diff --git a/logwatch-7.3.6-init2.patch b/logwatch-7.3.6-init2.patch new file mode 100644 index 0000000..98ccfff --- /dev/null +++ b/logwatch-7.3.6-init2.patch @@ -0,0 +1,56 @@ +diff -up logwatch-7.3.6/scripts/services/init.pom logwatch-7.3.6/scripts/services/init +--- logwatch-7.3.6/scripts/services/init.pom 2008-10-20 13:17:46.000000000 +0200 ++++ logwatch-7.3.6/scripts/services/init 2008-10-20 13:41:17.000000000 +0200 +@@ -16,7 +16,8 @@ $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} + while (defined($ThisLine = )) { + if (( $ThisLine =~ /open\(.*\): No such file or directory/) or + ( $ThisLine =~ /Id "r" respawning too fast: disabled for 5 minutes/) or +- ( $ThisLine =~ /Re-reading inittab/)) { ++ ( $ThisLine =~ /Re-reading inittab/) or ++ ( $ThisLine =~ /.* main process ended, respawning/)) { + # We don't care about these + } + elsif ( $ThisLine =~ s/Switching to runlevel: (.)\s*$/$1/ ) { +@@ -34,9 +35,15 @@ while (defined($ThisLine = )) { + chomp ($ThisLine); + $ReExecInit++; + } ++ elsif ( $ThisLine =~ /Re-executing \/sbin\/init/) { ++ $ReExecSbinInit++; ++ } + elsif ( ($Name,$Cause) = ($ThisLine =~ /(.*) main process \([0-9]*\) killed by (.*) /)) { + $ProcessKilled{"$Name,$Cause"}++; + } ++ elsif ( ($Name, $Status) = ($ThisLine =~ /(.*) main process \([0-9]*\) terminated with status ([0-9]*)/)) { ++ $ProcessTerminated{"$Name,Status"}++; ++ } + else { + # report any unmatched entries + push @OtherList,$ThisLine; +@@ -53,6 +60,11 @@ if ($ReExecInit) { + print "\n\nRe-execs of init: $ReExecInit times\n"; + } + ++if ($ReExecSbinInit) { ++ print "\n\nRe-executing \/sbin\/init/: $ReExecSbinInit times\n"; ++} ++ ++ + if ((keys %ProcessKilled) and ($Detail >=10)) { + print "\nKilled processses:\n"; + foreach (keys %ProcessKilled) { +@@ -61,6 +73,14 @@ if ((keys %ProcessKilled) and ($Detail > + } + } + ++if ((keys %ProcessTerminated) and ($Detail >=10)) { ++ print "\nTerminated processses:\n"; ++ foreach (keys %ProcessTerminated) { ++ my ($Name,$Status)=split ","; ++ print " Process " . $Name. " terminated with status " . $Cause . ": " . $ProcessTerminated{"$Name,$Status"} . " Time(s)\n"; ++ } ++} ++ + if ($#OtherList >= 0) { + print "\n**Unmatched Entries**\n"; + print @OtherList; diff --git a/logwatch-7.3.6-pam_unix3.patch b/logwatch-7.3.6-pam_unix3.patch new file mode 100644 index 0000000..469f47c --- /dev/null +++ b/logwatch-7.3.6-pam_unix3.patch @@ -0,0 +1,67 @@ +diff -up logwatch-7.3.6/scripts/services/pam_unix.pom logwatch-7.3.6/scripts/services/pam_unix +--- logwatch-7.3.6/scripts/services/pam_unix.pom 2008-10-20 13:17:46.000000000 +0200 ++++ logwatch-7.3.6/scripts/services/pam_unix 2008-10-20 13:16:31.000000000 +0200 +@@ -140,6 +140,8 @@ while ($line = ) { + $data{$service}{'Expired Accounts'}{$line}++; + } elsif ($line =~ s/bad username \[(.*)\]/$1/) { + $data{$service}{'Invalid Users'}{"Bad User: $line"}++; ++ } elsif ($line =~ s/auth could not identify password for \[(.*)\]/$1/) { ++ $data{$service}{'Not Identify Password For'}{$line}++; + } else { + $data{$service}{'Unknown Entries'}{$line}++; + } +@@ -165,12 +167,16 @@ while ($line = ) { + } elsif ($service eq 'gdm') { + if ($line =~ s/^session opened for user (.+) by \(uid=\d+\)/$1/) { + ($Detail >= 5) && $data{$service}{'Sessions Opened'}{$line}++; ++ } elsif ($line =~ s/auth could not identify password for \[(.