Revision: 97
http://logwatch.svn.sourceforge.net/logwatch/?rev=97&view=rev
Author: stefjakobs
Date: 2012-04-16 14:11:25 +0000 (Mon, 16 Apr 2012)
Log Message:
-----------
freeradius service script from Jonas Marczona added.
shared script removeheaders modified to remove freeradius style dates
Modified Paths:
--------------
scripts/shared/removeheaders
Added Paths:
-----------
conf/logfiles/freeradius.conf
conf/services/freeradius.conf
scripts/services/freeradius
Added: conf/logfiles/freeradius.conf
===================================================================
--- conf/logfiles/freeradius.conf (rev 0)
+++ conf/logfiles/freeradius.conf 2012-04-16 14:11:25 UTC (rev 97)
@@ -0,0 +1,22 @@
+##########################################################################
+# freeradius
+# Marczona
+# 28.12.2011
+##########################################################################
+
+
+# What actual file? Defaults to LogPath if not absolute path....
+LogFile = freeradius/radius.log
+
+# If the archives are searched, here is one or more line
+# (optionally containing wildcards) that tell where they are...
+#If you use a "-" in naming add that as well -mgt
+Archive = freeradius/radius.log.*
+
+# Expand the repeats (actually just removes them now)
+#*ExpandRepeats
+
+# Keep only the lines in the proper date range...
+*ApplyStdDate
+
+# vi: shiftwidth=3 tabstop=3 et
Added: conf/services/freeradius.conf
===================================================================
--- conf/services/freeradius.conf (rev 0)
+++ conf/services/freeradius.conf 2012-04-16 14:11:25 UTC (rev 97)
@@ -0,0 +1,26 @@
+##########################################################################
+# freeradius conf
+# Marczona 28.12.2011
+##########################################################################
+
+# You can put comments anywhere you want to. They are effective for the
+# rest of the line.
+
+# this is in the format of <name> = <value>. Whitespace at the beginning
+# and end of the lines is removed. Whitespace before and after the = sign
+# is removed. Everything is case *insensitive*.
+
+# Yes = True = On = 1
+# No = False = Off = 0
+
+Title = "freeradius FKM variant"
+
+# Which logfile group...
+LogFile = freeradius
+
+#Detail=med
+
+#*OnlyService = radiusd
+*RemoveHeaders
+
+# vi: shiftwidth=3 tabstop=3 et
Added: scripts/services/freeradius
===================================================================
--- scripts/services/freeradius (rev 0)
+++ scripts/services/freeradius 2012-04-16 14:11:25 UTC (rev 97)
@@ -0,0 +1,119 @@
+
+##########################################################################
+# freeradius logwatch filter
+# written by Jonas Marczona 28.12.2011
+#
+## Covered under the included MIT/X-Consortium License:
+## http://www.opensource.org/licenses/mit-license.php
+## All modifications and contributions by other persons to
+## this script are assumed to have been donated to the
+## Logwatch project and thus assume the above copyright
+## and licensing terms.
+##########################################################################
+
+$^W=1;
+use strict;
+
+my $Debug = $ENV{'LOGWATCH_DEBUG'} || 0;
+my $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;
+
+my $DebugCounter = 0;
+
+if ( $Debug >= 5 ) {
+ print STDERR "\n\nDEBUG: Inside freeradius Filter \n\n";
+ $DebugCounter = 1;
+}
+
+my %OtherList = ();
+
+my %loginsOk = ();
+my %wrongPassword = ();
+my %wrongUser = ();
+my %wrong_ip = ();
+
+my $ThisLine;
+while (defined($ThisLine = <STDIN>)) {
+ if ( $Debug >= 5 ) {
+ print STDERR "DEBUG($DebugCounter): $ThisLine";
+ $DebugCounter++;
+ }
+ chomp($ThisLine);
+
+ if ( my $user = ($ThisLine =~ m/^Auth: Login OK: \[(.+)\] \(from client [^ ]* port \d{1,10} cli \d+.\d+.\d+.\d+\)/) ) {
+ $loginsOk{$user}++;
+ } elsif ( my ($user, $ip) = ( $ThisLine =~ m/^Auth: Login incorrect \(rlm_pap: CLEAR TEXT password check failed\): \[(.+)\] \(from client [^ ]* port \d{1,10} cli (\d+.\d+.\d+.\d+)\)/) ) {
+ $wrongPassword{$ip}{$user}++;
+ $wrong_ip{$ip}++;
+ } elsif ( my ($user, $ip) = ($ThisLine =~ m/^Auth: Login incorrect: \[(.+)\] \(from client [^ ]* port \d{1,10} cli (\d+.\d+.\d+.\d+)\)/) ) {
+ $wrongUser{$ip}{$user}++;
+ $wrong_ip{$ip}++;
+ } else {
+ # Report any unmatched entries...
