Attachment 184238 Details for Bug 220609 – updated patch file

[patch] updated patch file

patch-security_logcheck (text/plain), 24.26 KB, created by Yasuhiro Kimura on 2017-07-10 18:30:45 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Yasuhiro Kimura

Created: 2017-07-10 18:30:45 UTC

Size: 24.26 KB

patch

obsolete

>Index: Makefile
>===================================================================
>--- Makefile	(revision 445407)
>+++ Makefile	(working copy)
>@@ -2,7 +2,7 @@
> # $FreeBSD$
> 
> PORTNAME=	logcheck
>-PORTVERSION=	1.3.17
>+PORTVERSION=	1.3.18
> CATEGORIES=	security
> MASTER_SITES=	DEBIAN_POOL
> DISTNAME=	${PORTNAME}_${PORTVERSION}
>@@ -12,6 +12,7 @@
> 
> LICENSE=	GPLv2
> 
>+BUILD_DEPENDS=	docbook-to-man>0:textproc/docbook-to-man
> RUN_DEPENDS=	mime-construct:mail/mime-construct \
> 		lockfile:mail/procmail \
> 		bash:shells/bash
>@@ -38,38 +39,30 @@
> BINMODE=	755
> SUB_LIST+=	LOGCHECK_USER=${LOGCHECK_USER} \
> 		LOGCHECK_GROUP=${LOGCHECK_GROUP} \
>-		CRON=${PORT_OPTIONS:MCRON}
>+		DBDIR=${DBDIR} CRON=${PORT_OPTIONS:MCRON}
> SUB_FILES=	pkg-install pkg-deinstall pkg-message
> PLIST_SUB+=	LOGCHECK_USER=${LOGCHECK_USER} \
> 		LOGCHECK_GROUP=${LOGCHECK_GROUP} \
> 		DBDIR=${DBDIR} RUNDIR=${RUNDIR}
>-SHEBANG_FILES=	src/logcheck src/logtail src/logtail2
>+SHEBANG_FILES=	src/logcheck src/logtail src/logtail2 src/detectrotate/*.dtr
> CONFIG_DIRS=	cracking.d ignore.d.paranoid ignore.d.server \
> 		ignore.d.workstation violations.d violations.ignore.d
> DOCS=		AUTHORS CHANGES CREDITS LICENSE TODO docs/README*
> PORTDOCS=	${DOCS:T}
> MAN_FILES=	logcheck.8 logtail.8 logtail2.8
>+REINPLACE_FILES=	debian/logcheck.cron.d docs/logcheck.sgml \
>+			etc/logcheck.conf src/logcheck src/logtail2
> 
>-PATCH_LIST=	extra-patch-debian__logcheck.cron.d \
>-		extra-patch-docs__logcheck.8 \
>-		extra-patch-etc__logcheck.conf \
>-		extra-patch-src__logcheck \
>-		extra-patch-src__logtail2
>-EXTRA_PATCHES=	${PATCH_LIST:C|^|${WRKDIR}/|g}
>-
> .include <bsd.port.pre.mk>
> 
>-pre-patch:
>-.for patch in ${PATCH_LIST}
>-	@${SED} ${_SUB_LIST_TEMP} ${FILESDIR}/${patch}.in > ${WRKDIR}/${patch}
>-.endfor
>-
> post-patch:
> 	@${FIND} ${WRKSRC}/rulefiles -type f -name \*.orig -delete
> 
> do-build:
>-	@${REINPLACE_CMD} -e 's!/var/log/syslog!/var/log/messages!' \
>-		${WRKSRC}/etc/logcheck.logfiles
>+.for file in ${REINPLACE_FILES}
>+	${REINPLACE_CMD} ${_SUB_LIST_TEMP} ${WRKSRC}/${file}
>+.endfor
>+	docbook-to-man ${WRKSRC}/docs/logcheck.sgml > ${WRKSRC}/docs/logcheck.8
> 
> do-install:
> 	@${MKDIR} ${STAGEDIR}${DATADIR}/detectrotate \
>Index: distinfo
>===================================================================
>--- distinfo	(revision 445407)
>+++ distinfo	(working copy)
>@@ -1,2 +1,3 @@
>-SHA256 (logcheck_1.3.17.tar.xz) = c2d3fc323e8c6555e91d956385dbfd0f67b55872ed0f6a7ad8ad2526a9faf03a
>-SIZE (logcheck_1.3.17.tar.xz) = 130956
>+TIMESTAMP = 1499679623
>+SHA256 (logcheck_1.3.18.tar.xz) = 077b9149ccd2b747b52785afa89da844f3d072c017c9e719925dec6acb9a9af4
>+SIZE (logcheck_1.3.18.tar.xz) = 131252
>Index: files/extra-patch-debian__logcheck.cron.d.in
>===================================================================
>--- files/extra-patch-debian__logcheck.cron.d.in	(revision 445407)
>+++ files/extra-patch-debian__logcheck.cron.d.in	(nonexistent)
>@@ -1,16 +0,0 @@
>---- ./debian/logcheck.cron.d.orig	2006-08-06 19:10:49.000000000 -0400
