Fwd: Patches for amavis, dovecot, sshd and vsftpd filters
"Kirk Bauer" <[email protected]>
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <[email protected]> |
---------- Forwarded message ---------- From: Johny Ågotnes <[email protected]> Date: Sun, 05 Oct 2008 12:36:12 +1000 Subject: Patches for amavis, dovecot, sshd and vsftpd filters To: [email protected] Guys, Please find attached patches for a few of the filters I'm using. I sent round 1 of these patches through a number of weeks ago, since then I've been patching in a small way every few days to get rid of the leftover noise from these filters. These 4 patches are against the latest CVS versions as of today, and I've been running with them successfully now for a wee while without getting any noise from the logs on my Production Gentoo server. Just for the record - I'm donating these patches with no strings attached from a licensing perspective (seems Logwatch has had some licensing issues). Thanks, :)Johny -- ------------------------------------------------------ Kirk Bauer <[email protected]> http://linux.kaybee.org | www.logwatch.org Author, Automating UNIX & Linux Administration _______________________________________________ Logwatch-Devel mailing list [email protected] http://www2.list.logwatch.org:81/mailman/listinfo/logwatch-devel
dovecot.diff
(text/plain, 2.2 KB)
--- dovecot 2008-08-11 17:38:02.000000000 +0200
+++ new/dovecot 2008-10-05 04:25:11.000000000 +0200
@@ -130,11 +130,15 @@
$Disconnected{$Reason}++;
} elsif (($Reason, $Host) = ($ThisLine =~ /TLS initialization failed/) ) {
$TLSInitFail++;
- } elsif (($Host) = ($ThisLine =~ /Aborted login \[(.*)\]/) ) {
+ } elsif (($Host) = ($ThisLine =~ /^dovecot: imap-login: Aborted login/) ) {
$Aborted{$Host}++;
# This is for Dovecot 1.0 series
+ } elsif ( $ThisLine =~ /failed: Authentication failure/) {
+ $AuthFail{"Fail"}++;
+ } elsif ( $ThisLine =~ /failed: User not known/) {
+ $AuthFail{"Unknown User"}++;
} elsif ($ThisLine =~ /Disconnected for inactivity/) {
$Disconnected{"Inactivity"}++;
} elsif ($ThisLine =~ /Disconnected in IDLE/) {
@@ -143,6 +147,8 @@
$Disconnected{"no reason"}++;
} elsif (($Reason) = ($ThisLine =~ /pop3-login: Disconnected: (.+)/) ) {
$Disconnected{"no reason"}++;
+ } elsif (($Reason) = ($ThisLine =~ /imap-login: Disconnected (.+)/) ) {
+ $Disconnected{"no reason"}++;
} elsif (($Reason) = ($ThisLine =~ /imap-login: Disconnected: (.+)/) ) {
$Disconnected{"no reason"}++;
} elsif (($Reason) = ($ThisLine =~ /IMAP.+: Disconnected: (.+)/) ) {
@@ -165,7 +171,7 @@
print "\nDovecot was killed, and not restarted afterwards.\n";
}
-if ( ( $Detail >=5 ) and $Restarts ) {
+if ( ( $Detail >=0 ) and $Restarts ) {
print "\nDovecot restarted $Restarts time(s).";
}
@@ -215,7 +221,7 @@
" |" . " " x $totalSpaceLength . $TotalCount . "\n";
}
-if ( ( $Detail >= 10 ) and (keys %Login)) {
+if ( ( $Detail >= 0 ) and (keys %Login)) {
print "\n\nDovecot IMAP and POP3 Successful Logins:";
$LoginCount = 0;
foreach my $User (keys %Login) {
@@ -245,7 +251,14 @@
print "\n\nTotal: $LoginCount successful logins";
}
-if (keys %Disconnected) {
+if ((keys %AuthFail) && ($Detail >= 0)) {
+ print "\n\nDovecot AuthFail:";
+ foreach my $Reason (sort keys %AuthFail) {
+ print "\n $Reason: $AuthFail{$Reason} Time(s)";
+ }
+}
+
+if ((keys %Disconnected) && ($Detail >= 10)) {
print "\n\nDovecot disconnects:";
foreach my $Reason (sort keys %Disconnected) {
print "\n $Reason: $Disconnected{$Reason} Time(s)";
sshd.diff
(text/plain, 784 B)
--- sshd 2008-05-12 23:44:26.000000000 +0200
+++ new/sshd 2008-10-05 04:25:11.000000000 +0200
@@ -343,7 +343,7 @@
$BadLogins{$Host}{"$User/$Method"}++;
