| Newsgroups |
gmane.comp.log.logwatch.devel |
| Message-ID |
<[email protected]> |
Revision: 109
http://logwatch.svn.sourceforge.net/logwatch/?rev=109&view=rev
Author: mtremaine
Date: 2012-05-27 21:12:18 +0000 (Sun, 27 May 2012)
Log Message:
-----------
Redhat contributed patches - Jan Synacek - autogen mail tag, sshd undef, and secure service fixes -mgt
Modified Paths:
--------------
scripts/logwatch.pl
scripts/services/secure
scripts/services/sshd
Modified: scripts/logwatch.pl
===================================================================
--- scripts/logwatch.pl 2012-05-24 17:16:52 UTC (rev 108)
+++ scripts/logwatch.pl 2012-05-27 21:12:18 UTC (rev 109)
@@ -1147,6 +1147,9 @@
} else {
print OUTFILE "Subject: Logwatch for $Config{'hostname'} (${OStitle})\n";
}
+ #Add headers to recognize automatically generated email
+ print OUTFILE "Auto-Submitted: auto-generated\n";
+ print OUTFILE "Precedence: bulk\n";
#Add MIME
$out_mime = "MIME-Version: 1.0\n";
#Config{encode} switch
Modified: scripts/services/secure
===================================================================
--- scripts/services/secure 2012-05-24 17:16:52 UTC (rev 108)
+++ scripts/services/secure 2012-05-27 21:12:18 UTC (rev 109)
@@ -210,6 +210,7 @@
( $ThisLine =~ /^pam_xauth\[\d+\]: call_xauth: child returned \d/) or
( $ThisLine =~ /^su\[\d+\]: pam_authenticate: Authentication failure/) or
( $ThisLine =~ /^passwd\[\d+\]:/) or
+ ( $ThisLine =~ /^passwd: gkr-pam: .*/) or
( $ThisLine =~ /^reboot:/) or
( $ThisLine =~ /^sudo:/) or
( $ThisLine =~ /^su: pam_unix2: session (started|finished) for user [^ ]+, service [^ ]+/) or
@@ -245,10 +246,12 @@
( $ThisLine =~ /PAM pam_set_item: attempt to set conv\(\) to NULL/) or
( $ThisLine =~ /PAM pam_get_item: nowhere to place requested item/) or
( $ThisLine =~ /pam_succeed_if\(.*:.*\): error retrieving information about user [a-zA-Z]*/ ) or
+ ( $ThisLine =~ /pam_selinux_permit\(.*:.*\):/ ) or
( $ThisLine =~ /logfile turned over/) or # newsyslog on OpenBSD
( $ThisLine =~ /vmware-authd\[[0-9]+\]: PAM \[error: [^ ]+ cannot open shared object file: No such file or directory\]/) or
( $ThisLine =~ /vmware-authd\[[0-9]+\]: PAM adding faulty module: [^ ]+/) or
( $ThisLine =~ /Connection closed by/) or
+ ( $ThisLine =~ /Conversation error/) or
( $ThisLine =~ /sshd.*: Accepted \S+ for \S+ from [\d\.:a-f]+ port \d+/) or # ssh script reads this log
( $ThisLine =~ /userhelper.*: running (.*) with context (.*)/) or
( $ThisLine =~ /userhelper.*: pam_thinkfinger(.*): conversation failed/) or
@@ -256,8 +259,16 @@
( $ThisLine =~ /polkit-grant-helper\[\d+\]: granted authorization for [^ ]* to uid [0-9]* \[auth=.*\]/) or
( $ThisLine =~ /polkit-grant-helper\[\d+\]: granted authorization for [^ ]* to session .* \[uid=[0-9]*\]/) or
( $ThisLine =~ /polkit-grant-helper-pam\[\d+\]: pam_thinkfinger\(polkit:auth\): conversation failed/) or
- ( $ThisLine =~ /gdm-session-worker\[\d+\]: gkr-pam: no password is available for user/) or
