diff options
Diffstat (limited to 'security/logcheck')
| -rw-r--r-- | security/logcheck/Makefile | 6 | ||||
| -rw-r--r-- | security/logcheck/distinfo | 6 | ||||
| -rw-r--r-- | security/logcheck/files/patch-rulefiles_linux_ignore.d.paranoid_ssh | 10 | ||||
| -rw-r--r-- | security/logcheck/files/patch-rulefiles_linux_ignore.d.server_ssh | 147 | ||||
| -rw-r--r-- | security/logcheck/files/patch-src_logcheck | 28 |
5 files changed, 177 insertions, 20 deletions
diff --git a/security/logcheck/Makefile b/security/logcheck/Makefile index 870facde151b..3b7ac320f85c 100644 --- a/security/logcheck/Makefile +++ b/security/logcheck/Makefile @@ -1,6 +1,5 @@ PORTNAME= logcheck -DISTVERSION= 1.4.4 -PORTREVISION= 1 +DISTVERSION= 1.4.7 CATEGORIES= security MASTER_SITES= DEBIAN_POOL DISTNAME= ${PORTNAME}_${PORTVERSION} @@ -17,6 +16,7 @@ RUN_DEPENDS= bash:shells/bash \ lockfile-create:sysutils/lockfile-progs \ mime-construct:mail/mime-construct + # Enable Perl dependency for logtail script USES= perl5 shebangfix tar:xz SHEBANG_FILES= src/detectrotate/*.dtr src/logcheck src/logtail src/logtail2 @@ -26,7 +26,7 @@ SUB_LIST+= CRON=${PORT_OPTIONS:MCRON} \ DBDIR=${DBDIR} \ LOGCHECK_GROUP=${LOGCHECK_GROUP} \ LOGCHECK_USER=${LOGCHECK_USER} -WRKSRC= ${WRKDIR}/${PORTNAME}-${PORTVERSION} +WRKSRC= ${WRKDIR}/${PORTNAME}-${DISTVERSION} USERS= ${LOGCHECK_USER} GROUPS= ${LOGCHECK_GROUP} PLIST_SUB+= CHGRP=${CHGRP} \ diff --git a/security/logcheck/distinfo b/security/logcheck/distinfo index a361a9724258..17a096f598ac 100644 --- a/security/logcheck/distinfo +++ b/security/logcheck/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1746315311 -SHA256 (logcheck_1.4.4.tar.xz) = d40e1a92707e19581cdc5f1596a56d26396f18b061612e84fb0fbd957bc03864 -SIZE (logcheck_1.4.4.tar.xz) = 143220 +TIMESTAMP = 1756511752 +SHA256 (logcheck_1.4.7.tar.xz) = cc160cbcac28f39388e8b96e462c4e62d005453b6957f1f0eaa8c093ff9cf3df +SIZE (logcheck_1.4.7.tar.xz) = 143776 diff --git a/security/logcheck/files/patch-rulefiles_linux_ignore.d.paranoid_ssh b/security/logcheck/files/patch-rulefiles_linux_ignore.d.paranoid_ssh new file mode 100644 index 000000000000..924527f2d62d --- /dev/null +++ b/security/logcheck/files/patch-rulefiles_linux_ignore.d.paranoid_ssh @@ -0,0 +1,10 @@ +--- rulefiles/linux/ignore.d.paranoid/ssh.orig 2025-08-25 23:42:11 UTC ++++ rulefiles/linux/ignore.d.paranoid/ssh +@@ -1,5 +1,5 @@ + # https://sources.debian.org/src/pam/1.5.3-7/modules/pam_unix/pam_unix_sess.c/#L100 +-^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[0-9]+\]: pam_[[:alnum:]]+\(sshd?:session\): session opened for user [^[:space:]]+\(uid=[0-9]+\) by [^[:space:]]*\(uid=[0-9]+\)$ ++^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[0-9]+\]: pam_[[:alnum:]]+\(sshd?:session\): session opened for user [^[:space:]]+\(uid=[0-9]+\) by [^[:space:]]*\(uid=[0-9]+\)$ + + # https://sources.debian.org/src/pam/1.5.3-7/modules/pam_unix/pam_unix_sess.c/#L130 +-^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[0-9]+\]: pam_[[:alnum:]]+\(sshd?:session\): session closed for user [^[:space:]]+$ ++^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[0-9]+\]: pam_[[:alnum:]]+\(sshd?:session\): session closed for user [^[:space:]]+$ diff --git a/security/logcheck/files/patch-rulefiles_linux_ignore.d.server_ssh b/security/logcheck/files/patch-rulefiles_linux_ignore.d.server_ssh new file mode 100644 index 000000000000..3deda7e94af3 --- /dev/null +++ b/security/logcheck/files/patch-rulefiles_linux_ignore.d.server_ssh @@ -0,0 +1,147 @@ +--- rulefiles/linux/ignore.d.server/ssh.orig 2025-08-25 23:42:06 UTC ++++ rulefiles/linux/ignore.d.server/ssh +@@ -2,108 +2,108 @@ + # gssapi-keyex is added by https://salsa.debian.org/ssh-team/openssh/-/blob/master/debian/patches/gssapi.patch -- this may be moved to a different package in future! + # sshd_config(5) lists: gssapi-with-mic,hostbased, keyboard-interactive, none, password, publickey + +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: Accepted (gssapi(-with-mic|-keyex)?