Bug 142467

Summary:	/var/log/auth.log may not be rotated for years
Product:	Base System	Reporter:	Mr. Olli <mister.olli>
Component:	conf	Assignee:	Gleb Smirnoff <glebius>
Status:	Closed FIXED
Severity:	Affects Only Me
Priority:	Normal
Version:	Unspecified
Hardware:	Any
OS:	Any

Description Mr. Olli 2010-01-08 10:40:02 UTC

On system with rare logins /var/log/auth.log may not get rotated, as
'/etc/newsyslog.conf' is configured to rotate if filesize > 100kb.

As login attempts via SSH are saved without year information
'/etc/periodic/security/800.loginfail' will report fail logins from
past years. This heavily confuses users.

Fix: 

'/var/log/auth.log' should be rotated at least once a year.
How-To-Repeat: - Make a default installation
- Do some failed logins
- Wait 1 year ;-)

Comment 1 Gleb Smirnoff freebsd_committer

2012-03-19 10:33:00 UTC

State Changed
From-To: open->patched

Fixed in http://svnweb.freebsd.org/base?view=revision&revision=233167

Comment 2 Gleb Smirnoff freebsd_committer

2012-03-19 10:33:00 UTC

Responsible Changed
From-To: freebsd-bugs->glebius

Fixed in http://svnweb.freebsd.org/base?view=revision&revision=233167

Comment 3 dfilter service freebsd_committer

2012-04-25 08:09:12 UTC

Author: glebius
Date: Wed Apr 25 07:09:02 2012
New Revision: 234675
URL: http://svn.freebsd.org/changeset/base/234675

Log:
  Merge r233167 from head:
    Rotate auth.log and messages at the beginning of a year. Otherwise,
    daily security checks 800.loginfail and 900.tcpwrap may produce
    false positive alerts.
  
  PR:		142467, 165331

Modified:
  stable/9/etc/newsyslog.conf
Directory Properties:
  stable/9/etc/   (props changed)

Modified: stable/9/etc/newsyslog.conf
==============================================================================
--- stable/9/etc/newsyslog.conf	Wed Apr 25 07:04:48 2012	(r234674)
+++ stable/9/etc/newsyslog.conf	Wed Apr 25 07:09:02 2012	(r234675)
@@ -19,7 +19,7 @@
 # logfilename          [owner:group]    mode count size when  flags [/pid_file] [sig_num]
 /var/log/all.log			600  7	   *	@T00  J
 /var/log/amd.log			644  7	   100	*     J
-/var/log/auth.log			600  7     100  *     JC
+/var/log/auth.log			600  7     100  @0101T JC
 /var/log/console.log			600  5	   100	*     J
 /var/log/cron				600  3	   100	*     JC
 /var/log/daily.log			640  7	   *	@T00  JN
@@ -27,7 +27,7 @@
 /var/log/kerberos.log			600  7	   100	*     J
 /var/log/lpd-errs			644  7	   100	*     JC
 /var/log/maillog			640  7	   *	@T00  JC
-/var/log/messages			644  5	   100	*     JC
+/var/log/messages			644  5	   100	@0101T JC
 /var/log/monthly.log			640  12	   *	$M1D0 JN
 /var/log/pflog				600  3	   100	*     JB    /var/run/pflogd.pid
 /var/log/ppp.log	root:network	640  3	   100	*     JC
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"

Comment 4 Gleb Smirnoff freebsd_committer

2012-04-25 08:09:17 UTC

State Changed
From-To: patched->closed

Fixed in stable/9, would be available in 9.1-RELEASE.