>-+++ ./debian/logcheck.cron.d	2008-09-06 19:11:28.000000000 -0400
>-@@ -1,9 +1,5 @@
>--# /etc/cron.d/logcheck: crontab entries for the logcheck package
>--
>--PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
>-+# crontab entries for the logcheck package
>-+PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
>- MAILTO=root
>--
>--@reboot         logcheck    if [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck -R; fi
>--2 * * * *       logcheck    if [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck; fi
>--
>--# EOF
>-+@reboot    if [ -x %%PREFIX%%/sbin/logcheck ]; then nice -n10 %%PREFIX%%/sbin/logcheck -R; fi
>-+2 * * * *  if [ -x %%PREFIX%%/sbin/logcheck ]; then nice -n10 %%PREFIX%%/sbin/logcheck; fi
>Index: files/extra-patch-docs__logcheck.8.in
>===================================================================
>--- files/extra-patch-docs__logcheck.8.in	(revision 445407)
>+++ files/extra-patch-docs__logcheck.8.in	(nonexistent)
>@@ -1,118 +0,0 @@
>---- docs/logcheck.8.orig	2009-12-15 15:03:22.000000000 -0500
>-+++ docs/logcheck.8	2009-12-15 15:03:41.000000000 -0500
>-@@ -0,0 +1,115 @@
>-+.\" This manpage has been automatically generated by docbook2man 
>-+.\" from a DocBook document.  This tool can be found at:
>-+.\" <http://shell.ipoline.com/~elmert/comp/docbook2X/> 
>-+.\" Please send any bug reports, improvements, comments, patches, 
>-+.\" etc. to Steve Cheng <steve@ggi-project.org>.
>-+.TH "Logcheck" "8" "15 December 2009" "" ""
>-+
>-+.SH NAME
>-+logcheck \- program to scan system logs for interesting lines
>-+.SH SYNOPSIS
>-+
>-+\fBlogcheck\fR [ \fBOPTIONS\fR ]
>-+
>-+.SH "DESCRIPTION"
>-+.PP
>-+The \fBlogcheck\fR program helps spot problems and
>-+security violations in your logfiles automatically and will send the
>-+results to you periodically in an e-mail. By default logcheck runs as 
>-+an hourly cronjob just off the hour and after every reboot.
>-+.PP
>-+\fBlogcheck\fR supports three level of filtering:
>-+"paranoid" is for high-security machines running as few services
>-+as possible. Don't use it if you can't handle its verbose messages.
>-+"server" is the default and contains rules for many different daemons.
>-+"workstation" is for sheltered machines and filters most of the messages.
>-+The ignore rules work in additive manner. "paranoid" rules are also
>-+included at level "server" and "workstation".
>-+.PP
>-+The messages reported are sorted into three layers, system events,
>-+security events and attack alerts. The verbosity of system events is 
>-+controlled by which level you choose, paranoid, server or workstation. 
>-+However, security events and attack alerts are not affected by this.
>-+.SH "EXAMPLES"
>-+.PP
>-+\fBlogcheck\fR can be invoked directly thanks
>-+to su(8) or sudo(8), which change the user ID. The following example checks the logfiles
>-+without updating the offset and outputs everything to STDOUT.
>-+.PP
>-+sudo -u logcheck \fBlogcheck\fR -o -t
>-+.SH "OPTIONS"
>-+.PP
>-+A summary of options is included below.
>-+.TP
>-+\fB-c CFG \fR
>-+Overrule default configuration file.
>-+.TP
>-+\fB-d \fR
>-+Debug mode.
>-+.TP
>-+\fB-h \fR
>-+Show usage information.
>-+.TP
>-+\fB-H \fR
>-+Use this hostname string in the subject of logcheck mail.
>-+.TP
>-+\fB-l LOG \fR
>-+Run logfile through logcheck.
>-+.TP
>-+\fB-L CFG \fR
>-+Overrule default logfiles list.
>-+.TP
>-+\fB-m \fR
>-+Mail report to recipient.