|password|publickey|keyboard-interactive/pam|hostbased) for [^[:space:]]+ from [.:[:xdigit:]]+ port [[:digit:]]+ ssh2(: (RSA|ECDSA|ED25519) (SHA256:[0-9a-zA-Z+/=]{43}|(MD5:)?([[:xdigit:]]{2}:){15}[[:xdigit:]]{2}))?$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: Accepted (gssapi(-with-mic|-keyex)?|password|publickey|keyboard-interactive/pam|hostbased) for [^[:space:]]+ from [.:[:xdigit:]]+ port [[:digit:]]+ ssh2(: (RSA|ECDSA|ED25519) (SHA256:[0-9a-zA-Z+/=]{43}|(MD5:)?([[:xdigit:]]{2}:){15}[[:xdigit:]]{2}))?$ + + # https://salsa.debian.org/ssh-team/openssh/-/blob/master/gss-serv-krb5.c#L103 +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: Authorized to [^[:space:]]+, krb5 principal [^[:space:]]+ \(krb5_kuserok\)$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: Authorized to [^[:space:]]+, krb5 principal [^[:space:]]+ \(krb5_kuserok\)$ + + # possibly https://salsa.debian.org/ssh-team/openssh/-/blob/master/packet.c#L1985 and #L1508 +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: Disconnecting: Bad packet length [[:digit:]]+\.$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: Disconnecting: Bad packet length [[:digit:]]+\.$ + # # possibly https://salsa.debian.org/ssh-team/openssh/-/blob/master/packet.c#L1586 (via #L1985) +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: Disconnecting: Corrupted MAC on input\.$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: Disconnecting: Corrupted MAC on input\.$ + + # https://salsa.debian.org/ssh-team/openssh/-/blob/master/packet.c#L1735 +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: Received disconnect from [.:[:xdigit:]]+ port [[:digit:]]+:[[:digit:]]+: .+$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: Received disconnect from [.:[:xdigit:]]+ port [[:digit:]]+:[[:digit:]]+: .+$ + + # https://salsa.debian.org/ssh-team/openssh/-/blob/master/packet.c#1912 +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: Disconnected from ((invalid|authenticating) )?(user [^[:space:]]+ )?[.:[:xdigit:]]+ port [[:digit:]]+( \[preauth\])?$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: Disconnected from ((invalid|authenticating) )?(user [^[:space:]]+ )?[.:[:xdigit:]]+ port [[:digit:]]+( \[preauth\])?$ + + # https://salsa.debian.org/ssh-team/openssh/-/blob/master/packet.c#1905 and 1906 +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: Connection (closed|reset) by ((invalid|authenticating) )?(user [^[:space:]]* )?[.:[:xdigit:]]+ port [[:digit:]]+( \[preauth\])?$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: Connection (closed|reset) by ((invalid|authenticating) )?(user [^[:space:]]* )?[.:[:xdigit:]]+ port [[:digit:]]+( \[preauth\])?$ + ^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Server listening on [.:[:xdigit:]]+ port [[:digit:]]+\.$ + + ## packet.c#1927 (logdie("Unable to negotiate with %s: %s. "...)) + # offer is something like diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 or ecdsa-sha2-nistp256-cert-v01@openssh.com +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: Unable to negotiate with [.:[:xdigit:]]+ port [[:digit:]]+: no matching (key exchange|host key) method found\. Their offer: [[:alnum:]@.,-]+ \[preauth\]$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: Unable to negotiate with [.:[:xdigit:]]+ port [[:digit:]]+: no matching (key exchange|host key) method found\. Their offer: [[:alnum:]@.,-]+ \[preauth\]$ + + # packet.c#L133 (message is at ssherr.c#L87) +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: ssh_dispatch_run_fatal: Connection from user [^[:space:]]+ [.:[:xdigit:]]+ port [[:digit:]]+: message authentication code incorrect$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: ssh_dispatch_run_fatal: Connection