Tilman Koschnick
2008-May-27 20:03 UTC
[Logcheck-devel] Bug#483214: logcheck-database: updated ssh rule - ignore hostbased auth method messages
Package: logcheck-database Version: 1.2.63 Severity: wishlist Tags: patch Hi, attached is an updated ssh rule, to ignore login messages for the hostbased auth method as well. Would be nice if this gets included in logcheck-database. Cheers, Til -------------- next part -------------- --- ssh.orig 2008-05-27 21:43:15.855035352 +0200 +++ ssh 2008-05-27 21:43:49.285481804 +0200 @@ -1,4 +1,4 @@ -^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Accepted (gssapi(-with-mic|-keyex)?|rsa|dsa|password|publickey|keyboard-interactive/pam) for [^[:space:]]+ from [^[:space:]]+ port [0-9]+( (ssh|ssh2))?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Accepted (gssapi(-with-mic|-keyex)?|rsa|dsa|password|publickey|keyboard-interactive/pam|hostbased) for [^[:space:]]+ from [^[:space:]]+ port [0-9]+( (ssh|ssh2))?$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Postponed keyboard-interactive(/pam)? for [^[:space:]]+ from [^[:space:]]+ port [0-9]+( (ssh|ssh2))?$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: PAM pam_putenv: delete non-existent entry; [[:alnum:]]+$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Server listening on [:[:xdigit:].]+ port [[:digit:]]+\.$
Debian Bug Tracking System
2008-Jun-25 13:21 UTC
[Logcheck-devel] Bug#483214: marked as done (logcheck-database: updated ssh rule - ignore hostbased auth method messages)
Your message dated Wed, 25 Jun 2008 13:02:07 +0000 with message-id <E1KBUdT-0003or-2a at ries.debian.org> and subject line Bug#483214: fixed in logcheck 1.2.65 has caused the Debian Bug report #483214, regarding logcheck-database: updated ssh rule - ignore hostbased auth method messages to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner at bugs.debian.org immediately.) -- 483214: bugs.debian.org/cgi-bin/bugreport.cgi?bug=483214 Debian Bug Tracking System Contact owner at bugs.debian.org with problems -------------- next part -------------- An embedded message was scrubbed... From: Tilman Koschnick <til at subnetz.org> Subject: logcheck-database: updated ssh rule - ignore hostbased auth method messages Date: Tue, 27 May 2008 22:03:26 +0200 Size: 3733 Url: lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20080625/4a429408/attachment.eml -------------- next part -------------- An embedded message was scrubbed... From: madduck at debian.org (martin f. krafft) Subject: Bug#483214: fixed in logcheck 1.2.65 Date: Wed, 25 Jun 2008 13:02:07 +0000 Size: 7009 Url: lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20080625/4a429408/attachment-0001.eml