From owner-freebsd-bugs@FreeBSD.ORG Thu May 26 08:50:04 2011 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 17DE7106564A for ; Thu, 26 May 2011 08:50:04 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 029D18FC12 for ; Thu, 26 May 2011 08:50:04 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id p4Q8o3Vk083543 for ; Thu, 26 May 2011 08:50:03 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.4/8.14.4/Submit) id p4Q8o3H4083542; Thu, 26 May 2011 08:50:03 GMT (envelope-from gnats) Date: Thu, 26 May 2011 08:50:03 GMT Message-Id: <201105260850.p4Q8o3H4083542@freefall.freebsd.org> To: freebsd-bugs@FreeBSD.org From: Christian Marg Cc: Subject: Re: conf/91732: [patch] 800.loginfail: fix log message grep expression X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Christian Marg List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 May 2011 08:50:04 -0000 The following reply was made to PR conf/91732; it has been noted by GNATS. From: Christian Marg To: bug-followup@FreeBSD.org, doconnor@gsoft.com.au Cc: Subject: Re: conf/91732: [patch] 800.loginfail: fix log message grep expression Date: Thu, 26 May 2011 10:30:34 +0200 This is a cryptographically signed message in MIME format. --------------ms020507050700000801060303 Content-Type: multipart/mixed; boundary="------------020303040004040106000607" This is a multi-part message in MIME format. --------------020303040004040106000607 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: quoted-printable Hello, this problem is still unresolved in 8.2-RELEASE. For example I see many=20 "ANON ftp: Login successful." log messages from my ProFTPD, just because = the host name of the client contains the word "kabel-badenwuerttemberg.de= ". I have a minor correction to Alan Amesbury's patch, which assumes that=20 there always is a space following the word the expression checks for.=20 I'd rather use "\b" to check for word boundaries. See the patch in my=20 attachment. It also finds lines with "auth.*error" in them. bye Christian --=20 Christian Marg mail : mailto:marg@rz.tu-clausthal.de Rechenzentrum TU Clausthal web : http://www.tu-clausthal.de D-38678 Clausthal-Zellerfeld fon : 05323/72-2626 Germany jabber: ifcma@jabber.tu-clausthal.de --------------020303040004040106000607 Content-Type: text/plain; name="loginfail.patch.txt" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="loginfail.patch.txt" --- 800.loginfail-orig 2011-03-03 10:28:00.000000000 +0100 +++ 800.loginfail 2011-05-26 10:13:04.000000000 +0200 @@ -59,7 +59,7 @@ [Yy][Ee][Ss]) echo "" echo "${host} login failures:" - n=3D$(catmsgs | egrep -ia "^$yesterday.