from user [^[:space:]]+ [.:[:xdigit:]]+ port [[:digit:]]+: message authentication code incorrect$ + + # possibly https://salsa.debian.org/ssh-team/openssh/-/blob/master/auth.c#L344 (via packet.c#L1985) +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: Disconnecting: Too many authentication failures for [^[:space:]]* \[preauth\]$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: Disconnecting: Too many authentication failures for [^[:space:]]* \[preauth\]$ + + # https://salsa.debian.org/ssh-team/openssh/-/blob/master/auth.c#L290-297 + # 'invalid user' and UNKNOWN can be returned by ssh_remote_ipaddr() - see packet.c +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: Failed (keyboard-interactive/pam|password|none) for (invalid user )?[^[:space:]]+ from ([.:[:xdigit:]]+|UNKNOWN) port [[:digit:]]+ ssh2$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: Failed (keyboard-interactive/pam|password|none) for (invalid user )?[^[:space:]]+ from ([.:[:xdigit:]]+|UNKNOWN) port [[:digit:]]+ ssh2$ + + # https://salsa.debian.org/ssh-team/openssh/-/blob/master/auth.c#L494 +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: Invalid user [^[:space:]]* from ([.:[:xdigit:]]+|UNKNOWN) port [[:digit:]]+$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: Invalid user [^[:space:]]* from ([.:[:xdigit:]]+|UNKNOWN) port [[:digit:]]+$ + + # auth.c #L286 +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: Postponed keyboard-interactive(/pam)? for (invalid user )?[^[:space:]]+ from [.:[:xdigit:]]+ port [[:digit:]]+ ssh2( \[preauth\])?$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: Postponed keyboard-interactive(/pam)? for (invalid user )?[^[:space:]]+ from [.:[:xdigit:]]+ port [[:digit:]]+ ssh2( \[preauth\])?$ + + # not found in code? +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: input_userauth_request: invalid user [^[:space:]]+ \[preauth\]$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: input_userauth_request: invalid user [^[:space:]]+ \[preauth\]$ + + # https://salsa.debian.org/ssh-team/openssh/-/blob/master/auth.c#L157-158 and #L185-186 +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: User [^[:space:]]+ from [-_.[:alnum:]]+ not allowed because (listed in Deny|not listed in Allow)Users$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: User [^[:space:]]+ from [-_.[:alnum:]]+ not allowed because (listed in Deny|not listed in Allow)Users$ + + #https://salsa.debian.org/ssh-team/openssh/-/blob/master/auth.c#L208-209 +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: User [^[:space:]]+ from [-_.[:alnum:]]+ not allowed because none of user's groups are listed in AllowGroups$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: User [^[:space:]]+ from [-_.[:alnum:]]+ not allowed because none of user's groups are listed in AllowGroups$ + + #' https://salsa.debian.org/ssh-team/openssh/-/blob/master/auth.c#L195-196 +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: User [^[:space:]]+ from [-_.[:alnum:]]+ not allowed because a group is listed in DenyGroups$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: User [^[:space:]]+ from [-_.[:alnum:]]+ not allowed because a group is listed in DenyGroups$ + + # not found - auth_pam.c#L397 is close (but wont match without a ":" after "PAM") +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: PAM pam_putenv: delete non-existent entry; [[:alnum:]]+$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: PAM pam_putenv: delete non-existent entry; [[:alnum:]]+$ + + # canohost.c#L85 +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: Nasty PTR record "[.:[:xdigit:]]+" is set up for [.:[:xdigit:]]+, ignoring$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: Nasty PTR record "[.:[:xdigit:]]+" is set up for [.:[:xdigit:]]+, ignoring$ + + # possibly from auth-shadow.c#L96? think you would want to know if