Various small fixes

Index: scripts/logwatch.pl
===================================================================
--- scripts/logwatch.pl	(revision 107)
+++ scripts/logwatch.pl	(working copy)
@@ -1147,6 +1147,9 @@
          } else {
             print OUTFILE "Subject: Logwatch for $Config{'hostname'} (${OStitle})\n";
          }
+         #Add headers to recognize automatically generated email
+         print OUTFILE "Auto-Submitted: auto-generated\n";
+         print OUTFILE "Precedence: bulk\n";
          #Add MIME
          $out_mime = "MIME-Version: 1.0\n";
          #Config{encode} switch

Index: scripts/services/sshd
===================================================================
--- scripts/services/sshd	(revision 107)
+++ scripts/services/sshd	(working copy)
@@ -449,9 +449,20 @@
 
 foreach my $Host (keys %PotentialIllegalUsers) {
    foreach my $User (keys %{$PotentialIllegalUsers{$Host}}) {
-      while ($IllegalUsers{$Host}{$User} < $PotentialIllegalUsers{$Host}{$User}) {
-	 $IllegalUsers{$Host}{$User}++;
+      my @user_hosts = grep { $PotentialIllegalUsers{$_}{$User} } keys %PotentialIllegalUsers;
+
+      if ($Host eq "undef") {
+         if ((scalar @user_hosts) == 1 && $user_hosts[0] == "undef") {
+            # Report illegal user from "undef" only if there are no other hosts
+            # for the given user
+            $IllegalUsers{"undef"}{$User}++;
+         }
       }
+      else {
+         while ($IllegalUsers{$Host}{$User} < $PotentialIllegalUsers{$Host}{$User}) {
+            $IllegalUsers{$Host}{$User}++;
+         }
+      }
    }
 }