*: .*(fail|invalid|bad|ill= egal)" | + n=3D$(catmsgs | egrep -ia "^$yesterday.*: .*\b(fail(ures?|ed)?|in= valid|bad|illegal|auth.*error)\b" | tee /dev/stderr | wc -l) [ $n -gt 0 ] && rc=3D1 || rc=3D0;; *) rc=3D0;; --------------020303040004040106000607-- --------------ms020507050700000801060303 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIUbTCC BCEwggMJoAMCAQICAgDHMA0GCSqGSIb3DQEBBQUAMHExCzAJBgNVBAYTAkRFMRwwGgYDVQQK ExNEZXV0c2NoZSBUZWxla29tIEFHMR8wHQYDVQQLExZULVRlbGVTZWMgVHJ1c3QgQ2VudGVy MSMwIQYDVQQDExpEZXV0c2NoZSBUZWxla29tIFJvb3QgQ0EgMjAeFw0wNjEyMTkxMDI5MDBa Fw0xOTA2MzAyMzU5MDBaMFoxCzAJBgNVBAYTAkRFMRMwEQYDVQQKEwpERk4tVmVyZWluMRAw DgYDVQQLEwdERk4tUEtJMSQwIgYDVQQDExtERk4tVmVyZWluIFBDQSBHbG9iYWwgLSBHMDEw ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDpm8NnhfkNrvWNVMOWUDU9YuluTO2U 1wBblSJ01CDrNI/W7MAxBAuZgeKmFNJSoCgjhIt0iQReW+DieMF4yxbLKDU5ey2QRdDtoAB6 fL9KDhsAw4bpXCsxEXsM84IkQ4wcOItqaACa7txPeKvSxhObdq3u3ibo7wGvdA/BCaL2a869 080UME/15eOkyGKbghoDJzANAmVgTe3RCSMqljVYJ9N2xnG2kB3E7f81hn1vM7PbD8URwoqD oZRdQWvY0hD1TP3KUazZve+Sg7va64sWVlZDz+HVEz2mHycwzUlU28kTNJpxdcVs6qcLmPkh nSevPqM5OUhqjK3JmfvDEvK9AgMBAAGjgdkwgdYwcAYDVR0fBGkwZzBloGOgYYZfaHR0cDov L3BraS50ZWxlc2VjLmRlL2NnaS1iaW4vc2VydmljZS9hZl9Eb3dubG9hZEFSTC5jcmw/LWNy bF9mb3JtYXQ9WF81MDkmLWlzc3Vlcj1EVF9ST09UX0NBXzIwHQYDVR0OBBYEFEm3xs/oPR9/ 6kR7Eyn38QpwPt5kMB8GA1UdIwQYMBaAFDHDeRu69VPXF+CJei0XbAqzK50zMA4GA1UdDwEB /wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgECMA0GCSqGSIb3DQEBBQUAA4IBAQA74Vp3wEgX 3KkY7IGvWonwvSiSpspZGBJw7Cjy565/lizn8l0ZMfYTK3S9vYCyufdnyTmieTvhERHua3iR M347XyYndVNljjNj7s9zw7CSI0khUHUjoR8Y4pSFPT8z6XcgjaK95qGFKUD2P3MyWA0Ja6ba hWzAP7uNZmRWJE6uDT8yNQFb6YyC2XJZT7GGhfF0hVblw/hc843uR7NTBXDn5U2KaYMo4RMJ hp5eyOpYHgwf+aTUWgRo/Sg+iwK2WLX2oSw3VwBnqyNojWOl75lrXP1LVvarQIc01BGSbOyH xQoLBzNytG8MHVQs2FHHzL8w00Ny8TK/jM5JY6gA9/IcMIIFKDCCBBCgAwIBAgIECgyxljAN BgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJERTETMBEGA1UEChMKREZOLVZlcmVpbjEQMA4G A1UECxMHREZOLVBLSTEkMCIGA1UEAxMbREZOLVZlcmVpbiBQQ0EgR2xvYmFsIC0gRzAxMB4X