this was happening +-#^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: error: Could not get shadow information for NOUSER$ ++#^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: error: Could not get shadow information for NOUSER$ + + # sshd.c#L380 +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: fatal: Timeout before authentication for [.:[:xdigit:]]+ port [[:digit:]]+$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: fatal: Timeout before authentication for [.:[:xdigit:]]+ port [[:digit:]]+$ + + # sshd.c#L977 +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: fatal: recv_rexec_state: ssh_msg_recv failed$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: fatal: recv_rexec_state: ssh_msg_recv failed$ + + # eg from auth2-pubkey.c#L291 +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: fatal: userauth_pubkey: send packet: Connection reset by peer \[preauth\]$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: fatal: userauth_pubkey: send packet: Connection reset by peer \[preauth\]$ + + # kex.c#1630 (verbose_f("Connection closed by remote host")) +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: error: kex_exchange_identification: Connection closed by remote host$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: error: kex_exchange_identification: Connection closed by remote host$ + +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: error: kex_exchange_identification: read: Connection reset by peer$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: error: kex_exchange_identification: read: Connection reset by peer$ + + # kex.c#L1672 (verbose_f("client sent invalid protocol identifier "...)) +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: error: kex_exchange_identification: client sent invalid protocol identifier ".+"$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: error: kex_exchange_identification: client sent invalid protocol identifier ".+"$ + + # sshconnect.c#L1585 (sshpkt_fatal(ssh, r, "banner exchange")) +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: banner exchange: Connection from [.:[:xdigit:]]+ port [[:digit:]]+: invalid format$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: banner exchange: Connection from [.:[:xdigit:]]+ port [[:digit:]]+: invalid format$ + + # kex.c#L1646-1647 +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: error: kex_exchange_identification: banner line contains invalid characters$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: error: kex_exchange_identification: banner line contains invalid characters$ + + # kex.c#L1720 +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: error: Protocol major versions differ: 2 vs\. 1$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: error: Protocol major versions differ: 2 vs\. 1$ + + # ssherr.c#L101 (SSH_ERR_NO_PROTOCOL_VERSION) +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: banner exchange: Connection from [.:[:xdigit:]]+ port [[:digit:]]+: could not read protocol version$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: banner exchange: Connection from [.:[:xdigit:]]+ port [[:digit:]]+: could not read protocol version$ + + # subsystem.c#L1964 +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: subsystem request for sftp by user [^[:space:]]+$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: subsystem request for sftp by user [^[:space:]]+$ + + # loginrec.c#L1439 --- you would want this message reported? +-#^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: syslogin_perform_logout: logout\(\) returned an error$ ++#^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: syslogin_perform_logout: logout\(\) returned an error$ + + # not sure where this is from +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: refused connect from [:[:alnum:]._-]+ \([:[:alnum:].]