Index: scripts/services/secure
===================================================================
--- scripts/services/secure	(revision 107)
+++ scripts/services/secure	(working copy)
@@ -210,6 +210,7 @@
       ( $ThisLine =~ /^pam_xauth\[\d+\]: call_xauth: child returned \d/) or
       ( $ThisLine =~ /^su\[\d+\]: pam_authenticate: Authentication failure/) or
       ( $ThisLine =~ /^passwd\[\d+\]:/) or
+      ( $ThisLine =~ /^passwd: gkr-pam: .*/) or
       ( $ThisLine =~ /^reboot:/) or
       ( $ThisLine =~ /^sudo:/) or
       ( $ThisLine =~ /^su: pam_unix2: session (started|finished) for user [^ ]+, service [^ ]+/) or
@@ -245,10 +246,12 @@
       ( $ThisLine =~ /PAM pam_set_item: attempt to set conv\(\) to NULL/) or
       ( $ThisLine =~ /PAM pam_get_item: nowhere to place requested item/) or
       ( $ThisLine =~ /pam_succeed_if\(.*:.*\): error retrieving information about user [a-zA-Z]*/ ) or
+      ( $ThisLine =~ /pam_selinux_permit\(.*:.*\):/ ) or
       ( $ThisLine =~ /logfile turned over/) or # newsyslog on OpenBSD
       ( $ThisLine =~ /vmware-authd\[[0-9]+\]: PAM \[error: [^ ]+ cannot open shared object file: No such file or directory\]/) or
       ( $ThisLine =~ /vmware-authd\[[0-9]+\]: PAM adding faulty module: [^ ]+/) or
       ( $ThisLine =~ /Connection closed by/) or
+      ( $ThisLine =~ /Conversation error/) or
       ( $ThisLine =~ /sshd.*: Accepted \S+ for \S+ from [\d\.:a-f]+ port \d+/) or # ssh script reads this log
       ( $ThisLine =~ /userhelper.*: running (.*) with context (.*)/) or
       ( $ThisLine =~ /userhelper.*: pam_thinkfinger(.*): conversation failed/) or
@@ -256,8 +259,16 @@
       ( $ThisLine =~ /polkit-grant-helper\[\d+\]: granted authorization for [^ ]* to uid [0-9]* \[auth=.*\]/) or
       ( $ThisLine =~ /polkit-grant-helper\[\d+\]: granted authorization for [^ ]* to session .* \[uid=[0-9]*\]/) or
       ( $ThisLine =~ /polkit-grant-helper-pam\[\d+\]: pam_thinkfinger\(polkit:auth\): conversation failed/) or
-      ( $ThisLine =~ /gdm-session-worker\[\d+\]: gkr-pam: no password is available for user/) or
-      ( $ThisLine =~ /gdm-session-worker\[\d+\]: pam_namespace\(gdm:session\): Unmount of [^ ]* failed, Device or resource busy/)
+      ( $ThisLine =~ /polkitd\(authority=.*\): (Unr|R)egistered Authentication Agent/) or
+      ( $ThisLine =~ /(gdm-session-worker|gdm-password)\[\d+\]: gkr-pam: no password is available for user/) or
+      ( $ThisLine =~ /gkr-pam: the password for the login keyring was invalid/) or
+      ( $ThisLine =~ /groupadd\[\d+\]: group added to /) or    # Details in other messages
+      ( $ThisLine =~ /groupmod\[\d+\]: group changed in \/etc\/gshadow /) or    # Details in other messages
+      ( $ThisLine =~ /gdm-session-worker\[\d+\]: pam_namespace\(gdm:session\): Unmount of [^ ]* failed, Device or resource busy/) or
+      ( $ThisLine =~ /pkexec: pam_systemd(.*): /) or
+      ( $ThisLine =~ /pkexec: \S+: Executing command /) or
+      ( $ThisLine =~ /su: pam_systemd(.*): Failed to parse message: /) or
+      ( $ThisLine =~ /systemd-logind\[\d+\]: (New|Removed) session/)
    ) {
       # Ignore these entries
    } elsif ($ThisLine =~ /^spop3d/ || $ThisLine =~ /^pop\(\w+\)\[\d+\]:/) {
@@ -371,23 +382,23 @@
       $UserLogin{$User}++;
    } elsif ( ($User,undef) = ($ThisLine =~ /^com.apple.SecurityServer: authinternal authenticated user ([^ ]+) .*/ )) {
       $UserLogin{$User}++;
-   } elsif ( $ThisLine =~ s/^userdel\[\d+\]: delete user `(.+)'/$1/ ) {
+   } elsif ( $ThisLine =~ s/^userdel\[\d+\]: delete user ['`](.+)'/$1/ ) {
       $DeletedUsers .= "   $ThisLine\n";
    } elsif ( $ThisLine =~ s/^(?:useradd|adduser)\[\d+\]: new user: name=(.+), (?:uid|UID)=(\d+).*$/$1 ($2)/ ) {