+ $OtherList{$ThisLine}++;
+ }
+}
+
+
+#################################
+# Output section
+################################
+
+sub compPerIp {
+ return $wrong_ip{$b} <=> $wrong_ip{$a};
+}
+
+if ($Detail >= 10) {
+ if (keys %loginsOk) {
+ print "\nSuccessful logins:\n";
+ my $user;
+ foreach $user (sort {$loginsOk{$b} <=> $loginsOk{$a}} keys %loginsOk) {
+ # print $user, " ";
+ # print $loginsOk{$user};
+ printf " %10s : %3d time(s)\n", $user, $loginsOk{$user};
+ }
+ }
+}
+
+if ($Detail >= 5) {
+ if (keys %wrong_ip) {
+ print "\nSum of failed logins per ip (wrong password or user)\n";
+ foreach my $ip (sort compPerIp keys %wrong_ip) {
+ printf " %15s : %3d time(s)\n", $ip, $wrong_ip{$ip};
+ }
+ }
+}
+
+if (keys %wrongUser) {
+ print "\nFailed logins - wrong user name:\n";
+ foreach my $ip (sort compPerIp keys %wrongUser) {
+ printf " %15s\n", $ip;
+ my $users = $wrongUser{$ip};
+ foreach my $user (sort {$users->{$b} <=> $users->{$a}} keys %$users) {
+ printf "%20s : %3d time(s)\n", $user, $users->{$user};
+ }
+ }
+}
+
+if (keys %wrongPassword) {
+ print "\nFailed logins - wrong password:\n";
+ foreach my $ip (sort compPerIp keys %wrongPassword) {
+ my $users = $wrongPassword{$ip};
+ printf " %15s\n", $ip ;
+ foreach my $user (sort {$users->{$b} <=> $users->{$a}} keys %$users) {
+ #print " $user ", $users->{$user}, " time(s)\n";
+ printf "%20s : %3d time(s)\n", $user, $users->{$user};
+ }
+ }
+}
+
+if (keys %OtherList) {
+ print "\n**** Unmatched entries ****\n";
+ foreach (keys %OtherList) {
+ print " $_ : $OtherList{$_} Time(s)\n";
+ }
+}
+
+exit(0);
+
+# vi: shiftwidth=3 tabstop=3 syntax=perl et
+
Property changes on: scripts/services/freeradius
___________________________________________________________________
Added: svn:executable
+ *
Modified: scripts/shared/removeheaders
===================================================================
--- scripts/shared/removeheaders 2012-04-14 17:42:45 UTC (rev 96)
+++ scripts/shared/removeheaders 2012-04-16 14:11:25 UTC (rev 97)
@@ -32,6 +32,8 @@
# OnlyService is called before RemoveHeaders, so this should only be done
# on the required services.
$ThisLine =~ s/^... .. ..:..:.. [^ ]* //;
+ # remove date-prefix, eg Tue Dec 27 21:36:48 2011 : <message>, from each line
+ $ThisLine =~ s/^\w{3} \w{3} .. \d{2}:\d{2}:\d{2} \d{4}\s?:\s?//;
print $ThisLine;
}
This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.
------------------------------------------------------------------------------
For Developers, A Lot Can Happen In A Second.
Boundary is the first to Know...and Tell You.
Monitor Your Applications in Ultra-Fine Resolution. Try it FREE!
http://p.sf.net/sfu/Boundary-d2dvs2
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.