>-+.TP
>-+\fB-o \fR
>-+STDOUT mode, not sending mail.
>-+.TP
>-+\fB-p \fR
>-+Set the report level to "paranoid".
>-+.TP
>-+\fB-r DIR \fR
>-+Overrule default rules directory.
>-+.TP
>-+\fB-R \fR
>-+Adds "Reboot:" to the email subject line.
>-+.TP
>-+\fB-s \fR
>-+Set the report level to "server".
>-+.TP
>-+\fB-S DIR \fR
>-+Overrule default state directory.
>-+.TP
>-+\fB-t \fR
>-+Testing mode does not update offset.
>-+.TP
>-+\fB-T \fR
>-+Do not remove the TMPDIR.
>-+.TP
>-+\fB-u \fR
>-+Enable syslog-summary.
>-+.TP
>-+\fB-v \fR
>-+Print current version.
>-+.TP
>-+\fB-w \fR
>-+Set the report level to "workstation".
>-+.SH "FILES"
>-+.PP
>-+%%ETCDIR%%/logcheck.conf is the main configuration file.
>-+.PP
>-+%%ETCDIR%%/logcheck.logfiles is the list of files to monitor.
>-+.PP
>-+%%DOCSDIR%%/README.logcheck-database for hints on how to write, test and maintain rules.
>-+.SH "EXIT STATUS"
>-+.PP
>-+0 upon success; 1 upon failure
>-+.SH "SEE ALSO"
>-+.PP
>-+\fBlogtail\fR(8)
>-+.SH "AUTHOR"
>-+.PP
>-+logcheck is developed by Debian logcheck Team at alioth: 
>-+http://alioth.debian.org/projects/logcheck/.
>-+.PP
>-+This manual page was written by Jon Middleton.
>Index: files/extra-patch-etc__logcheck.conf.in
>===================================================================
>--- files/extra-patch-etc__logcheck.conf.in	(revision 445407)
>+++ files/extra-patch-etc__logcheck.conf.in	(nonexistent)
>@@ -1,17 +0,0 @@
>---- etc/logcheck.conf.orig	2010-04-15 01:15:34.000000000 +0900
>-+++ etc/logcheck.conf	2010-05-12 14:22:13.000000000 +0900
>-@@ -53,13 +53,7 @@
>- # Controls the base directory for rules file location
>- # This must be an absolute path
>- 
>--#RULEDIR="/etc/logcheck"
>--
>--# Controls if syslog-summary is run over each section.
>--# Alternatively, set to "1" to enable extra summary.
>--# HINT: syslog-summary needs to be installed.
>--
>--#SYSLOGSUMMARY=0
>-+#RULEDIR="%%ETCDIR%%"
>- 
>- # Controls Subject: lines on logcheck reports:
>- 
>Index: files/extra-patch-src__logcheck.in
>===================================================================
>--- files/extra-patch-src__logcheck.in	(revision 445407)
>+++ files/extra-patch-src__logcheck.in	(nonexistent)
>@@ -1,151 +0,0 @@
>---- src/logcheck.orig	2010-07-07 15:59:57.000000000 -0400
>-+++ src/logcheck	2010-07-07 16:19:33.000000000 -0400
>-@@ -24,17 +24,10 @@
>- 
>- if [ `id -u` = 0 ]; then
>-     echo "logcheck should not be run as root. Use su to invoke logcheck:"
>--    echo "su -s /bin/bash -c \"/usr/sbin/logcheck${@:+ $@}\" logcheck"
>-+    echo "su -m %%LOGCHECK_USER%% -c \"%%LOCALBASE%%/bin/bash %%PREFIX%%/sbin/logcheck${@:+ $@}\""
>-     echo "Or use sudo: sudo -u logcheck logcheck${@:+ $@}."
>-     # you may want to uncomment that hack to let logcheck invoke itself.
>--    # su -s /bin/bash -c "$0 $*" logcheck
>--    exit 1
>--fi
>--
>--if [ ! -f /usr/bin/lockfile-create -o \
>--     ! -f /usr/bin/lockfile-remove -o \
>--     ! -f /usr/bin/lockfile-touch ]; then
>--    echo "fatal: lockfile-progs is a prerequisite for logcheck, and was not found."
