I regularly run a command via sudo which emits the following line through syslog to /var/log/auth.log: May 11 07:46:04 <auth.info> XX sudo[5684]: XX : TTY=pts/2 ; PWD=/tmp ; USER=root ; COMMAND=/usr/local/bin/rdist -P ... -l notify=ferror:stdout=warning,nerror,ferror,change,notice -o remove,numchkowner,numchkgroup local4 800.loginfail catches these as the regex part "...|auth.*error)\b" matches the "auth" of "auth.info" until the "ferror,". This spams the daily security output, making real login failures to be easily missed. Instead of trying to refine the regex being currently used (which probably is almost impossible if we want to deal with all cases like this), we might use something like a (user) customisable additional regex to filter stuff out, e.g.: catmsgs | grep -Ev "${security_status_loginfail_ignore_regex}" | egrep -ia "${prefix}.*\b(fail(ures?|ed)?|invalid|bad|illegal|auth.*error)\b" If people thing this is an option, I try to make up a patch. In this case, should we do something like In /etc/defaults/periodic.conf: security_status_loginfail_ignore_regex="" In 800.loginfail: if [ -z "$security_status_loginfail_ignore_regex" ]; then catmsgs | egrep -ia "${prefix}.*\b(fail(ures?|ed)?|invalid|bad|illegal|auth.*error)\b" else catmsgs | grep -Ev "${security_status_loginfail_ignore_regex}" | egrep -ia "${prefix}.*\b(fail(ures?|ed)?|invalid|bad|illegal|auth.*error)\b" fi OR In /etc/defaults/periodic.conf: security_status_loginfail_ignore_regex='$.' In 800.loginfail: catmsgs | grep -Ev "${security_status_loginfail_ignore_regex}" | egrep -ia "${prefix}.*\b(fail(ures?|ed)?|invalid|bad|illegal|auth.*error)\b"
Created attachment 271747 [details] Patch introducing ${security_status_loginfail_ignore} FWIW, I am now using the attached patch with security_status_loginfail_ignore="rdistd.*notify=ferror" in /etc/periodic.conf
Created attachment 271786 [details] Patch introducing ${security_status_loginfail_ignore} ^Triage: rebase and convert to git diff.
André, does ${security_status_loginfail_ignore-^$} make more sense?
(In reply to Michael Osipov from comment #3) You are right -- we can use the simple form which (not) hits only on empty lines (which will never happen since empty lines won't pass the grep before). But we should use ^\$ instead of ^$ :-)
(In reply to Andre Albsmeier from comment #4) Please update the patch and create a full git commit. I will try to find one who is willing to commit and MFC it.
(In reply to Michael Osipov from comment #5) This will be hard as I don't use git. I could try a pull request on github (although this is somehow cumbersome)...
(In reply to Andre Albsmeier from comment #6) No issue, then just update a patch and a commit message you seem reasonable, I will do the review for you.
Created attachment 271954 [details] Updated patch Updated patch honouring michaelo's proposal for a simpler never-match (default) pattern. Document $security_status_loginfail_ignore in the man page. Summary: Introduce $security_status_loginfail_ignore for security/800.loginfail Introduce a new variable "security_status_loginfail_ignore" to filter out false positives which are no failed logins but would spam the output of the standard daily security checks.
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=6a7c8c92245562cfd9b900dedacab99a13d5ca86 commit 6a7c8c92245562cfd9b900dedacab99a13d5ca86 Author: Andre Albsmeier <mail@fbsd2.e4m.org> AuthorDate: 2026-06-19 13:50:00 +0000 Commit: Michael Osipov <michaelo@FreeBSD.org> CommitDate: 2026-06-20 20:34:30 +0000 periodic/security: Introduce $security_status_loginfail_ignore for 800.loginfail Introduce a new variable "security_status_loginfail_ignore" to filter unwanted login failure messages from the daily security checks. Co-authored-by: Michael Osipov <michaelo@FreeBSD.org> Co-authored-by: Joseph Mingrone <jrm@FreeBSD.org> PR: 295191 Reviewed by: jrm MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D57671 share/man/man5/periodic.conf.5 | 6 +++++- usr.sbin/periodic/etc/security/800.loginfail | 1 + 2 files changed, 6 insertions(+), 1 deletion(-)
A commit in branch stable/15 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=624e0bf29d72c008c6cdd641d6e47a44599660b1 commit 624e0bf29d72c008c6cdd641d6e47a44599660b1 Author: Andre Albsmeier <mail@fbsd2.e4m.org> AuthorDate: 2026-06-19 13:50:00 +0000 Commit: Michael Osipov <michaelo@FreeBSD.org> CommitDate: 2026-06-28 20:17:47 +0000 periodic/security: Introduce $security_status_loginfail_ignore for 800.loginfail Introduce a new variable "security_status_loginfail_ignore" to filter unwanted login failure messages from the daily security checks. Co-authored-by: Michael Osipov <michaelo@FreeBSD.org> Co-authored-by: Joseph Mingrone <jrm@FreeBSD.org> PR: 295191 Reviewed by: jrm MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D57671 (cherry picked from commit 6a7c8c92245562cfd9b900dedacab99a13d5ca86) share/man/man5/periodic.conf.5 | 6 +++++- usr.sbin/periodic/etc/security/800.loginfail | 1 + 2 files changed, 6 insertions(+), 1 deletion(-)
A commit in branch stable/14 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=1807800b7986ad9ba9d517d06d9d77f1797fbbab commit 1807800b7986ad9ba9d517d06d9d77f1797fbbab Author: Andre Albsmeier <mail@fbsd2.e4m.org> AuthorDate: 2026-06-19 13:50:00 +0000 Commit: Michael Osipov <michaelo@FreeBSD.org> CommitDate: 2026-06-28 20:21:28 +0000 periodic/security: Introduce $security_status_loginfail_ignore for 800.loginfail Introduce a new variable "security_status_loginfail_ignore" to filter unwanted login failure messages from the daily security checks. Co-authored-by: Michael Osipov <michaelo@FreeBSD.org> Co-authored-by: Joseph Mingrone <jrm@FreeBSD.org> PR: 295191 Reviewed by: jrm MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D57671 (cherry picked from commit 6a7c8c92245562cfd9b900dedacab99a13d5ca86) share/man/man5/periodic.conf.5 | 6 +++++- usr.sbin/periodic/etc/security/800.loginfail | 1 + 2 files changed, 6 insertions(+), 1 deletion(-)