From owner-freebsd-bugs@FreeBSD.ORG Fri Jan 13 00:50:12 2006 Return-Path: X-Original-To: freebsd-bugs@hub.freebsd.org Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 15FFD16A41F for ; Fri, 13 Jan 2006 00:50:12 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 4DC1E43D48 for ; Fri, 13 Jan 2006 00:50:11 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.4/8.13.4) with ESMTP id k0D0oBwH035645 for ; Fri, 13 Jan 2006 00:50:11 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.4/8.13.4/Submit) id k0D0oBMI035644; Fri, 13 Jan 2006 00:50:11 GMT (envelope-from gnats) Resent-Date: Fri, 13 Jan 2006 00:50:11 GMT Resent-Message-Id: <200601130050.k0D0oBMI035644@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, "Daniel O'Connor" Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7770516A41F for ; Fri, 13 Jan 2006 00:40:28 +0000 (GMT) (envelope-from doconnor@cain.gsoft.com.au) Received: from cain.gsoft.com.au (cain.gsoft.com.au [203.31.81.10]) by mx1.FreeBSD.org (Postfix) with ESMTP id B458A43D45 for ; Fri, 13 Jan 2006 00:40:27 +0000 (GMT) (envelope-from doconnor@cain.gsoft.com.au) Received: from cain.gsoft.com.au (localhost [127.0.0.1]) by cain.gsoft.com.au (8.13.5/8.13.4) with ESMTP id k0D0eQd1095715 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 13 Jan 2006 11:10:26 +1030 (CST) (envelope-from doconnor@cain.gsoft.com.au) Received: (from doconnor@localhost) by cain.gsoft.com.au (8.13.5/8.13.4/Submit) id k0D0eQva095714; Fri, 13 Jan 2006 11:10:26 +1030 (CST) (envelope-from doconnor) Message-Id: <200601130040.k0D0eQva095714@cain.gsoft.com.au> Date: Fri, 13 Jan 2006 11:10:26 +1030 (CST) From: "Daniel O'Connor" To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: Subject: bin/91732: X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Daniel O'Connor List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Jan 2006 00:50:12 -0000 >Number: 91732 >Category: bin >Synopsis: >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Fri Jan 13 00:50:10 GMT 2006 >Closed-Date: >Last-Modified: >Originator: Daniel O'Connor >Release: FreeBSD 6.0-RELEASE amd64 >Organization: >Environment: System: FreeBSD cain.gsoft.com.au 6.0-RELEASE FreeBSD 6.0-RELEASE #0: Wed Nov 2 19:07:38 UTC 2005 root@rat.samsco.home:/usr/obj/usr/src/sys/GENERIC amd64 >Description: /etc/periodic/security/800.loginfail uses a simplistic grep expression to find relevant log messages. Unfortunately it misses some things that it shouldn't and shows others that are superfluous. eg. sasl-auth login failures don't show up, but sshd warnings about non-matching forward/reverse lookups are. >How-To-Repeat: >Fix: --- /etc/periodic/security/800.loginfail.orig Thu Nov 3 04:23:36 2005 +++ /etc/periodic/security/800.loginfail Wed Jan 11 14:05:34 2006 @@ -59,7 +59,10 @@ [Yy][Ee][Ss]) echo "" echo "${host} login failures:" - n=$(catmsgs | grep -ia "^$yesterday.*fail" | + n=$(catmsgs | grep -ia "^$yesterday.*" | + grep -v 'Accepted' | grep -v 'logfile turned over' | + grep -v 'subsystem request for' | + grep -v 'reverse mapping checking getaddrinfo for' | tee /dev/stderr | wc -l) [ $n -gt 0 ] && rc=1 || rc=0;; *) rc=0;; >Release-Note: >Audit-Trail: >Unformatted: