Date: Wed, 16 Jun 1999 02:43:56 +0200 (CEST) From: phschack@inba.fr To: FreeBSD-gnats-submit@freebsd.org Subject: misc/12228: /etc/security don't search in all the files Message-ID: <199906160043.CAA01167@m2.inba.fr>
next in thread | raw e-mail | index | archive | help
>Number: 12228
>Category: misc
>Synopsis: /etc/security don't search in all the files
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: change-request
>Submitter-Id: current-users
>Arrival-Date: Tue Jun 15 17:50:01 PDT 1999
>Closed-Date:
>Last-Modified:
>Originator: Philippe SCHACK
>Release: FreeBSD 3.1-RELEASE i386
>Organization:
>Environment:
Tested in FreeBSD 3.1-RELEASE i386
>Description:
Because of the rotation of the log files (/etc/messages) when /etc/security sear
ch for the 'login failure' and 'refused connect', it can miss some of them in th
e compressed files.
If the rotation is slow because of changes in /etc/newsyslog.conf or small numbe
r of events, it reports the same event each day until the rotation is done.
>How-To-Repeat:
Make some login failures and make the /var/log/message rotate.
or
Make a login failure one day and wait for the security report during few days.
>Fix:
Here is a patch I applied to /etc/security :
--- security.orig Wed Jun 16 02:16:03 1999
+++ security Wed Jun 16 02:16:14 1999
@@ -11,6 +11,8 @@
echo ""
}
+yesterday=`date -v-1d "+%b %e "`
+
host=`hostname`
echo "Subject: $host security check output"
@@ -103,11 +105,11 @@
# show login failures
separator
echo "$host login failures:"
-grep -i "login failure" $LOG/messages
+zcat -f $LOG/messages.0* $LOG/messages | grep -i "^$yesterday.*login failure"
# show tcp_wrapper warning messages
separator
echo "$host refused connections:"
-grep -i "refused connect" $LOG/messages
+zcat -f $LOG/messages.0* $LOG/messages | grep -i "^$yesterday.*refused connect"
rm -f $TMP
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199906160043.CAA01167>