+\)$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: refused connect from [:[:alnum:]._-]+ \([:[:alnum:].]+\)$ + + # unclear if this is still generated +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: nss_ldap: reconnect(ing|ed) to LDAP server(\.\.\.| after [[:digit:]]+ attempt\(s\))$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: nss_ldap: reconnect(ing|ed) to LDAP server(\.\.\.| after [[:digit:]]+ attempt\(s\))$ + + # tcp wrappers - not sure what generates these, or if they are up-to-date +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: warning: /etc/hosts\.(allow|deny), line [[:digit:]]+: can't verify hostname: getaddrinfo\([._[:alnum:]-]+, AF_INET\) failed$ +-^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd-session\[[[:digit:]]+\]: warning: /etc/hosts\.(allow|deny), line [[:digit:]]+: host name/(name|address) mismatch: [._[:alnum:]-]+ != [._[:alnum:]-]+$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: warning: /etc/hosts\.(allow|deny), line [[:digit:]]+: can't verify hostname: getaddrinfo\([._[:alnum:]-]+, AF_INET\) failed$ ++^(\w{3} [ :[:digit:]]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ sshd(-session)?\[[[:digit:]]+\]: warning: /etc/hosts\.(allow|deny), line [[:digit:]]+: host name/(name|address) mismatch: [._[:alnum:]-]+ != [._[:alnum:]-]+$ diff --git a/security/logcheck/files/patch-src_logcheck b/security/logcheck/files/patch-src_logcheck index dc1f0636f23b..fc153e9a4ae9 100644 --- a/security/logcheck/files/patch-src_logcheck +++ b/security/logcheck/files/patch-src_logcheck @@ -1,4 +1,4 @@ ---- src/logcheck.orig 2025-05-03 23:35:17 UTC +--- src/logcheck.orig 2025-08-10 23:32:15 UTC +++ src/logcheck @@ -24,16 +24,16 @@ if [ "$(id -u)" = 0 ]; then @@ -43,16 +43,16 @@ SYSLOG_SUMMARY="/usr/bin/syslog-summary" # Defaults for options -@@ -92,7 +92,7 @@ SYSLOGSUMMARY=0 - SORTUNIQ=0 - SUPPORT_CRACKING_IGNORE=0 - SYSLOGSUMMARY=0 --LOCKDIR=/run/lock/logcheck -+LOCKDIR=/var/run/logcheck +@@ -99,7 +99,7 @@ else + elif [ -d "$TMPDIR" ] && [ -w "$TMPDIR" ]; then + LOCKDIR="$TMPDIR/logcheck" + else +- LOCKDIR="/tmp/logcheck" ++ LOCKDIR=/var/run/logcheck + fi LOCKFILE="$LOCKDIR/logcheck" - # Allow globs to return zero files -@@ -183,8 +183,8 @@ logfiles specified in; +@@ -191,8 +191,8 @@ logfiles specified in; } - verify that the logcheck user can read all logfiles specified in; @@ -63,7 +63,7 @@ - check the system has enough space; (df -h output follows): $(df -h 2>&1|| :) - check the settings (environment follows): -@@ -237,7 +237,7 @@ cleanrules() { +@@ -245,7 +245,7 @@ cleanrules() { error "Could not read $x" fi done @@ -72,7 +72,7 @@ rulefile="$(basename "$rulefile")" if [ -f "${dir}/${rulefile}" ]; then debug "cleanrules: ${dir}/${rulefile} -> $cleaned/$rulefile" -@@ -503,7 +503,7 @@ logoutput() { +@@ -511,7 +511,7 @@ logoutput() { >> "$TMPDIR/report" || error "Could not write message about first-time check of journal to report" echo "Only recent entries (from the last 5 hours) will be checked" \ >> "$TMPDIR/report" || error "Could not write message about first-time check of journal to report" @@ -81,7 +81,7 @@ >> "$TMPDIR/report" || error "Could not write message about first-time check of journal to report" offsettime="--since=-5h" fi -@@ -589,7 +589,7 @@ if [ -r "$CONFFILE" ]; then +@@ -597,7 +597,7 @@ if [ -r "$CONFFILE" ]; then # Now source the config file - before things that should not be changed if [ -r "$CONFFILE" ]; then @@ -90,7 +90,7 @@ . "$CONFFILE" elif [ -f "$CONFFILE" ]; then error "Config file $CONFFILE could not be read" -@@ -620,9 +620,9 @@ if [ "$FQDN" -eq 1 ]; then +@@ -628,9 +628,9 @@ if [ "$FQDN" -eq 1 ]; then # HOSTNAME is either 'fully qualified' or 'short' if [ "$FQDN" -eq 1 ]; then @@ -102,7 +102,7 @@ fi # Now check for the other options -@@ -727,8 +727,8 @@ fi +@@ -735,8 +735,8 @@ fi fi # Create a secure temporary working directory (or exit) |