>-+    # su -s %%LOCALBASE%%/bin/bash -c "$0 $*" logcheck
>-     exit 1
>- fi
>- 
>-@@ -69,12 +62,12 @@
>- ADDTAG="no"
>- 
>- # Set the default paths
>--RULEDIR="/etc/logcheck"
>--CONFFILE="/etc/logcheck/logcheck.conf"
>--STATEDIR="/var/lib/logcheck"
>--LOGFILES_LIST="/etc/logcheck/logcheck.logfiles"
>--LOGFILE_FALLBACK="/var/log/syslog"
>--LOGTAIL="/usr/sbin/logtail2"
>-+RULEDIR="%%ETCDIR%%"
>-+CONFFILE="%%ETCDIR%%/logcheck.conf"
>-+STATEDIR="/var/db/logcheck"
>-+LOGFILES_LIST="%%ETCDIR%%/logcheck.logfiles"
>-+LOGFILE_FALLBACK="/var/log/messages"
>-+LOGTAIL="%%PREFIX%%/sbin/logtail2"
>- CAT="/bin/cat"
>- SYSLOG_SUMMARY="/usr/bin/syslog-summary"
>- 
>-@@ -89,20 +82,15 @@
>- SORTUNIQ=0
>- SUPPORT_CRACKING_IGNORE=0
>- SYSLOGSUMMARY=0
>--LOCKDIR=/run/lock/logcheck
>-+LOCKDIR=/var/run/logcheck
>- LOCKFILE="$LOCKDIR/logcheck"
>- 
>- # Carry out the clean up tasks
>- cleanup() {
>- 
>--    if [ -n "$LOCK" ]; then
>--        debug "cleanup: Killing lockfile-touch - $LOCK"
>--	kill "$LOCK" && unset LOCK
>--    fi
>--
>--    if [ -f "$LOCKFILE.lock" ]; then
>--        debug "cleanup: Removing lockfile: $LOCKFILE.lock"
>--	lockfile-remove "$LOCKFILE"
>-+    if [ -f "$LOCKFILE" ]; then
>-+        debug "cleanup: Removing lockfile: $LOCKFILE"
>-+	rm -f "$LOCKFILE"
>-     fi
>- 
>-     if [ -d "$TMPDIR" ]; then
>-@@ -144,14 +132,9 @@
>-     if [ "$2" = "noclean" ]; then
>- 	debug "error: Not removing lockfile"
>-     else
>--        if [ -n "$LOCK" ]; then
>--	    debug "error: Killing lockfile-touch - $LOCK"
>--	    kill "$LOCK" && unset LOCK
>--	fi
>--
>--       if [ -f "$LOCKFILE.lock" ]; then
>--           debug "error: Removing lockfile: $LOCKFILE.lock"
>--           lockfile-remove "$LOCKFILE"
>-+       if [ -f "$LOCKFILE" ]; then
>-+           debug "error: Removing lockfile: $LOCKFILE"
>-+           rm -f "$LOCKFILE"
>-        fi
>- 
>-     fi
>-@@ -170,7 +153,7 @@
>- ${TMPDIR:+Check temporary directory: $TMPDIR
>- }
>- Also verify that the logcheck user can read all files referenced in
>--/etc/logcheck/logcheck.logfiles!
>-+%%ETCDIR%%/logcheck.logfiles!
>- 
>- $(export)
>- EOF
>-@@ -215,7 +198,7 @@
>- 	    mkdir "$cleaned" \
>- 	        || error "Could not make dir $cleaned for cleaned rulefiles."
>- 	fi
>--	for rulefile in $(run-parts --list "$dir"); do
>-+	for rulefile in $(ls -1R "$dir"); do
>- 	    rulefile="$(basename "$rulefile")"
>- 	    if [ -f "${dir}/${rulefile}" ]; then
>- 		debug "cleanrules: ${dir}/${rulefile}"
>-@@ -529,9 +512,9 @@
>- 
>- # Hostname either fully qualified or not.
>- if [ "$FQDN" -eq 1 ]; then
>--        HOSTNAME="$(hostname --fqdn 2>/dev/null)"
>-+        HOSTNAME="$(hostname -f 2>/dev/null)"
>- else
>--        HOSTNAME="$(hostname --short 2>/dev/null)"
>-+        HOSTNAME="$(hostname -s 2>/dev/null)"
>- fi
>- 
>- # Now check for the other options
>-@@ -610,30 +593,25 @@
>- 
>- trap 'cleanup' 0
>- 
>--debug "Trying to get lockfile: $LOCKFILE.lock"
>-+debug "Trying to get lockfile: $LOCKFILE"
>- if [ ! -d "$LOCKDIR" ]; then
>- 	mkdir -m 0755 "$LOCKDIR"
>- fi
>--lockfile-create --retry 1 "$LOCKFILE" > /dev/null 2>&1
>-+lockfile -r 1 "$LOCKFILE" > /dev/null 2>&1
>- 
>- 
>- if [ $? -eq 1 ]; then
>-     trap 0
>--    if [ -e "${LOCKFILE}.lock" ]; then
>-+    if [ -e "${LOCKFILE}" ]; then
>-         error "Another logcheck process is still running" "noclean"
>-     else
>--        error "Failed to get lockfile: $LOCKFILE.lock" "noclean"
>-+        error "Failed to get lockfile: $LOCKFILE" "noclean"
>-     fi
>--
>--else
>--    debug "Running lockfile-touch $LOCKFILE.lock"
>--    lockfile-touch "$LOCKFILE" &
>--    LOCK="$!"
