SF.net SVN: logwatch:[108] scripts/services/openvpn

Revision: 108
          http://logwatch.svn.sourceforge.net/logwatch/?rev=108&view=rev
Author:   opoplawski
Date:     2012-05-24 17:16:52 +0000 (Thu, 24 May 2012)
Log Message:
-----------
Handle TLS: Username/Password authentication succeeded for username messages
Handle PLUGIN_CALL messages
Only output Cipher messages at Detail 10

Modified Paths:
--------------
    scripts/services/openvpn

Modified: scripts/services/openvpn
===================================================================
--- scripts/services/openvpn	2012-05-17 15:41:03 UTC (rev 107)
+++ scripts/services/openvpn	2012-05-24 17:16:52 UTC (rev 108)
@@ -109,6 +109,8 @@
    }  elsif (($status, $dn) = ( $ThisLine =~ /^VERIFY X509NAME (.*): (.*)/ )) {
       #VERIFY X509NAME OK: /C=US/ST=TX/O=Aidant.Enterprises/OU=IT/CN=delta.aidant.net/Email=keymaster-g3L/[email protected]: 23 Time(s)
       $VerifyList{"status: $status X509Name DN: $dn"}++;
+   } elsif ($ThisLine =~ /^TLS: Username\/Password authentication/) {
+      $VerifyList{$ThisLine}++;
    } elsif ($ThisLine =~ m/^MULTI: new incoming connection would exceed maximum number of clients/) {
       $MaxClients++;
    } elsif ($ThisLine =~ m/^OpenVPN [\d.]+ [\w-]+ [\[\]\w ]+ built on [\w]+ +[\d]+ [\d]+$/) {
@@ -132,6 +134,12 @@
    } elsif ((($Err) = ($ThisLine =~ /(read UDPv4 \[ECONNREFUSED\]: Connection refused \(code=111\))/)) or
       (($Err) = ($ThisLine =~ /(read UDPv4 \[EHOSTUNREACH\]: No route to host \(code=113\))/))) {
       $Error{$Err}++;
+   } elsif (($plugin,$call,$status) = ($ThisLine =~ /^PLUGIN_CALL: POST (.*)\/(PLUGIN_.*) status=(.*)/)) {
+      if ($status == 0) {
+         $PluginCallOK{$plugin}{$call}++;
+      } else {
+         $PluginCallFailure{$plugin}{$call}++;
+      }
    } else {
       # Report any unmatched entries...
       # remove PID from named messages
@@ -181,7 +189,7 @@
    }
 }
 
-if (keys %Auth) {
+if (keys %Auth and $Detail >= 10) {
    print "\nCiphers used for Authentication:";
    foreach $channel (sort keys %Auth) {
       print "\n   $channel:";
@@ -195,7 +203,7 @@
    }
 }
 
-if (keys %Crypt) {
+if (keys %Crypt and $Detail >= 10) {
    print "\nCiphers used for Encryption:";
    foreach $channel (sort keys %Crypt) {
       print "\n   $channel:";
@@ -230,6 +238,30 @@
    }
 }
 
+if (keys %PluginCallFailures) {
+   print "\nPlugin Call Failures:";
+   foreach $plugin (sort keys %PluginCallFailures) {
+      print "\n   Plugin $plugin:";
+      foreach $call (sort keys %{$PluginCallFailures{$plugin}}) {
+         $times = $PluginCallFailures{$plugin}{$call};
+         print "\n      $call failed $PluginCallFailures{$plugin}{$call} Time(s)";
+      }
+      print "\n";
+   }
+}
+
+if (keys %PluginCallOK and $Detail >= 5) {
+   print "\nPlugin Call OK:";
+   foreach $plugin (sort keys %PluginCallOK) {
+      print "\n   Plugin $plugin:";
+      foreach $call (sort keys %{$PluginCallOK{$plugin}}) {
+         $times = $PluginCallOK{$plugin}{$call};
+         print "\n      $call succeeded $PluginCallOK{$plugin}{$call} Time(s)";
+      }
+      print "\n";
+   }
+}
+
 if (keys %OtherList) {
    print "\n**Unmatched Entries**\n";
    foreach $line (sort {$a cmp $b} keys %OtherList) {

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.


------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/