*)\]/$1/) { ++ $data{$service}{'Not Identify Password For'}{$line}++; + } elsif ($line =~ s/^authentication failure; logname=.*user=(.+)$/$1/) { + $data{$service}{'Authentication Failures'}{$line}++; + } elsif ($line =~ /session closed for user/) { + # ignore this line + } elsif ($line =~ /bad username \[\]/) { + # ignore this line ++ } elsif ($line =~ /conversation failed/) { ++ # ignore this line + } else { + $data{$service}{'Unknown Entries'}{$line}++; + } +@@ -183,7 +189,7 @@ while ($line = ) { + $data{$service}{'Authentication Failures'}{$line}++; + } + +- } elsif ($service eq 'xdm') { ++ } elsif ($service eq 'xdm') { + if ($line =~ s/^session opened for user (.+) by \(uid=\d+\)/$1/) { + ($Detail >= 5) && $data{$service}{'Sessions Opened'}{$line}++; + } elsif ($line =~ /session closed for user/) { +@@ -273,8 +279,27 @@ while ($line = ) { + } else { + $data{$service}{'Unknown Entries'}{$line}++; + } ++ } elsif ($service eq 'polkit') { ++ if ($line =~ s/auth could not identify password for \[(.*)\]/$1/) { ++ $data{$service}{'Not Identify Password For'}{$line}++; ++ } elsif ($line =~ s/^authentication failure; logname=(\S*) uid=(\d+) .*user=(\S*)$/$1($2) -> $3/) { ++ $data{$service}{'Authentication Failures'}{$line}++; ++ } elsif ($line =~ /conversation failed/) { ++ # ignore this line ++ } else { ++ $data{$service}{'Unknown Entries'}{$line}++; ++ } ++ } elsif ($service eq 'virt-manager') { ++ if ($line =~ s/auth could not identify password for \[(.*)\]/$1/) { ++ $data{$service}{'Not Identify Password For'}{$line}++; ++ } elsif ($line =~ /conversation failed/) { ++ # ignore this line ++ } else { ++ $data{$service}{'Unknown Entries'}{$line}++; ++ } ++ + } else { +- $data{$service}{'Unknown Entries'}{$line}++; ++ $data{$service}{'Unknown Entries'}{$line}++; + } + } + diff --git a/logwatch-7.3.6-secure2.patch b/logwatch-7.3.6-secure2.patch new file mode 100644 index 0000000..542f758 --- /dev/null +++ b/logwatch-7.3.6-secure2.patch @@ -0,0 +1,57 @@ +diff -up logwatch-7.3.6/scripts/services/secure.pom logwatch-7.3.6/scripts/services/secure +--- logwatch-7.3.6/scripts/services/secure.pom 2008-10-20 13:50:05.000000000 +0200 ++++ logwatch-7.3.6/scripts/services/secure 2008-10-21 10:47:07.000000000 +0200 +@@ -196,7 +196,9 @@ while (defined($ThisLine = )) { + ( $ThisLine =~ /^su\[\d+\]: [+-] .+/) or + ( $ThisLine =~ /^su\[\d+\]: FAILED su for \S+ by \S+/) or #debian: done in pam_unix + ( $ThisLine =~ /^login\[\d+\]: ROOT LOGIN on '\S+'/) or #debian: done in pam_unix (Similar message on other system is reported) +- ( $ThisLine =~ /^login\[\d+\]: FAILED LOGIN \(\d+\) on ['`]\S+' FOR `\S+', (Authentication failure|User not known to the underlying authentication module)/) or #debian: done in pam_unix ++ ( $ThisLine =~ /^login\[\d+\]: FAILED LOGIN \(\d+\) on ['`]\S+' FOR `\S+', (Authentication failure|User not known to the underlying authentication module)/) or ++ ( $ThisLine =~ /^login: FAILED LOGIN 2 FROM (.*) FOR .*, (Authentication failure|User not known to the underlying authentication module)/) or ++ ( $ThisLine =~ /^login: pam_securetty(.*): unexpected response from failed conversation function/) or + ( $ThisLine =~ /^pam_limits\[\d+\]/ ) or + ( $ThisLine =~ /^kcheckpass(\[\d+\]|):/ ) or # done in pam_unix + ( $ThisLine =~ /^cyrus\/lmtpd\[\d+\]: [^ ]+ server step [12]/ ) or +@@ -213,8 +215,15 @@ while (defined($ThisLine = )) { + ( $ThisLine =~ /pam_succeed_if\(.