>- fi
>- 
>- # Create the secure temporary directory or exit
>--TMPDIR="$(mktemp -d -p "${TMP:-/tmp}" logcheck.XXXXXX)" \
>--    || TMPDIR="$(mktemp -d -p /var/tmp logcheck.XXXXXX)" \
>-+TMPDIR="$(mktemp -d ${TMP:-/tmp}/logcheck.XXXXXX)" \
>-+    || TMPDIR="$(mktemp -d /var/tmp/logcheck.XXXXXX)" \
>-     || error "Could not create temporary directory"
>- 
>- # Now clean the rulefiles in the directories
>Index: files/extra-patch-src__logtail2.in
>===================================================================
>--- files/extra-patch-src__logtail2.in	(revision 445407)
>+++ files/extra-patch-src__logtail2.in	(nonexistent)
>@@ -1,11 +0,0 @@
>---- src/logtail2.orig	2010-01-18 17:24:26.000000000 -0500
>-+++ src/logtail2	2010-01-18 17:24:40.000000000 -0500
>-@@ -108,7 +108,7 @@
>-     # function with dateext magic added.
>-     
>-     #print "determine_rotated_logfile $filename $inode\n";
>--    for my $codefile (glob("/usr/share/logtail/detectrotate/*.dtr")) {
>-+    for my $codefile (glob("%%DATADIR%%/detectrotate/*.dtr")) {
>-         my $func = do $codefile;
>-         if (!$func) {
>- 	    print STDERR "cannot compile $codefile: $!";
>Index: files/patch-debian_logcheck.cron.d
>===================================================================
>--- files/patch-debian_logcheck.cron.d	(nonexistent)
>+++ files/patch-debian_logcheck.cron.d	(working copy)
>@@ -0,0 +1,16 @@
>+--- debian/logcheck.cron.d.orig	2017-01-25 21:08:04 UTC
>++++ debian/logcheck.cron.d
>+@@ -1,9 +1,5 @@
>+-# /etc/cron.d/logcheck: crontab entries for the logcheck package
>+-
>+-PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
>++# crontab entries for the logcheck package
>++PATH=/sbin:/bin:/usr/sbin:/usr/bin:%%PREFIX%%/sbin:%%PREFIX%%/bin
>+ MAILTO=root
>+-
>+-@reboot         logcheck    if [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck -R; fi
>+-2 * * * *       logcheck    if [ -x /usr/sbin/logcheck ]; then nice -n10 /usr/sbin/logcheck; fi
>+-
>+-# EOF
>++@reboot    if [ -x %%PREFIX%%/sbin/logcheck ]; then nice -n10 %%PREFIX%%/sbin/logcheck -R; fi
>++2 * * * *  if [ -x %%PREFIX%%/sbin/logcheck ]; then nice -n10 %%PREFIX%%/sbin/logcheck; fi
>Index: files/patch-docs_logcheck.sgml
>===================================================================
>--- files/patch-docs_logcheck.sgml	(nonexistent)
>+++ files/patch-docs_logcheck.sgml	(working copy)
>@@ -0,0 +1,17 @@
>+--- docs/logcheck.sgml.orig	2017-01-25 21:08:04 UTC
>++++ docs/logcheck.sgml
>+@@ -244,10 +244,10 @@ manpage.1: manpage.sgml
>+   <refsect1>
>+     <title>FILES</title>
>+ 
>+-    <para>/etc/logcheck/logcheck.conf is the main configuration file.</para>
>+-    <para>/etc/logcheck/logcheck.logfiles is the list of files to monitor.</para>
>+-    <para>/etc/logcheck/logcheck.logfiles.d is the directory of lists of files to monitor.</para>
>+-    <para>/usr/share/doc/logcheck-database/README.logcheck-database.gz for hints on how to write, test and maintain rules.</para>
>++    <para>%%ETCDIR%%/logcheck.conf is the main configuration file.</para>
>++    <para>%%ETCDIR%%/logcheck.logfiles is the list of files to monitor.</para>
>++    <para>%%ETCDIR%%/logcheck.logfiles.d is the directory of lists of files to monitor.</para>
>++    <para>%%DOCSDIR%%/README.logcheck-database for hints on how to write, test and maintain rules.</para>
>+   </refsect1>
>+   <refsect1>
>+     <title>EXIT STATUS</title>
>Index: files/patch-etc_logcheck.conf
>===================================================================
>--- files/patch-etc_logcheck.conf	(nonexistent)
>+++ files/patch-etc_logcheck.conf	(working copy)
>@@ -0,0 +1,17 @@
>+--- etc/logcheck.conf.orig	2017-01-25 21:08:04 UTC
>++++ etc/logcheck.conf
>+@@ -53,13 +53,7 @@ FQDN=1
>+ # Controls the base directory for rules file location
>+ # This must be an absolute path
>+ 
>+-#RULEDIR="/etc/logcheck"
>+-
>+-# Controls if syslog-summary is run over each section.