       $NewUsers .= "   $ThisLine\n";
-   } elsif ( $ThisLine =~ s/^userdel\[\d+\]: remove(?:d)? group `(\S+)'( owned by \S+)?/$1/ ) {
+   } elsif ( $ThisLine =~ s/^userdel(?:\[\d+\])?: remove(?:d)? group [`'](\S+)'( owned by \S+)?/$1/ ) {
       $DeletedGroups .= "   $ThisLine\n";
    } elsif ( $ThisLine =~ s/^groupdel\[\d+\]: remove group `(.+)'/$1/ ) {
       $DeletedGroups .= "   $ThisLine\n";
    } elsif ( $ThisLine =~ s/^(?:useradd|adduser)\[\d+\]: new group: name=(.+), (?:gid|GID)=(\d+).*$/$1 ($2)/ ) {
       $NewGroups .= "   $ThisLine\n";
-   } elsif ( (undef,$User,,undef,$Group) = ($ThisLine =~ /(usermod|useradd)\[\d+\]: add `([^ ]+)' to (shadow |)group `([^ ]+)'/ )) {
+   } elsif ( (undef,$User,,undef,$Group) = ($ThisLine =~ /(usermod|useradd)\[\d+\]: add [`']([^ ]+)' to (shadow|)group [`']([^ ]+)'/ )) {
       $AddToGroup{$Group}{$User}++;
    } elsif ( $ThisLine =~ s/^groupadd\[\d+\]: new group: name=(.+), (?:gid|GID)=(\d+).*$/$1 ($2)/ ) {
       $NewGroups .= "   $ThisLine\n";
    } elsif ( $ThisLine =~ s/^gpasswd\[\d+\]: set members of // ) {
       $SetGroupMembers .= "   $ThisLine\n";
-   } elsif ( $ThisLine =~ /^userdel\[\d+\]: delete `(.*)' from (shadow |)group `(.*)'\s*$/ ) {
+   } elsif ( $ThisLine =~ /^(?:userdel|usermod)\[\d+\]: delete [`'](.*)' from (shadow |)group [`'](.*)'\s*$/ ) {
       push @RemoveFromGroup, "    user $1 from group $3\n";
       # This is an inetd lookup... $1 is the service (i.e. ftp), $2 is the response
       # I don't think these are important to log at this time
@@ -416,6 +427,10 @@
       $XauthMessage{$Message}++;
    } elsif ( ($Group,$NewName) = ($ThisLine =~ /^groupmod\[\d+\]: change group `(.*)' to `(.*)'/)) {
       $GroupRenamed{"$Group -> $NewName"}++;
+   } elsif ( $ThisLine =~ s/^groupmod\[\d+\]: group changed in \/etc\/group \(group (.+)\/(\d+)\).*/$1 ($2)/) {
+      $GroupChanged{"$ThisLine"}++;
+   } elsif ( $ThisLine =~ s/^groupmod\[\d+\]: group changed in \/etc\/group \(group (.+)\/\d+, new name: (.+)\).*/$1 -> $2/) {
+      $GroupChanged{"$ThisLine"}++;
    } elsif ( ($User,$Home,$NewHome) = ($ThisLine =~ /^usermod\[\d+\]: change user `(.*)' home from `(.*)' to `(.*)'/)) {
       $HomeChange{$User}{"$Home -> $NewHome"}++;
    } elsif ( ($User,$From,$To) = ($ThisLine =~ /^usermod\[\d+\]:change user `(.*)' UID from `(.*)' to `(.*)'/)) {
@@ -474,7 +489,7 @@
    } elsif ( ($Client,$User) = ($ThisLine =~ /vmware-authd\[\d+\]: login from ([0-9\.]+) as ([^ ]+)/) ) {
       $UserLogin{$User}++;
    } elsif ( ($User) = ($ThisLine =~ /vmware-authd\[\d+\]: pam_unix_auth\(vmware-authd:auth\): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=([^ ]*)/) ) {
-   } elsif ( ($User) = ($ThisLine =~ /useradd.*failed adding user `(.*)', data deleted/) ) {# failed adding user/)) {# (.*), data deleted/)) {
+   } elsif ( ($User) = ($ThisLine =~ /useradd.*failed adding user [`'](.*)', data deleted/) ) {# failed adding user/)) {# (.*), data deleted/)) {
       # useradd: failed adding user `rpcuser', data deleted
       $FailedAddUsers{$User}++;
    } elsif (($User,$Reason) = ($ThisLine =~ /dovecot-auth: pam_userdb\(dovecot:auth\): user `(.*)' denied access \((.*)\)/)) {
@@ -544,6 +559,13 @@
    }
 }
 
+if (keys %GroupChanged) {
+   print "Changed groups:\n";
+   foreach $Group (sort {$a cmp $b} keys %GroupChanged) {
+      print "   $Group\n";
+   }
+}
+
 if (keys %AddToGroup) {
    print "\nAdded User to group:\n";
    foreach $Group (sort {$a cmp $b} keys %AddToGroup) {
@@ -700,7 +722,7 @@
 }
 
 if ($RootLoginTTY) {
-   print "\nRoot logins on tty\'s: $RootLoginTTY Time(s).\n";
+   print "\nRoot logins on ttys: $RootLoginTTY Time(s).\n";
 }
 
 if (keys %UserLogin) {