Logcheck devel - Sep 2007 - Bug#443886: /etc/logcheck/ignore.d.server/proftpd: [proftpd] Refused user $USER for service $FOO

Package: logcheck-database
Version: 1.2.61
Severity: wishlist
File: /etc/logcheck/ignore.d.server/proftpd

Two weeks ago, I got a rush of these:

  Sep  8 12:37:07 goretex proftpd: PAM-listfile: Refused user news for service
proftpd

(Apparently, fail2ban managed to miss those.)

This is triggered by pam_listfile, which is used by proftpd (and other
FTP daemons) to block users listed in /etc/ftpusers.


Given how lazy I am, I simply wrote a rule for my own particular daemon:

  ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd: PAM-listfile: Refused user
[-_.[:alnum:]]+ for service proftpd$

I'm not sure how you'd prefer to handle this case, though, as there are
various other FTP daemons that do the same thing.  Copy the same rule
over and over for each package?  Write an enumeration and create
ignore.d.server/libpam-modules?  There may be other packages that use
pam_listfile, so should you use ".*" for the daemon and service names?

Ahh, the joy of being a mere user and not having to come up with
answers.  :)


FYI, here's the list of packages that include /etc/ftpusers:

  ftpd
  ftpd-ssl
  proftpd
  pure-ftpd
  pure-ftpd-ldap
  pure-ftpd-mysql
  pure-ftpd-postgresql
  vsftpd
  wu-ftpd


-- System Information:
Debian Release: lenny/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)

Kernel: Linux 2.6.21-2-k7 (SMP w/1 CPU core)
Locale: LANG=en_CA.utf-8, LC_CTYPE=en_CA.utf-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

-- debconf information excluded

# Commit ed3eb5e1d8697c7c0b1447b1580c742cd8d12cad
tag 443886 pending
thanks

In article <20070924203300.1382.19693.reportbug at
toroia.fbriere.dyndns.org> you wrote:
> I'm not sure how you'd prefer to handle this case, though, as there
are
> various other FTP daemons that do the same thing.  Copy the same rule
> over and over for each package?
This is what I did.


-- 
<wiggy> in a stunning new move I actually tested this upload

Processing commands for control at bugs.debian.org:
> # Commit ed3eb5e1d8697c7c0b1447b1580c742cd8d12cad
> tag 443886 pending
Bug#443886: /etc/logcheck/ignore.d.server/proftpd: [proftpd] Refused user $USER
for service $FOO
There were no tags set.
Tags added: pending
> thanks
Stopping processing here.

Please contact me if you need assistance.

Debian bug tracking system administrator
(administrator, Debian Bugs database)

Your message dated Mon, 7 Jul 2008 15:41:36 -0400
with message-id <20080707194136.GB840 at toroia.fbriere.dyndns.org>
and subject line Re: Bug#443886: /etc/logcheck/ignore.d.server/proftpd:
[proftpd] Refused user $USER for service $FOO
has caused the Debian Bug report #443886,
regarding /etc/logcheck/ignore.d.server/proftpd: [proftpd] Refused user $USER
for service $FOO
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner at bugs.debian.org
immediately.)


-- 
443886: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=443886
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems
-------------- next part --------------
An embedded message was scrubbed...
From: =?utf-8?b?RnLDqWTDqXJpYyBCcmnDqHJl?= <fbriere at fbriere.net>
Subject: /etc/logcheck/ignore.d.server/proftpd: [proftpd] Refused user $USER for
 service $FOO
Date: Mon, 24 Sep 2007 16:33:00 -0400
Size: 3011
Url:
http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20080707/b9f72bdf/attachment.eml
-------------- next part --------------
An embedded message was scrubbed...
From: =?iso-8859-1?B?RnLpZOlyaWMgQnJp6HJl?= <fbriere at fbriere.net>
Subject: Re: Bug#443886: /etc/logcheck/ignore.d.server/proftpd: [proftpd]
	Refused user $USER for service $FOO
Date: Mon, 7 Jul 2008 15:41:36 -0400
Size: 1591
Url:
http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20080707/b9f72bdf/attachment-0001.eml