From owner-freebsd-current@FreeBSD.ORG  Tue Aug 31 19:43:31 2004
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 1FAC116A4CE
	for <current@freebsd.org>; Tue, 31 Aug 2004 19:43:31 +0000 (GMT)
Received: from mailserv1.neuroflux.com (mailserv1.neuroflux.com
	[204.228.228.92])
	by mx1.FreeBSD.org (Postfix) with ESMTP id C5ED743D48
	for <current@freebsd.org>; Tue, 31 Aug 2004 19:43:30 +0000 (GMT)
	(envelope-from ryans@gamersimpact.com)
Received: (qmail 41930 invoked by uid 89); 31 Aug 2004 19:49:21 -0000
Received: from unknown (HELO www2.neuroflux.com) (127.0.0.1)
  by localhost with SMTP; 31 Aug 2004 19:49:21 -0000
Received: from 208.4.77.15
        (SquirrelMail authenticated user ryans@gamersimpact.com)
        by www2.neuroflux.com with HTTP;
        Tue, 31 Aug 2004 13:49:21 -0600 (MDT)
Message-ID: <50241.208.4.77.15.1093981761.squirrel@www2.neuroflux.com>
Date: Tue, 31 Aug 2004 13:49:21 -0600 (MDT)
From: "Ryan Sommers" <ryans@gamersimpact.com>
To: current@freebsd.org
User-Agent: SquirrelMail/1.4.2
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3
Importance: Normal
Subject: Periodic security
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 31 Aug 2004 19:43:31 -0000

Slight modification to the loginfail script for periodics. This will catch
sshd, proftpd and su errors, as well as other programs, better.

--- 800.loginfail       Mon Aug 30 21:50:50 2004
+++ 800.loginfail       Mon Aug 30 21:51:53 2004
@@ -59,7 +59,7 @@
     [Yy][Ee][Ss])
        echo ""
        echo "${host} login failures:"
-       n=$(catmsgs | grep -ia "^$yesterday.*fail" |
+       n=$(catmsgs | egrep -ia "^$yesterday.*(fail|invalid|bad|illegal)" |
            tee /dev/stderr | wc -l)
        [ $n -gt 0 ] && rc=1 || rc=0;;
     *) rc=0;;

-- 
Ryan "leadZERO" Sommers
Gamer's Impact President
ryans@gamersimpact.com
ICQ: 1019590
AIM/MSN: leadZERO

-= http://www.gamersimpact.com =-