Tilman Koschnick
2005-May-14 12:45 UTC
[Logcheck-devel] Bug#309084: logcheck-database: new rule & minor fixes for proftpd
Package: logcheck-database
Version: 1.2.39
Severity: wishlist
Tags: patch
Hi,
find attached an additional rule for proftpd, and some minor fixes
for the existing ones. Could you please include this in the database?
Cheers, Til
-- System Information:
Debian Release: 3.1
Architecture: i386 (i686)
Kernel: Linux 2.6.8
Locale: LANG=en_US, LC_CTYPE=en_US (charmap=ISO-8859-1)
Versions of packages logcheck-database depends on:
ii debconf [debconf-2.0] 1.4.30.13 Debian configuration management sy
-- debconf information:
logcheck-database/conffile-cleanup: false
logcheck-database/rules-directories-note:
logcheck-database/standard-rename-note:
-------------- next part --------------
=== logcheck/ignore.d.server/proftpd
=================================================================---
logcheck/ignore.d.server/proftpd (revision 322)
+++ logcheck/ignore.d.server/proftpd (local)
@@ -1,3 +1,4 @@
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [._[:alnum:]-]+
\([._[:alnum:]-]+\[[0-9.]{7,15}\]\) (- )FTP session (opened|closed)\.$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [._[:alnum:]-]+
\([._[:alnum:]-]+\[[0-9.]{7,15}\]\) (- )USER [\._[:alnum:]-]+: Login
successful\.$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd: \(pam_unix\) session
(opened|closed) for user [\._[:alnum:]-]+( by \(uid=[0-9]+\))$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [._[:alnum:]-]+
\([._[:alnum:]-]+\[[0-9.]{7,15}\]\) (- )USER [._[:alnum:]-]+: Login
successful\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [._[:alnum:]-]+
\([._[:alnum:]-]+\[[0-9.]{7,15}\]\) (- )mod_delay/0.4: delaying for [0-9]+
usecs$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd: \(pam_unix\) session
(opened|closed) for user [._[:alnum:]-]+( by \(uid=[0-9]+\)|)$
maximilian attems
2005-May-14 15:15 UTC
Bug#309084: [Logcheck-devel] Bug#309084: logcheck-database: new rule & minor fixes for proftpd
tags 309084 pending thanks On Sat, 14 May 2005, Tilman Koschnick wrote:> Hi, > > find attached an additional rule for proftpd, and some minor fixes > for the existing ones. Could you please include this in the database?thanks for the new rulefile, corrected dot match in bracket expressions.> Cheers, Til> --- logcheck/ignore.d.server/proftpd (revision 322) > +++ logcheck/ignore.d.server/proftpd (local) > @@ -1,3 +1,4 @@ > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [._[:alnum:]-]+ \([._[:alnum:]-]+\[[0-9.]{7,15}\]\) (- )FTP session (opened|closed)\.$ > -^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [._[:alnum:]-]+ \([._[:alnum:]-]+\[[0-9.]{7,15}\]\) (- )USER [\._[:alnum:]-]+: Login successful\.$ > -^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd: \(pam_unix\) session (opened|closed) for user [\._[:alnum:]-]+( by \(uid=[0-9]+\))$ > +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [._[:alnum:]-]+ \([._[:alnum:]-]+\[[0-9.]{7,15}\]\) (- )USER [._[:alnum:]-]+: Login successful\.$ > +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [._[:alnum:]-]+ \([._[:alnum:]-]+\[[0-9.]{7,15}\]\) (- )mod_delay/0.4: delaying for [0-9]+ usecs$ > +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd: \(pam_unix\) session (opened|closed) for user [._[:alnum:]-]+( by \(uid=[0-9]+\)|)$attached the current rules out of logcheck cvs. please test them. thanks for your feedback. -- maks -------------- next part -------------- ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [._[:alnum:]-]+ \([._[:alnum:]-]+\[[0-9.]{7,15}\]\) (- )FTP session (opened|closed)\.$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [._[:alnum:]-]+ \([._[:alnum:]-]+\[[0-9.]{7,15}\]\) (- )USER [._[:alnum:]-]+: Login successful\.$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd: \(pam_unix\) session (opened|closed) for user [._[:alnum:]-]+( by \(uid=[0-9]+\))?$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [._[:alnum:]-]+ \([._[:alnum:]-]+\[[0-9.]{7,15}\]\) (- )mod_delay/[0-9]\.[0-9]: delaying for [0-9]+ usecs$
Debian Bug Tracking System
2005-May-14 15:19 UTC
Processed: Re: [Logcheck-devel] Bug#309084: logcheck-database: new rule & minor fixes for proftpd
