SF.net SVN: logwatch:[104] scripts/services/pam_unix

Revision: 104
          http://logwatch.svn.sourceforge.net/logwatch/?rev=104&view=rev
Author:   mtremaine
Date:     2012-05-08 19:29:18 +0000 (Tue, 08 May 2012)
Log Message:
-----------
Added ruser detection for dovecot to silence that under RHEL/Centos 6 -mgt

Modified Paths:
--------------
    scripts/services/pam_unix

Modified: scripts/services/pam_unix
===================================================================
--- scripts/services/pam_unix	2012-05-02 15:46:51 UTC (rev 103)
+++ scripts/services/pam_unix	2012-05-08 19:29:18 UTC (rev 104)
@@ -232,6 +232,8 @@
          ($Detail >= 5) && $data{$service}{'Sessions Opened'}{$line}++;
       } elsif ($line =~ s/^authentication failure;.* user=(.+)$/$1/) {
          $data{$service}{'Authentication Failures'}{$line}++;
+      } elsif ($line =~ s/^authentication failure;.* ruser=(.+) rhost=.+$/$1/) {
+         $data{$service}{'Authentication Failures'}{$line}++;
       } elsif ($line =~ /check pass; user unknown/) {
          $data{$service}{'Invalid Users'}{'Unknown Account'}++;
       } elsif ($line =~ /session closed for user/) {

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.


------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/