DTA3MDMwNjA5MjczNloXDTE5MDMwNTAwMDAwMFowgZgxCzAJBgNVBAYTAkRFMSowKAYDVQQK EyFUZWNobmlzY2hlIFVuaXZlcnNpdGFldCBDbGF1c3RoYWwxFjAUBgNVBAsTDVJlY2hlbnpl bnRydW0xHjAcBgNVBAMTFVRVIENsYXVzdGhhbCBDQSAtIEcwMjElMCMGCSqGSIb3DQEJARYW cGtpQHJ6LnR1LWNsYXVzdGhhbC5kZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB ALiTQIGm718nnhWt8IiMlFmK9AMhGYmhTWZO41XHR4PTg9fvFBULkpqBJzl/U9LwAtDTmvyk FQ1+OdWm7qdDJhSiJnNTKZTHXYYG6aTdRLakwYNmB2IZNnNqeEuqS7qJzPZdiebNzRJsh11x UUbOlIfA3N8MOLS+Jj2N+R8R05jeLFoSGBAQqDyI9RwbqoLxf8rKlvcAzpJHDEMkA6AYcaNM jp6MTfN7xQB+VS6w/0NroT+plTXts+omff1mKfNvVROpC+lKi3jVW8kVU31zrarX+l39vnoI hkb6Nb81vguc4P5x/r3EyddaO/3WX2KHAk7mf6ml8tJHTFi5D1XRtakCAwEAAaOCAbUwggGx MA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgEGMB0GA1UdDgQWBBRi/JK35+3zHzVVW8lD 31CzXvQQJTAfBgNVHSMEGDAWgBRJt8bP6D0ff+pEexMp9/EKcD7eZDAhBgNVHREEGjAYgRZw a2lAcnoudHUtY2xhdXN0aGFsLmRlMIGIBgNVHR8EgYAwfjA9oDugOYY3aHR0cDovL2NkcDEu cGNhLmRmbi5kZS9nbG9iYWwtcm9vdC1jYS9wdWIvY3JsL2NhY3JsLmNybDA9oDugOYY3aHR0 cDovL2NkcDIucGNhLmRmbi5kZS9nbG9iYWwtcm9vdC1jYS9wdWIvY3JsL2NhY3JsLmNybDCB ogYIKwYBBQUHAQEEgZUwgZIwRwYIKwYBBQUHMAKGO2h0dHA6Ly9jZHAxLnBjYS5kZm4uZGUv Z2xvYmFsLXJvb3QtY2EvcHViL2NhY2VydC9jYWNlcnQuY3J0MEcGCCsGAQUFBzAChjtodHRw Oi8vY2RwMi5wY2EuZGZuLmRlL2dsb2JhbC1yb290LWNhL3B1Yi9jYWNlcnQvY2FjZXJ0LmNy dDANBgkqhkiG9w0BAQUFAAOCAQEAL1N0jYuGTKeAv4RmqAC+0P+KjwAJjh2gMA/Z4au84EUf ana4G4Im2lM8BhuNAEyxKJeU4WWcMMHqBicK1xl2OpxOsEsRb7i++aIHe/+DMqKMdteZUkjw XP+H59V1ZgN7DKAXvIguKEYgVsPpNluPJyKX0jeDw+hGxo0RnepZG1Hn7b5HctJQxAjn8Zf3 VHVMf3oN3NAQ3EnN8G6FOwcoC5JT+baqAS0K/rvhPTAUWvi8S0WRxzBbHK4I/LvKE5mLO9uI Akj8r11haKAdpepamqzq4QNKf/UqJB7w2N6Ruve1MwZh90lxelWquWjvtXOJrcL8QzlhfNTB u/8nqloIFTCCBYowggRyoAMCAQICBBEMpRgwDQYJKoZIhvcNAQEFBQAwgZgxCzAJBgNVBAYT AkRFMSowKAYDVQQKEyFUZWNobmlzY2hlIFVuaXZlcnNpdGFldCBDbGF1c3RoYWwxFjAUBgNV BAsTDVJlY2hlbnplbnRydW0xHjAcBgNVBAMTFVRVIENsYXVzdGhhbCBDQSAtIEcwMjElMCMG CSqGSIb3DQEJARYWcGtpQHJ6LnR1LWNsYXVzdGhhbC5kZTAeFw0xMDExMjQxNDU2MDhaFw0x MzExMjMxNDU2MDhaMFIxCzAJBgNVBAYTAkRFMSowKAYDVQQKEyFUZWNobmlzY2hlIFVuaXZl cnNpdGFldCBDbGF1c3RoYWwxFzAVBgNVBAMTDkNocmlzdGlhbiBNYXJnMIIBIjANBgkqhkiG 9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuhoPQ/hBKDDMjyXqz6cG6G+k5YHGdHfv9gh3w6ncuh5u rEJ6/SpcqpiFZxPYRLKd5bsM3cf0ELrAsT7f5UoFuKtyEX4Pn5Ww4N0uj82tlxmlT0No3CAV t1Pc7a1juYgV4O63m/igRevZl2u+9AhYJaxqYTOx1BBim7wjx0lQHBTHz26/UueUudakEVnF