Processing commands for control at bugs.debian.org:> tags 309084 pendingBug#309084: logcheck-database: new rule & minor fixes for proftpd Tags were: patch Tags added: pending> thanksStopping processing here. Please contact me if you need assistance. Debian bug tracking system administrator (administrator, Debian Bugs database)
Tilman Koschnick
2005-May-14 23:04 UTC
Bug#309084: [Logcheck-devel] Bug#309084: logcheck-database: new rule & minor fixes for proftpd
On Sat, 2005-05-14 at 17:15 +0200, maximilian attems wrote:> tags 309084 pending > thanks > > On Sat, 14 May 2005, Tilman Koschnick wrote: > > > Hi, > > > > find attached an additional rule for proftpd, and some minor fixes > > for the existing ones. Could you please include this in the database? > > thanks for the new rulefile, > corrected dot match in bracket expressions. > > > Cheers, Til > > > > --- logcheck/ignore.d.server/proftpd (revision 322) > > +++ logcheck/ignore.d.server/proftpd (local) > > @@ -1,3 +1,4 @@ > > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [._[:alnum:]-]+ \([._[:alnum:]-]+\[[0-9.]{7,15}\]\) (- )FTP session (opened|closed)\.$ > > -^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [._[:alnum:]-]+ \([._[:alnum:]-]+\[[0-9.]{7,15}\]\) (- )USER [\._[:alnum:]-]+: Login successful\.$ > > -^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd: \(pam_unix\) session (opened|closed) for user [\._[:alnum:]-]+( by \(uid=[0-9]+\))$ > > +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [._[:alnum:]-]+ \([._[:alnum:]-]+\[[0-9.]{7,15}\]\) (- )USER [._[:alnum:]-]+: Login successful\.$ > > +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [._[:alnum:]-]+ \([._[:alnum:]-]+\[[0-9.]{7,15}\]\) (- )mod_delay/0.4: delaying for [0-9]+ usecs$ > > +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd: \(pam_unix\) session (opened|closed) for user [._[:alnum:]-]+( by \(uid=[0-9]+\)|)$ > > attached the current rules out of logcheck cvs. > please test them. > thanks for your feedback.The rules are working fine, many thanks! Til
Debian Bug Tracking System
2005-May-29 05:03 UTC
[Logcheck-devel] Bug#309084: marked as done (logcheck-database: new rule & minor fixes for proftpd)
Your message dated Sun, 29 May 2005 00:47:11 -0400 with message-id <E1DcFhf-0001k0-00 at newraff.debian.org> and subject line Bug#309084: fixed in logcheck 1.2.40 has caused the attached Bug report to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what I am talking about this indicates a serious mail system misconfiguration somewhere. Please contact me immediately.) Debian bug tracking system administrator (administrator, Debian Bugs database) -------------------------------------- Received: (at submit) by bugs.debian.org; 14 May 2005 12:45:18 +0000>From til at subnetz.org Sat May 14 05:45:18 2005Return-path: <til at subnetz.org> Received: from mxout.hispeed.ch (smtp.hispeed.ch) [62.2.95.247] by spohr.debian.org with esmtp (Exim 3.35 1 (Debian)) id 1DWw18-0006dB-00; Sat, 14 May 2005 05:45:18 -0700 Received: from holly.subnetz.org (217-162-23-214.dclient.hispeed.ch [217.162.23.214]) by smtp.hispeed.ch (8.12.6/8.12.6/tornado-1.0) with ESMTP id j4ECjDtR002681 for <submit at bugs.debian.org>; Sat, 14 May 2005 14:45:14 +0200 Received: from localhost (localhost.localdomain [127.0.0.1]) by holly.subnetz.org (Postfix) with ESMTP id 321661A7E794; Sat, 14 May 2005 14:45:15 +0200 (CEST) Received: from holly.subnetz.org ([127.0.0.1]) by localhost (holly [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 18389-06; Sat, 14 May 2005 14:45:14 +0200 (CEST) Received: by holly.subnetz.org (Postfix, from userid 1000) id 2A30F1800083; Sat, 14 May 2005 14:45:14 +0200 (CEST) Content-Type: multipart/mixed; boundary="===============0300396691==" MIME-Version: 1.0 From: Tilman Koschnick <til at subnetz.org> To: Debian Bug Tracking System <submit at bugs.debian.org> Subject: logcheck-database: new rule & minor fixes for proftpd X-Mailer: reportbug 3.8 Date: Sat, 14 May 2005 14:45:14 +0200 Message-Id: <20050514124514.2A30F1800083 at holly.subnetz.org> X-Virus-Scanned: ClamAV version 0.84, clamav-milter version 0.84e on smtp-07.tornado.cablecom.ch X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at subnetz.org X-Virus-Status: Clean X-DCC-spamcheck-02.tornado.cablecom.ch-Metrics: smtp-07.tornado.cablecom.ch 32701; Body=1 Fuz1=1 Fuz2=1 Delivered-To: submit at bugs.debian.org X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02 (1.212-2003-09-23-exp) on spohr.debian.org X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE autolearn=no version=2.60-bugs.debian.org_2005_01_02 X-Spam-Level: This is a multi-part MIME message sent by reportbug. --===============0300396691=Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Package: logcheck-database Version: 1.2.39 Severity: wishlist Tags: patch Hi, find attached an additional rule for proftpd, and some minor fixes for the existing ones. Could you please include this in the database? Cheers, Til -- System Information: Debian Release: 3.1 Architecture: i386 (i686) Kernel: Linux 2.6.8 Locale: LANG=en_US, LC_CTYPE=en_US (charmap=ISO-8859-1) Versions of packages logcheck-database depends on: ii debconf [debconf-2.0] 1.4.30.13 Debian configuration management sy -- debconf information: logcheck-database/conffile-cleanup: false logcheck-database/rules-directories-note: logcheck-database/standard-rename-note: --===============0300396691=Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="proftpd.diff" === logcheck/ignore.d.server/proftpd =================================================================--- logcheck/ignore.d.server/proftpd (revision 322) +++ logcheck/ignore.d.server/proftpd (local) @@ -1,3 +1,4 @@ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [._[:alnum:]-]+ \([._[:alnum:]-]+\[[0-9.]{7,15}\]\) (- )FTP session (opened|closed)\.$ -^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [._[:alnum:]-]+ \([._[:alnum:]-]+\[[0-9.]{7,15}\]\) (- )USER [\._[:alnum:]-]+: Login successful\.$ -^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd: \(pam_unix\) session (opened|closed) for user [\._[:alnum:]-]+( by \(uid=[0-9]+\))$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [._[:alnum:]-]+ \([._[:alnum:]-]+\[[0-9.]{7,15}\]\) (- )USER [._[:alnum:]-]+: Login successful\.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]: [._[:alnum:]-]+ \([._[:alnum:]-]+\[[0-9.]{7,15}\]\) (- )mod_delay/0.4: delaying for [0-9]+ usecs$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd: \(pam_unix\) session (opened|closed) for user [._[:alnum:]-]+( by \(uid=[0-9]+\)|)$ --===============0300396691==-- --------------------------------------- Received: (at 309084-close) by bugs.debian.org; 29 May 2005 04:51:27 +0000>From katie at ftp-master.debian.org Sat May 28 21:51:27 2005Return-path: <katie at ftp-master.debian.org> Received: from newraff.debian.org [208.185.25.31] (mail) by spohr.debian.org with esmtp (Exim 3.35 1 (Debian)) id 1DcFlm-00049D-00; Sat, 28 May 2005 21:51:26 -0700 Received: from katie by newraff.debian.org with local (Exim 3.35 1 (Debian)) id 1DcFhf-0001k0-00; Sun, 29 May 2005 00:47:11 -0400 From: Todd Troxell <ttroxell at debian.org> To: 309084-close at bugs.debian.org X-Katie: $Revision: 1.56 $ Subject: Bug#309084: fixed in logcheck 1.2.40 Message-Id: <E1DcFhf-0001k0-00 at newraff.debian.org> Sender: Archive Administrator <katie at ftp-master.debian.org> Date: Sun, 29 May 2005 00:47:11 -0400 Delivered-To: 309084-close at bugs.debian.org X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02 (1.212-2003-09-23-exp) on spohr.debian.org X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER autolearn=no version=2.60-bugs.debian.org_2005_01_02 X-Spam-Level: X-CrossAssassin-Score: 12 Source: logcheck Source-Version: 1.2.40 We believe that the bug you reported is fixed in the latest version of logcheck, which is due to be installed in the Debian FTP archive: logcheck-database_1.2.40_all.deb to pool/main/l/logcheck/logcheck-database_1.2.40_all.deb logcheck_1.2.40.dsc to pool/main/l/logcheck/logcheck_1.2.40.dsc logcheck_1.2.40.tar.gz to pool/main/l/logcheck/logcheck_1.2.40.tar.gz logcheck_1.2.40_all.deb to pool/main/l/logcheck/logcheck_1.2.40_all.deb logtail_1.2.40_all.deb to pool/main/l/logcheck/logtail_1.2.40_all.deb A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 309084 at bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Todd Troxell <ttroxell at debian.org> (supplier of updated logcheck package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster at debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.7 Date: Sunday, 29 May 2005 00:24:00 -0500 Source: logcheck Binary: logcheck logtail logcheck-database Architecture: source all Version: 1.2.40 Distribution: unstable Urgency: low Maintainer: Debian logcheck Team <logcheck-devel at lists.alioth.debian.org> Changed-By: Todd Troxell <ttroxell at debian.org> Description: logcheck - Mails anomalies in the system logfiles to the administrator logcheck-database - A database of system log rules for the use of log checkers logtail - Print log file lines that have not been read Closes: 125794 191637 303661 305350 306388 306695 307588 307675 307889 308249 308800 309084 310423 Changes: logcheck (1.2.40) unstable; urgency=low . jamie: * Improve postfix rules in ignore.d.server/postfix and violations.ignore.d/logcheck-postfix. (Closes: #305350) * Add postfix rule for "Temporary failure in name resolution" messages. * Add rules for policyd, add comma to throttle rule. * Add nagios rules for PROCESS_SERVICE_CHECK_RESULT messages. (Closes: #306695) * Add more ntp rules for "adjusting local clock" messages. (Closes: #303661) * Add postfix rule for "unknown SPF result" messages when using the libspf2 patch. * Add rule for bind 9.3 "FORMERR resolving" messages. * Add more nagios rules for SERVICE_FLAPPING messages and ENABLE_*_NOTIFICATIONS messages. * Fix udev rules to match alphanumeric device names and subdirectories in front of %k. (Closes: #307588) * Add bind rule to suppress NSTATS messages. (Closes: #307675) * Add nagios rule for "HOST EVENT HANDLER" messages. * Add cyrus rules to match notifyd messages. * Add first rule for grinch, an open relay checker for postfix. * Set a default for FQDN and only set the value of HOSTNAME once we've read logcheck.conf. The FQDN option now works. (Closes: #308249) * Minor changes to innd rules. Add rule to match innfeed "Connection refused" messages. * Add nagios rule for ENABLE_NOTIFICATIONS messages. * Add postfix rule to suppress "certificate has expired" messages. * Add postfix rule for "misplaced delimiter" hostname warnings. * Add nagios rules to match ACKNOWLEDGEMENT, ADD_SVC_COMMENT, HOST_DOWNTIME and DISABLE_SVC_NOTIFICATIONS messages. * Add the first rules for qpopper and qpopper-drac. (Closes: #125794, #191637) * Fix innd rules in violations.ignore.d/logcheck-innd for innfeed to match "global/final seconds.." messages. * Correct innd rule for perl filter rejection messages to match hostnames with hyphens and underscores too. * Adjust the anvil rule to match "max connection" messages with port 587 (submission). * Add section to README.logcheck-database about submitting rules. * Modify rules for dovecot to also match messages from the pop3 daemon. (Closes: #310423) * Minor changes to innd rules. Add rule for readclose messages. * Add postfix rule in violations.ignore.d/logcheck-postfix to suppress dNSNames mismatch messages. * Add innd rule for innfeed hostChkCxns messages. * Fix postfix rule in violations.ignore.d/logcheck-postfix to match CommonName mis-match messages when verifying broken certs where the CN is empty. maks: * Add some pppd rules for pppoatm usage. * Fix hostname match in cvsd rules. * Add some first preliminary iptables rules for iptables REJECT logging ignore.d.server/kernel for UDP packets. * Add jabberd, ssh, rsync rules from Peter Palfrader <weasel at debian.org>. The ssh rule ignores network scanning noise (not the account brutforcing). * Added dot to username match in scponly rule. * Match more strictly ipv4 address in dhcpd + dhclient rules. * Add to ignore.d.server/dhcpd initial udhcpd lines. (Closes: #306388) * Minor additions to logcheck(8). * Add rule for cron nss_ldap message in ignore.d.server/cron. * Generalise kernel message no IPv6 routers present level workstation. * Update rsync daemon rule thanks Paul Slootman <paul at debian.org> (Closes: #308800) * Update postfix peer verification rule match. (Closes: #307889) * Beautify logcheck.postinst don't call dpkg --compare-versions when no $2. * Correct proftpd rules thanks to Tilman Koschnick <til at subnetz.org> (Closes: #309084) todd: * Add Eric Evans as an uploader. Files: a2beb31d9b0f4e68ea3d5a547e59d845 735 admin optional logcheck_1.2.40.dsc 5d551961f207686d742238091a9690c5 97252 admin optional logcheck_1.2.40.tar.gz deb784701a1d13b4da69bd6d0f8ed7ca 46382 admin optional logcheck_1.2.40_all.deb 3ac5cdadfb09a143bd66c5a4a27639ac 64426 admin optional logcheck-database_1.2.40_all.deb a0b8e138cbb9d5585c1ad79a3ff000f1 28726 admin optional logtail_1.2.40_all.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (GNU/Linux) iD8DBQFCmUXt4u3oQ3FHP2YRAqkUAKDYDcqorsem0NETNuseoz6moBQguQCgvhNq 3T0fWVOMl7Gh0vgqtAIiVCM=fFmU -----END PGP SIGNATURE-----