Fwd: sudo patch to count failed authentications

---------- Forwarded message ----------
From: Alan Brenner <[email protected]>
Date: Tue, 23 Dec 2008 15:05:12 -0500
Subject: sudo patch to count failed authentications
To: [email protected]

diff -uNr logwatch-7.3.6.orig/scripts/services/sudo logwatch-7.3.6/
scripts/services/sudo
--- logwatch-7.3.6.orig/scripts/services/sudo   2008-12-23
12:16:02.000000000 -0500
+++ logwatch-7.3.6/scripts/services/sudo        2008-12-23
12:16:36.000000000 -0500
@@ -22,7 +22,7 @@
  use strict;
  my %OtherList;

-my ($Debug,  $Detail,  %byUser, %byUserSum);
+my (%byUser, %byUserSum, %authFail);
  my $Debug = $ENV{'LOGWATCH_DEBUG'} || 0;
  my $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;
  # maximum number of commands user ran to display at low detail
@@ -32,13 +32,16 @@

  while (defined(my $ThisLine = <STDIN>)) {
     if ( ($user, $error, $tty, $dir, $euser, $cmd, $args) = $ThisLine
=~ m/^\s*(\w+) : (.*; )?TTY=(\S+) ; PWD=(.*?) ; USER=(\S+) ;
COMMAND=(\S+)( ?.*)/) {
-      push @{$byUser{$user}{$euser}}, [$error . $cmd,$args, $dir,
$tty];
+      push @{$byUser{$user}{$euser}}, [$error . $cmd, $args, $dir,
$tty];
        $byUserSum{$user}{$euser}{$cmd} += 1;
+   } elsif ( ($dir, $cmd, $args, $tty, $euser, $user) = $ThisLine =~
m/^pam_unix.sudo:auth.: authentication failure; logname=(\S+)\s+uid=(\d
+)\s+euid=(\d+)\s+tty=(\S+)\s+ruser=(.*?)\s+user=(\S+)/) {
+      $user ||= $euser;
+      $authFail{"$user ($dir): $cmd ($args) on $tty"}++;
     } elsif ( ($user,$euser) = $ThisLine =~ /^\s*(\w+) : no passwd
entry for (\w+)\!$/) {
        push @{$byUser{$user}{$euser . " (No such user)"}}, ["No
password entry"];
     } else {
-   chomp($ThisLine);
-   $OtherList{$ThisLine}++;
+      chomp($ThisLine);
+      $OtherList{$ThisLine}++;
     }
  }

@@ -68,6 +71,12 @@
     } # foreach $euser
  } # foreach $user

+if (keys %authFail) {
+   print "\n\n**Authentication Failure Entries**";
+   foreach my $line (sort {$OtherList{$b}<=>$OtherList{$a} } keys
%authFail) {
+      print "\n   $line: $authFail{$line} Time(s)";
+   }
+}

  if (keys %OtherList) {
     print "\n\n**Unmatched Entries**";


-- 
Sent from my mobile device


------------------------------------------------------
Kirk Bauer <[email protected]>
http://linux.kaybee.org | www.logwatch.org
Author, Automating UNIX & Linux Administration