kNelGzQ3oSiIShii3CrSH22uOQ3r7zQ+KakwbqjNV+l/mD3W+QMBhyQvvARPJHkPeGe5HwDo 6b7zzVDoCGai7EyeGapmdNN8gDfhgTNKDtlLkskSCqUMHDKvT/13dzOjS2iU29Azzk4jTHS5 n64dZJCrswIDAQABo4ICHzCCAhswCQYDVR0TBAIwADALBgNVHQ8EBAMCBeAwKQYDVR0lBCIw IAYIKwYBBQUHAwIGCCsGAQUFBwMEBgorBgEEAYI3FAICMB0GA1UdDgQWBBTbwx34N/hSwNmT T75NQUtPFcvKsjAfBgNVHSMEGDAWgBRi/JK35+3zHzVVW8lD31CzXvQQJTBZBgNVHREEUjBQ gRdtYXJnQHJ6LnR1LWNsYXVzdGhhbC5kZYEeY2hyaXN0aWFuLm1hcmdAdHUtY2xhdXN0aGFs LmRlgRVpZmNtYUB0dS1jbGF1c3RoYWwuZGUwgY8GA1UdHwSBhzCBhDBAoD6gPIY6aHR0cDov L2NkcDEucGNhLmRmbi5kZS90dS1jbGF1c3RoYWwtY2EvcHViL2NybC9nX2NhY3JsLmNybDBA oD6gPIY6aHR0cDovL2NkcDIucGNhLmRmbi5kZS90dS1jbGF1c3RoYWwtY2EvcHViL2NybC9n X2NhY3JsLmNybDCBqAYIKwYBBQUHAQEEgZswgZgwSgYIKwYBBQUHMAKGPmh0dHA6Ly9jZHAx LnBjYS5kZm4uZGUvdHUtY2xhdXN0aGFsLWNhL3B1Yi9jYWNlcnQvZ19jYWNlcnQuY3J0MEoG CCsGAQUFBzAChj5odHRwOi8vY2RwMi5wY2EuZGZuLmRlL3R1LWNsYXVzdGhhbC1jYS9wdWIv Y2FjZXJ0L2dfY2FjZXJ0LmNydDANBgkqhkiG9w0BAQUFAAOCAQEAJkHb85tF8rblRsyfYP3A d+iFCsrzdPucM289YAxycNCF31ispgj8dwk7qWE6bPtENRgplNN2yYGAGdGdOz9Tq7kzV0Ws 8gB+PNLXUuLmWK/FbpBDPfVd3tveB8e4ZBLrzM19zVID8n/x7gYvy9BF6cYega2Vb6eZBUt8 QdgCQJM9KgSzn1ip63o1F1GAyjfs1+/lM0BF+29+3xJUKDqc/DctTgI8rsR/a9eCUGmZVXFY 0p2i9QbUzjIIHgG8ICuquJ3Nj6EpGzi+GDm/W538D9HI1Vt3lDKiDLz9gjF/aitr0JmCCRQv 30PwfIGYfEmZwvJotQRkrfu4rUh16B4L2jCCBYowggRyoAMCAQICBBEMpRgwDQYJKoZIhvcN AQEFBQAwgZgxCzAJBgNVBAYTAkRFMSowKAYDVQQKEyFUZWNobmlzY2hlIFVuaXZlcnNpdGFl dCBDbGF1c3RoYWwxFjAUBgNVBAsTDVJlY2hlbnplbnRydW0xHjAcBgNVBAMTFVRVIENsYXVz dGhhbCBDQSAtIEcwMjElMCMGCSqGSIb3DQEJARYWcGtpQHJ6LnR1LWNsYXVzdGhhbC5kZTAe Fw0xMDExMjQxNDU2MDhaFw0xMzExMjMxNDU2MDhaMFIxCzAJBgNVBAYTAkRFMSowKAYDVQQK EyFUZWNobmlzY2hlIFVuaXZlcnNpdGFldCBDbGF1c3RoYWwxFzAVBgNVBAMTDkNocmlzdGlh biBNYXJnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuhoPQ/hBKDDMjyXqz6cG 6G+k5YHGdHfv9gh3w6ncuh5urEJ6/SpcqpiFZxPYRLKd5bsM3cf0ELrAsT7f5UoFuKtyEX4P n5Ww4N0uj82tlxmlT0No3CAVt1Pc7a1juYgV4O63m/igRevZl2u+9AhYJaxqYTOx1BBim7wj x0lQHBTHz26/UueUudakEVnFkNelGzQ3oSiIShii3CrSH22uOQ3r7zQ+KakwbqjNV+l/mD3W +QMBhyQvvARPJHkPeGe5HwDo6b7zzVDoCGai7EyeGapmdNN8gDfhgTNKDtlLkskSCqUMHDKv T/13dzOjS2iU29Azzk4jTHS5n64dZJCrswIDAQABo4ICHzCCAhswCQYDVR0TBAIwADALBgNV HQ8EBAMCBeAwKQYDVR0lBCIwIAYIKwYBBQUHAwIGCCsGAQUFBwMEBgorBgEEAYI3FAICMB0G A1UdDgQWBBTbwx34N/hSwNmTT75NQUtPFcvKsjAfBgNVHSMEGDAWgBRi/JK35+3zHzVVW8lD 31CzXvQQJTBZBgNVHREEUjBQgRdtYXJnQHJ6LnR1LWNsYXVzdGhhbC5kZYEeY2hyaXN0aWFu