- ( $ThisLine =~ /gdm-session-worker\[\d+\]: pam_namespace\(gdm:session\): Unmount of [^ ]* failed, Device or resource busy/)
+ ( $ThisLine =~ /polkitd\(authority=.*\): (Unr|R)egistered Authentication Agent/) or
+ ( $ThisLine =~ /(gdm-session-worker|gdm-password)\[\d+\]: gkr-pam: no password is available for user/) or
+ ( $ThisLine =~ /gkr-pam: the password for the login keyring was invalid/) or
+ ( $ThisLine =~ /groupadd\[\d+\]: group added to /) or # Details in other messages
+ ( $ThisLine =~ /groupmod\[\d+\]: group changed in \/etc\/gshadow /) or # Details in other messages
+ ( $ThisLine =~ /gdm-session-worker\[\d+\]: pam_namespace\(gdm:session\): Unmount of [^ ]* failed, Device or resource busy/) or
+ ( $ThisLine =~ /pkexec: pam_systemd(.*): /) or
+ ( $ThisLine =~ /pkexec: \S+: Executing command /) or
+ ( $ThisLine =~ /su: pam_systemd(.*): Failed to parse message: /) or
+ ( $ThisLine =~ /systemd-logind\[\d+\]: (New|Removed) session/)
) {
# Ignore these entries
} elsif ($ThisLine =~ /^spop3d/ || $ThisLine =~ /^pop\(\w+\)\[\d+\]:/) {
@@ -371,23 +382,23 @@
$UserLogin{$User}++;
} elsif ( ($User,undef) = ($ThisLine =~ /^com.apple.SecurityServer: authinternal authenticated user ([^ ]+) .*/ )) {
$UserLogin{$User}++;
- } elsif ( $ThisLine =~ s/^userdel\[\d+\]: delete user `(.+)'/$1/ ) {
+ } elsif ( $ThisLine =~ s/^userdel\[\d+\]: delete user ['`](.+)'/$1/ ) {
$DeletedUsers .= " $ThisLine\n";
} elsif ( $ThisLine =~ s/^(?:useradd|adduser)\[\d+\]: new user: name=(.+), (?:uid|UID)=(\d+).*$/$1 ($2)/ ) {
$NewUsers .= " $ThisLine\n";
- } elsif ( $ThisLine =~ s/^userdel\[\d+\]: remove(?:d)? group `(\S+)'( owned by \S+)?/$1/ ) {
+ } elsif ( $ThisLine =~ s/^userdel(?:\[\d+\])?: remove(?:d)? group [`'](\S+)'( owned by \S+)?/$1/ ) {
$DeletedGroups .= " $ThisLine\n";
} elsif ( $ThisLine =~ s/^groupdel\[\d+\]: remove group `(.+)'/$1/ ) {
$DeletedGroups .= " $ThisLine\n";
} elsif ( $ThisLine =~ s/^(?:useradd|adduser)\[\d+\]: new group: name=(.+), (?:gid|GID)=(\d+).*$/$1 ($2)/ ) {
$NewGroups .= " $ThisLine\n";
- } elsif ( (undef,$User,,undef,$Group) = ($ThisLine =~ /(usermod|useradd)\[\d+\]: add `([^ ]+)' to (shadow |)group `([^ ]+)'/ )) {
+ } elsif ( (undef,$User,,undef,$Group) = ($ThisLine =~ /(usermod|useradd)\[\d+\]: add [`']([^ ]+)' to (shadow|)group [`']([^ ]+)'/ )) {
$AddToGroup{$Group}{$User}++;
} elsif ( $ThisLine =~ s/^groupadd\[\d+\]: new group: name=(.+), (?:gid|GID)=(\d+).*$/$1 ($2)/ ) {
$NewGroups .= " $ThisLine\n";
} elsif ( $ThisLine =~ s/^gpasswd\[\d+\]: set members of // ) {
$SetGroupMembers .= " $ThisLine\n";
- } elsif ( $ThisLine =~ /^userdel\[\d+\]: delete `(.*)' from (shadow |)group `(.*)'\s*$/ ) {
+ } elsif ( $ThisLine =~ /^(?:userdel|usermod)\[\d+\]: delete [`'](.*)' from (shadow |)group [`'](.*)'\s*$/ ) {
push @RemoveFromGroup, " user $1 from group $3\n";
# This is an inetd lookup... $1 is the service (i.e. ftp), $2 is the response
# I don't think these are important to log at this time
@@ -416,6 +427,10 @@