>+-# Alternatively, set to "1" to enable extra summary.
>+-# HINT: syslog-summary needs to be installed.
>+-
>+-#SYSLOGSUMMARY=0
>++#RULEDIR="%%ETCDIR%%"
>+ 
>+ # Controls Subject: lines on logcheck reports:
>+ 
>Index: files/patch-rulefiles__linux__ignore.d.server__ssh
>===================================================================
>--- files/patch-rulefiles__linux__ignore.d.server__ssh	(revision 445407)
>+++ files/patch-rulefiles__linux__ignore.d.server__ssh	(working copy)
>@@ -1,6 +1,6 @@
>---- ./rulefiles/linux/ignore.d.server/ssh.orig	2010-09-03 04:24:30.000000000 -0400
>-+++ ./rulefiles/linux/ignore.d.server/ssh	2011-11-23 14:25:31.000000000 -0500
>-@@ -21,8 +21,8 @@
>+--- rulefiles/linux/ignore.d.server/ssh.orig	2017-01-25 21:08:04 UTC
>++++ rulefiles/linux/ignore.d.server/ssh
>+@@ -27,8 +27,8 @@
>  ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: $pam_unix$ check pass; user unknown$
>  ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: $pam_unix$ bad username \[[^]]+\]$
>  ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: Could not get shadow information for NOUSER$
>Index: files/patch-src_logcheck
>===================================================================
>--- files/patch-src_logcheck	(nonexistent)
>+++ files/patch-src_logcheck	(working copy)
>@@ -0,0 +1,153 @@
>+--- src/logcheck.orig	2017-07-10 17:15:49 UTC
>++++ src/logcheck
>+@@ -24,17 +24,10 @@
>+ 
>+ if [ `id -u` = 0 ]; then
>+     echo "logcheck should not be run as root. Use su to invoke logcheck:"
>+-    echo "su -s /bin/bash -c \"/usr/sbin/logcheck${@:+ $@}\" logcheck"
>++    echo "su -m %%LOGCHECK_USER%% -c \"%%LOCALBASE%%/bin/bash %%PREFIX%%/sbin/logcheck${@:+ $@}\""
>+     echo "Or use sudo: sudo -u logcheck logcheck${@:+ $@}."
>+     # you may want to uncomment that hack to let logcheck invoke itself.
>+-    # su -s /bin/bash -c "$0 $*" logcheck
>+-    exit 1
>+-fi
>+-
>+-if [ ! -f /usr/bin/lockfile-create -o \
>+-     ! -f /usr/bin/lockfile-remove -o \
>+-     ! -f /usr/bin/lockfile-touch ]; then
>+-    echo "fatal: lockfile-progs is a prerequisite for logcheck, and was not found."