} elsif ($ThisLine =~ s/^(log: )?Could not reverse map address ([^ ]*).*$/$2/) {
$NoRevMap{$ThisLine}++;
- } elsif ( my ($Address) = ($ThisLine =~ /^reverse mapping checking getaddrinfo for ([^ ]*) failed - POSSIBLE BREAK-?IN ATTEMPT!/)) {
+ } elsif ( my ($Address) = ($ThisLine =~ /^reverse mapping checking getaddrinfo for ([^ ]*) ([^ ]*) failed - POSSIBLE BREAK-?IN ATTEMPT!/)) {
$NoRevMap{$Address}++;
} elsif ( my ($IP,$Address) = ($ThisLine =~ /^Address ([^ ]*) maps to ([^ ]*), but this does not map back to the address - POSSIBLE BREAK-?IN ATTEMPT!/)) {
$NoRevMap{"$Address($IP)"}++;
vsftpd.diff
(text/plain, 1.2 KB)
--- vsftpd 2008-07-15 16:57:32.000000000 +0200
+++ new/vsftpd 2008-10-05 04:25:11.000000000 +0200
@@ -83,7 +83,7 @@
}
}
-if ( (keys %AnonLogins) and ($Detail >= 5) ) {
+if (keys %AnonLogins) {
print "\nAnonymous FTP Logins:\n";
foreach $ThisOne (keys %AnonLogins) {
print $ThisOne . $AnonLogins{$ThisOne} . " Time(s)\n";
@@ -111,11 +111,11 @@
if ( ( $#UploadedFiles >= 0 ) or
( $#FailedUploadedFiles >= 0 ) ) {
- if ( $#UploadedFiles >= 0) {
+ if ( ( $#UploadedFiles >= 0) && ( $Detail >= 5) ) {
print "\nIncoming FTP Files:\n";
print @UploadedFiles;
}
- if ( $#FailedUploadedFiles >= 0) {
+ if ( ( $#FailedUploadedFiles >= 0) && ( $Detail >= 5) ) {
print "\nFailed Uploads\n";
print @FailedUploadedFiles;
}
@@ -124,11 +124,11 @@
if ( ( $#DownloadedFiles >= 0 ) or
( $#FailedDownloadedFiles >=0 ) ) {
- if ( $#DownloadedFiles >= 0) {
+ if ( ( $#DownloadedFiles >= 0) && ( $Detail >= 5) ) {
print "\nOutgoing FTP Files:\n";
print @DownloadedFiles;
}
- if ( $#FailedDownloadedFiles >= 0) {
+ if ( ( $#FailedDownloadedFiles >= 0) && ( $Detail >= 5) ) {
print "\nFailed Downloads\n";
print @FailedDownloadedFiles;
}
amavis.diff
(text/plain, 2.2 KB)
--- amavis 2008-06-17 23:46:40.000000000 +0200
+++ new/amavis 2008-10-05 04:25:11.000000000 +0200
@@ -74,6 +74,12 @@
or ($ThisLine =~ /^Checking/)
or ($ThisLine =~ /^(ESMTP|FWD|SEND) via/)
or ($ThisLine =~ /^spam_scan/)
+ or ($ThisLine =~ /^virus_scan/)
+ or ($ThisLine =~ /^run_av/)
+ or ($ThisLine =~ /^check_header/)
+ or ($ThisLine =~ /^p.path/)
+ or ($ThisLine =~ /sender addr ignored/)
+ or ($ThisLine =~ /^smtp session rundown/)
or ($ThisLine =~ /^Not-Delivered/)
or ($ThisLine =~ /^SpamControl/)
or ($ThisLine =~ /^SPAM-TAG/)
@@ -86,14 +92,26 @@
or ($ThisLine =~ /^.* code[ \t]+(NOT)? loaded/)
or ($ThisLine =~ /^tempdir being removed/)
or ($ThisLine =~ /^Found primary av scanner/)
+ or ($ThisLine =~ /^Turning AV infection into a spam report/)
+ or ($ThisLine =~ /^smtp session most likely still valid/)
+ or ($ThisLine =~ /^DSN: NOTIFICATION: Action:failed, LOCAL 554 Banned/)
+ or ($ThisLine =~ /^do_notify_and_quarantine: rec_bl_ccat/)
+ or ($ThisLine =~ /^Cached virus check expired, TTL/)
+ or ($ThisLine =~ /^Cached spam check expired, TTL/)
+ or ($ThisLine =~ /^do_unzip: [^ ]* members are encrypted, none extracted, archive retained/)
+ or ($ThisLine =~ /^WARN: MIME::Parser error: part did not end with expected boundary/)
or ($ThisLine =~ /^Found \$[\S]+[\s]+at/)
or ($ThisLine =~ /^No \$[\S]+,[\s]+not using it/)
+ or ($ThisLine =~ /^bounce unverifiable/)
+ or ($ThisLine =~ /^smtp resp to NOOP/)
or ($ThisLine =~ /^Found secondary av scanner/)
or ($ThisLine =~ /^Using internal av scanner code/)
or ($ThisLine =~ /^mail_via_smtp/)
or ($ThisLine =~ /^local delivery: /)
or ($ThisLine =~ /^cached [a-zA-Z0-9]+ /)
or ($ThisLine =~ /^loaded policy bank/)
+ or ($ThisLine =~ /^extra modules loaded:/)
+ or ($ThisLine =~ /smtp connection cache/)
or ($ThisLine =~ /^wbl: soft-whitelisted/)
or ($ThisLine =~ /^p\d+ \d+(\/\d+)* Content-Type: /)
or ($ThisLine =~ /^Requesting (a |)process rundown after [0-9]+ tasks/)