$XauthMessage{$Message}++;
} elsif ( ($Group,$NewName) = ($ThisLine =~ /^groupmod\[\d+\]: change group `(.*)' to `(.*)'/)) {
$GroupRenamed{"$Group -> $NewName"}++;
+ } elsif ( $ThisLine =~ s/^groupmod\[\d+\]: group changed in \/etc\/group \(group (.+)\/(\d+)\).*/$1 ($2)/) {
+ $GroupChanged{"$ThisLine"}++;
+ } elsif ( $ThisLine =~ s/^groupmod\[\d+\]: group changed in \/etc\/group \(group (.+)\/\d+, new name: (.+)\).*/$1 -> $2/) {
+ $GroupChanged{"$ThisLine"}++;
} elsif ( ($User,$Home,$NewHome) = ($ThisLine =~ /^usermod\[\d+\]: change user `(.*)' home from `(.*)' to `(.*)'/)) {
$HomeChange{$User}{"$Home -> $NewHome"}++;
} elsif ( ($User,$From,$To) = ($ThisLine =~ /^usermod\[\d+\]:change user `(.*)' UID from `(.*)' to `(.*)'/)) {
@@ -474,7 +489,7 @@
} elsif ( ($Client,$User) = ($ThisLine =~ /vmware-authd\[\d+\]: login from ([0-9\.]+) as ([^ ]+)/) ) {
$UserLogin{$User}++;
} elsif ( ($User) = ($ThisLine =~ /vmware-authd\[\d+\]: pam_unix_auth\(vmware-authd:auth\): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= user=([^ ]*)/) ) {
- } elsif ( ($User) = ($ThisLine =~ /useradd.*failed adding user `(.*)', data deleted/) ) {# failed adding user/)) {# (.*), data deleted/)) {
+ } elsif ( ($User) = ($ThisLine =~ /useradd.*failed adding user [`'](.*)', data deleted/) ) {# failed adding user/)) {# (.*), data deleted/)) {
# useradd: failed adding user `rpcuser', data deleted
$FailedAddUsers{$User}++;
} elsif (($User,$Reason) = ($ThisLine =~ /dovecot-auth: pam_userdb\(dovecot:auth\): user `(.*)' denied access \((.*)\)/)) {
@@ -544,6 +559,13 @@
}
}
+if (keys %GroupChanged) {
+ print "Changed groups:\n";
+ foreach $Group (sort {$a cmp $b} keys %GroupChanged) {
+ print " $Group\n";
+ }
+}
+
if (keys %AddToGroup) {
print "\nAdded User to group:\n";
foreach $Group (sort {$a cmp $b} keys %AddToGroup) {
@@ -700,7 +722,7 @@
}
if ($RootLoginTTY) {
- print "\nRoot logins on tty\'s: $RootLoginTTY Time(s).\n";
+ print "\nRoot logins on ttys: $RootLoginTTY Time(s).\n";
}
if (keys %UserLogin) {
Modified: scripts/services/sshd
===================================================================
--- scripts/services/sshd 2012-05-24 17:16:52 UTC (rev 108)
+++ scripts/services/sshd 2012-05-27 21:12:18 UTC (rev 109)
@@ -449,9 +449,20 @@
foreach my $Host (keys %PotentialIllegalUsers) {
foreach my $User (keys %{$PotentialIllegalUsers{$Host}}) {
- while ($IllegalUsers{$Host}{$User} < $PotentialIllegalUsers{$Host}{$User}) {
- $IllegalUsers{$Host}{$User}++;
+ my @user_hosts = grep { $PotentialIllegalUsers{$_}{$User} } keys %PotentialIllegalUsers;
+
+ if ($Host eq "undef") {
+ if ((scalar @user_hosts) == 1 && $user_hosts[0] == "undef") {
+ # Report illegal user from "undef" only if there are no other hosts
+ # for the given user
+ $IllegalUsers{"undef"}{$User}++;
+ }
}
+ else {
+ while ($IllegalUsers{$Host}{$User} < $PotentialIllegalUsers{$Host}{$User}) {
+ $IllegalUsers{$Host}{$User}++;
+ }
+ }
}
}
This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/