*:.*\): error retrieving information about user [a-zA-Z]*/ ) or + ( $ThisLine =~ /logfile turned over/) or # newsyslog on OpenBSD + ( $ThisLine =~ /Connection closed by/) or +- ( $ThisLine =~ /sshd.*: Accepted \S+ for \S+ from [\d\.:a-f]+ port \d+/) or # ssh script reads this log ) +- ( $ThisLine =~ /userhelper.*: running (.*) with context (.*)/) ++ ( $ThisLine =~ /sshd.*: Accepted \S+ for \S+ from [\d\.:a-f]+ port \d+/) or # ssh script reads this log ) or ++ ( $ThisLine =~ /userhelper.*: running (.*) with context (.*)/) or ++ ( $ThisLine =~ /userhelper.*: pam_thinkfinger(.*): conversation failed/) or ++ ( $ThisLine =~ /su: PAM [0-9] more authentication failure; .*/) or ++ ( $ThisLine =~ /polkit-grant-helper\[\d+\]: granted authorization for [^ ]* to uid [0-9]* \[auth=.*\]/) or ++ ( $ThisLine =~ /polkit-grant-helper\[\d+\]: granted authorization for [^ ]* to session .* \[uid=[0-9]*\]/) or ++ ( $ThisLine =~ /polkit-grant-helper-pam\[\d+\]: pam_thinkfinger\(polkit:auth\): conversation failed/) or ++ ( $ThisLine =~ /gdm-session-worker\[\d+\]: gkr-pam: no password is available for user/) or ++ ( $ThisLine =~ /gdm-session-worker\[\d+\]: pam_namespace\(gdm:session\): Unmount of [^ ]* failed, Device or resource busy/) + ) { + # Ignore these entries + } elsif ($ThisLine =~ /^spop3d/ || $ThisLine =~ /^pop\(\w+\)\[\d+\]:/) { +@@ -423,6 +432,9 @@ while (defined($ThisLine = )) { + $ChangedUID{"$Name,$UID1,$UID2"}++; + } elsif (($Module,$Service) = ($ThisLine =~ /Deprecated (pam_[^ ]*) module called from service "([^ ]*)"/)) { + $DeprecateModule{"$Module,$Service"}++; ++ } elsif ( ($User) = ($ThisLine =~ /useradd.*failed adding user `(.*)', data deleted/) ) {# failed adding user/)) {# (.*), data deleted/)) { ++ # useradd: failed adding user `rpcuser', data deleted ++ $FailedAddUsers{$User}++; + } else { + # Unmatched entries... + $ThisLine =~ s/\[\d+\]:/:/; +@@ -440,6 +452,14 @@ if ($DeletedUsers) { + print "Deleted Users:\n$DeletedUsers\n"; + } + ++if (keys %FailedAddUsers) { ++ print "Failed adding users:\n"; ++ foreach $User (keys %FailedAddUsers) { ++ print " $User: ". $FailedAddUsers{$User}. " Time(s)\n"; ++ } ++ print"\n"; ++} ++ + if ($NewGroups) { + print "New Groups:\n$NewGroups\n"; + } diff --git a/logwatch.spec b/logwatch.spec index cefde2f..2f885a9 100644 --- a/logwatch.spec +++ b/logwatch.spec @@ -1,7 +1,7 @@ Summary: A log file analysis program Name: logwatch Version: 7.3.6 -Release: 29%{?dist} +Release: 30%{?dist} License: MIT Group: Applications/System URL: http://www.logwatch.org/ @@ -46,6 +46,9 @@ Patch40: logwatch-7.3.6-cron5.patch Patch41: logwatch-7.3.6-logrotate.patch Patch42: logwatch-7.3.6-postfix2.patch Patch43: logwatch-7.3.6-postfix3.patch +Patch44: logwatch-7.3.6-pam_unix3.patch +Patch45: logwatch-7.3.6-init2.patch +Patch46: logwatch-7.3.6-secure2.patch Requires: textutils sh-utils grep mailx Requires: perl(Date::Manip) @@ -100,6 +103,9 @@ of the package on many systems. %patch41 -p1 %patch42 -p1 %patch43 -p1 +%patch44 -p1 +%patch45 -p1 +%patch46 -p1 rm -f scripts/services/*.orig %build @@ -213,6 +219,9 @@ rm -rf %{buildroot} %doc License project/CHANGES %changelog +* Tue Oct 21 2008 Ivana Varekova 7.3.6-30 +- fix secure, pam_unix and init scripts + * Fri Oct 17 2008 Ivana Varekova 7.3.6-29 - fix postfix script again (#462174)