>++    # su -s %%LOCALBASE%%/bin/bash -c "$0 $*" logcheck
>+     exit 1
>+ fi
>+ 
>+@@ -69,13 +62,13 @@ EVENTSSUBJECT="System Events"
>+ ADDTAG="no"
>+ 
>+ # Set the default paths
>+-RULEDIR="/etc/logcheck"
>+-CONFFILE="/etc/logcheck/logcheck.conf"
>+-STATEDIR="/var/lib/logcheck"
>+-LOGFILES_LIST="/etc/logcheck/logcheck.logfiles"
>+-LOGFILES_LIST_D="/etc/logcheck/logcheck.logfiles.d"
>+-LOGFILE_FALLBACK="/var/log/syslog"
>+-LOGTAIL="/usr/sbin/logtail2"
>++RULEDIR="%%ETCDIR%%"
>++CONFFILE="%%ETCDIR%%/logcheck.conf"
>++STATEDIR="%%DBDIR%%"
>++LOGFILES_LIST="%%ETCDIR%%/logcheck.logfiles"
>++LOGFILES_LIST_D="%%ETCDIR%%/logcheck.logfiles.d"
>++LOGFILE_FALLBACK="/var/log/messages"
>++LOGTAIL="%%PREFIX%%/sbin/logtail2"
>+ CAT="/bin/cat"
>+ SYSLOG_SUMMARY="/usr/bin/syslog-summary"
>+ 
>+@@ -90,20 +83,15 @@ FQDN=0
>+ SORTUNIQ=0
>+ SUPPORT_CRACKING_IGNORE=0
>+ SYSLOGSUMMARY=0
>+-LOCKDIR=/run/lock/logcheck
>++LOCKDIR=/var/run/logcheck
>+ LOCKFILE="$LOCKDIR/logcheck"
>+ 
>+ # Carry out the clean up tasks
>+ cleanup() {
>+ 
>+-    if [ -n "$LOCK" ]; then
>+-        debug "cleanup: Killing lockfile-touch - $LOCK"
>+-	kill "$LOCK" && unset LOCK
>+-    fi
>+-
>+-    if [ -f "$LOCKFILE.lock" ]; then
>+-        debug "cleanup: Removing lockfile: $LOCKFILE.lock"
>+-	lockfile-remove "$LOCKFILE"
>++    if [ -f "$LOCKFILE" ]; then
>++        debug "cleanup: Removing lockfile: $LOCKFILE"
>++	rm -f "$LOCKFILE"
>+     fi
>+ 
>+     if [ -d "$TMPDIR" ]; then
>+@@ -145,14 +133,9 @@ error() {
>+     if [ "$2" = "noclean" ]; then
>+ 	debug "error: Not removing lockfile"
>+     else
>+-        if [ -n "$LOCK" ]; then
>+-	    debug "error: Killing lockfile-touch - $LOCK"
>+-	    kill "$LOCK" && unset LOCK
>+-	fi
>+-
>+-       if [ -f "$LOCKFILE.lock" ]; then
>+-           debug "error: Removing lockfile: $LOCKFILE.lock"
>+-           lockfile-remove "$LOCKFILE"
>++       if [ -f "$LOCKFILE" ]; then
>++           debug "error: Removing lockfile: $LOCKFILE"
>++           rm -f "$LOCKFILE"
>+        fi
>+ 
>+     fi
>+@@ -171,7 +154,7 @@ $message
>+ ${TMPDIR:+Check temporary directory: $TMPDIR
>+ }
>+ Also verify that the logcheck user can read all files referenced in
>+-/etc/logcheck/logcheck.logfiles!
>++%%ETCDIR%%/logcheck.logfiles!
>+ 
>+ $(export)
>+ EOF
>+@@ -223,7 +206,7 @@ cleanrules() {
>+ 			error "Couldn't read $x"
>+ 		fi
>+ 	done
>+-	for rulefile in $(run-parts --list "$dir"); do
>++	for rulefile in $(ls -1R "$dir"); do
>+ 	    rulefile="$(basename "$rulefile")"
>+ 	    if [ -f "${dir}/${rulefile}" ]; then
>+ 		debug "cleanrules: ${dir}/${rulefile}"
>+@@ -538,9 +521,9 @@ fi
>+ 
>+ # Hostname either fully qualified or not.
>+ if [ "$FQDN" -eq 1 ]; then
>+-        HOSTNAME="$(hostname --fqdn 2>/dev/null)"
>++        HOSTNAME="$(hostname -f 2>/dev/null)"
>+ else
>+-        HOSTNAME="$(hostname --short 2>/dev/null)"
>++        HOSTNAME="$(hostname -s 2>/dev/null)"
>+ fi
>+ 
>+ # Now check for the other options
>+@@ -623,30 +606,25 @@ fi
>+ 
>+ trap 'cleanup' 0
>+ 
>+-debug "Trying to get lockfile: $LOCKFILE.lock"
>++debug "Trying to get lockfile: $LOCKFILE"
>+ if [ ! -d "$LOCKDIR" ]; then
>+ 	mkdir -m 0755 "$LOCKDIR"
>+ fi
>+-lockfile-create --retry 1 "$LOCKFILE" > /dev/null 2>&1
>++lockfile -r 1 "$LOCKFILE" > /dev/null 2>&1
>+ 
>+ 
>+ if [ $? -eq 1 ]; then
>+     trap 0
>+-    if [ -e "${LOCKFILE}.lock" ]; then
>++    if [ -e "${LOCKFILE}" ]; then
>+         error "Another logcheck process is still running" "noclean"
>+     else
>+-        error "Failed to get lockfile: $LOCKFILE.lock" "noclean"
>++        error "Failed to get lockfile: $LOCKFILE" "noclean"
>+     fi
>+-
>+-else
>+-    debug "Running lockfile-touch $LOCKFILE.lock"
>+-    lockfile-touch "$LOCKFILE" &
>+-    LOCK="$!"
