logwatch patches - proftpd
"gulikoza" <[email protected]>
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <[email protected]> |
Attached patch fixes:
- proftpd-messages does not match:
**Unmatched Entries**
pam_unix(proftpd:session): session opened for user gulikoza by (uid=0)
- if TLS is used ftpd-xferlog will not match the line:
Wed Jun 19 02:17:20 2013 227 10.1.1.100 100 /path/to/file b _ o r gulikoza
ftps 0 * c
- pam_unix handles sessions from ftpd and vsftpd, but not proftpd:
proftpd:
Unknown Entries:
session opened for user gulikoza by (uid=0): 4 Time(s)
Regards,
gulikoza
------------------------------------------------------------------------------
This SF.net email is sponsored by Windows:
Build for Windows Store.
http://p.sf.net/sfu/windows-dev2dev
_______________________________________________
Logwatch-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/logwatch-devel
logwatch-proftpd.patch
(application/octet-stream, 1.9 KB)
diff --git a/scripts/services/proftpd-messages b/scripts/services/proftpd-messages
--- a/scripts/services/proftpd-messages
+++ b/scripts/services/proftpd-messages
@@ -80,6 +80,7 @@ while (defined($ThisLine = <STDIN>)) {
( $ThisLine =~ /^FTP session closed/ ) or
( $ThisLine =~ /^(ANONYMOUS )?FTP login as \'.*\' from [^ ]+ \[.*\] to .*/ ) or
( $ThisLine =~ /(PAM|pam_unix)\(.*\): [Aa]uthentication failure/ ) or
+ ( $ThisLine =~ /(PAM|pam_unix)\(.*\): session (opened|closed) for user/ ) or
( $ThisLine =~ /^data_sendfile/ ) or
( $ThisLine =~ /(:| \-) FTP session (closed|opened)/ ) or
( $ThisLine =~ /(:| \-) No certificate files found/ ) or
diff --git a/scripts/services/ftpd-xferlog b/scripts/services/ftpd-xferlog
--- a/scripts/services/ftpd-xferlog
+++ b/scripts/services/ftpd-xferlog
@@ -49,7 +49,7 @@ $TotalBytesIn = 0;
while (defined($ThisLine = <STDIN>)) {
# Remove transfer time if it is there
if ( ($RemoteHost,$Size,$FileName,$Direction,$AccessMode,$UserName) =
- ( $ThisLine =~ /^([^ ]+) (\d+) (.*) . . (.) (.) (.*) ftp . .*$/ ) ) {
+ ( $ThisLine =~ /^([^ ]+) (\d+) (.*) . . (.) (.) (.*) ftps? . .*$/ ) ) {
if ($Detail < 15) {
$FileName = dirname($FileName);
}
diff --git a/scripts/services/pam_unix b/scripts/services/pam_unix
--- a/scripts/services/pam_unix
+++ b/scripts/services/pam_unix
@@ -163,7 +163,7 @@
}
#lowercase the service
$service = lc($service);
- if ( grep $_ eq $service, qw/ssh sshd login ftp vsftpd rsh remote rlogin rexec/) {
+ if ( grep $_ eq $service, qw/ssh sshd login ftp vsftpd proftpd rsh remote rlogin rexec/) {
if ($line =~ s/^session opened for user (.+) by \(uid=\d+\)/$1/) {
($Detail >= 5) && $data{$service}{'Sessions Opened'}{$line}++;
} elsif ($line =~ s/^session opened for user ([^ ]*) by ([^ ]*)\(uid=\d+\)/$1 by $2/) {