Lm1hcmdAdHUtY2xhdXN0aGFsLmRlgRVpZmNtYUB0dS1jbGF1c3RoYWwuZGUwgY8GA1UdHwSB hzCBhDBAoD6gPIY6aHR0cDovL2NkcDEucGNhLmRmbi5kZS90dS1jbGF1c3RoYWwtY2EvcHVi L2NybC9nX2NhY3JsLmNybDBAoD6gPIY6aHR0cDovL2NkcDIucGNhLmRmbi5kZS90dS1jbGF1 c3RoYWwtY2EvcHViL2NybC9nX2NhY3JsLmNybDCBqAYIKwYBBQUHAQEEgZswgZgwSgYIKwYB BQUHMAKGPmh0dHA6Ly9jZHAxLnBjYS5kZm4uZGUvdHUtY2xhdXN0aGFsLWNhL3B1Yi9jYWNl cnQvZ19jYWNlcnQuY3J0MEoGCCsGAQUFBzAChj5odHRwOi8vY2RwMi5wY2EuZGZuLmRlL3R1 LWNsYXVzdGhhbC1jYS9wdWIvY2FjZXJ0L2dfY2FjZXJ0LmNydDANBgkqhkiG9w0BAQUFAAOC AQEAJkHb85tF8rblRsyfYP3Ad+iFCsrzdPucM289YAxycNCF31ispgj8dwk7qWE6bPtENRgp lNN2yYGAGdGdOz9Tq7kzV0Ws8gB+PNLXUuLmWK/FbpBDPfVd3tveB8e4ZBLrzM19zVID8n/x 7gYvy9BF6cYega2Vb6eZBUt8QdgCQJM9KgSzn1ip63o1F1GAyjfs1+/lM0BF+29+3xJUKDqc /DctTgI8rsR/a9eCUGmZVXFY0p2i9QbUzjIIHgG8ICuquJ3Nj6EpGzi+GDm/W538D9HI1Vt3 lDKiDLz9gjF/aitr0JmCCRQv30PwfIGYfEmZwvJotQRkrfu4rUh16B4L2jGCA/cwggPzAgEB MIGhMIGYMQswCQYDVQQGEwJERTEqMCgGA1UEChMhVGVjaG5pc2NoZSBVbml2ZXJzaXRhZXQg Q2xhdXN0aGFsMRYwFAYDVQQLEw1SZWNoZW56ZW50cnVtMR4wHAYDVQQDExVUVSBDbGF1c3Ro YWwgQ0EgLSBHMDIxJTAjBgkqhkiG9w0BCQEWFnBraUByei50dS1jbGF1c3RoYWwuZGUCBBEM pRgwCQYFKw4DAhoFAKCCAiowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0B CQUxDxcNMTEwNTI2MDgzMDM0WjAjBgkqhkiG9w0BCQQxFgQUaq01jo2xT2bfWt7ATdseU9js 48EwXwYJKoZIhvcNAQkPMVIwUDALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwDgYIKoZIhvcN AwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMIGyBgkrBgEE AYI3EAQxgaQwgaEwgZgxCzAJBgNVBAYTAkRFMSowKAYDVQQKEyFUZWNobmlzY2hlIFVuaXZl cnNpdGFldCBDbGF1c3RoYWwxFjAUBgNVBAsTDVJlY2hlbnplbnRydW0xHjAcBgNVBAMTFVRV IENsYXVzdGhhbCBDQSAtIEcwMjElMCMGCSqGSIb3DQEJARYWcGtpQHJ6LnR1LWNsYXVzdGhh bC5kZQIEEQylGDCBtAYLKoZIhvcNAQkQAgsxgaSggaEwgZgxCzAJBgNVBAYTAkRFMSowKAYD VQQKEyFUZWNobmlzY2hlIFVuaXZlcnNpdGFldCBDbGF1c3RoYWwxFjAUBgNVBAsTDVJlY2hl bnplbnRydW0xHjAcBgNVBAMTFVRVIENsYXVzdGhhbCBDQSAtIEcwMjElMCMGCSqGSIb3DQEJ ARYWcGtpQHJ6LnR1LWNsYXVzdGhhbC5kZQIEEQylGDANBgkqhkiG9w0BAQEFAASCAQCzT2WG G1v3c0iB+rCmr/F9q2F4rplfyGjTIn5u1xmEWHs8bNbURj1DXGxIg6wUSAR6/qK9EMfQrhkg fh3nAcF6DeXl99nqqqLbe10g56RijmZPD5rddiGLDBe3pTEsp6NN6/57NHPzECeSqqJlkAmj 7Z9amWeRmlFlZCBWlsEJTbgimw5EyHZvetskc6c+TCa7D0E1w3obYg04T1aG/XGYHv1S+Tdd T4jBQUYhKN7O1QFYShZBmvBFAbWPxyz4x0TYViqLPRbYFIxJySMNj/9bjKQGC4XXSZn89DIb GFsspnLCjFkYFPOf674tw3mxJnI4X8MrLY2HUu22uI3S6e6QAAAAAAAA --------------ms020507050700000801060303--