>+ fi
>+ 
>+ # Create the secure temporary directory or exit
>+-TMPDIR="$(mktemp -d -p "${TMP:-/tmp}" logcheck.XXXXXX)" \
>+-    || TMPDIR="$(mktemp -d -p /var/tmp logcheck.XXXXXX)" \
>++TMPDIR="$(mktemp -d ${TMP:-/tmp}/logcheck.XXXXXX)" \
>++    || TMPDIR="$(mktemp -d /var/tmp/logcheck.XXXXXX)" \
>+     || error "Could not create temporary directory"
>+ 
>+ # Now clean the rulefiles in the directories
>Index: files/patch-src_logtail2
>===================================================================
>--- files/patch-src_logtail2	(nonexistent)
>+++ files/patch-src_logtail2	(working copy)
>@@ -0,0 +1,11 @@
>+--- src/logtail2.orig	2017-07-10 17:15:49 UTC
>++++ src/logtail2
>+@@ -109,7 +109,7 @@ sub determine_rotated_logfile {
>+     # function with dateext magic added.
>+ 
>+     #print "determine_rotated_logfile $filename $inode\n";
>+-    for my $codefile (glob("/usr/share/logtail/detectrotate/*.dtr")) {
>++    for my $codefile (glob("%%DATADIR%%/detectrotate/*.dtr")) {
>+         my $func = do $codefile;
>+         if (!$func) {
>+ 	    print STDERR "cannot compile $codefile: $!";
>Index: pkg-plist
>===================================================================
>--- pkg-plist	(revision 445407)
>+++ pkg-plist	(working copy)
>@@ -1,4 +1,7 @@
> @mode 640
>+%%DATADIR%%/detectrotate/10-savelog.dtr
>+%%DATADIR%%/detectrotate/20-logrotate.dtr
>+%%DATADIR%%/detectrotate/30-logrotate-dateext.dtr
> %%ETCDIR%%/cracking.d/kernel
> %%ETCDIR%%/cracking.d/rlogind
> %%ETCDIR%%/cracking.d/rsh
>@@ -131,6 +134,8 @@
> %%ETCDIR%%/ignore.d.server/sudo
> %%ETCDIR%%/ignore.d.server/sympa
> %%ETCDIR%%/ignore.d.server/syslogd
>+%%ETCDIR%%/ignore.d.server/systemd
>+%%ETCDIR%%/ignore.d.server/systemd-timesyncd
> %%ETCDIR%%/ignore.d.server/teapop
> %%ETCDIR%%/ignore.d.server/telnetd
> %%ETCDIR%%/ignore.d.server/tftpd
>@@ -179,6 +184,8 @@
> %%ETCDIR%%/ignore.d.workstation/wpasupplicant
> %%ETCDIR%%/ignore.d.workstation/xdm
> %%ETCDIR%%/ignore.d.workstation/xlockmore
>+%%ETCDIR%%/logcheck.conf.sample
>+%%ETCDIR%%/logcheck.logfiles.sample
> %%ETCDIR%%/violations.d/kernel
> %%ETCDIR%%/violations.d/logcheck
> %%ETCDIR%%/violations.d/smartd
>@@ -186,11 +193,6 @@
> %%ETCDIR%%/violations.d/sudo
> %%ETCDIR%%/violations.ignore.d/logcheck-su
> %%ETCDIR%%/violations.ignore.d/logcheck-sudo
>-%%ETCDIR%%/logcheck.conf.sample
>-%%ETCDIR%%/logcheck.logfiles.sample
>-%%DATADIR%%/detectrotate/10-savelog.dtr
>-%%DATADIR%%/detectrotate/20-logrotate.dtr
>-%%DATADIR%%/detectrotate/30-logrotate-dateext.dtr
> @mode
> man/man8/logcheck.8.gz
> man/man8/logtail.8.gz

Flags:

yasu: maintainer-approval+

Actions: View | Diff

Attachments on bug 220609: 184238 | 184253 | 184281 | 184295