Bug 295191 - 800.loginfail false positives
Summary: 800.loginfail false positives
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: conf (show other bugs)
Version: 14.4-STABLE
Hardware: Any Any
: --- Affects Some People
Assignee: Michael Osipov
URL: https://reviews.freebsd.org/D57671
Keywords:
Depends on:
Blocks:
 
Reported: 2026-05-11 06:44 UTC by Andre Albsmeier
Modified: 2026-06-28 22:28 UTC (History)
1 user (show)

See Also:


Attachments
Patch introducing ${security_status_loginfail_ignore} (437 bytes, patch)
2026-06-13 04:02 UTC, Andre Albsmeier
no flags Details | Diff
Patch introducing ${security_status_loginfail_ignore} (537 bytes, patch)
2026-06-14 18:28 UTC, Mark Linimon
no flags Details | Diff
Updated patch (944 bytes, patch)
2026-06-19 13:50 UTC, Andre Albsmeier
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Andre Albsmeier 2026-05-11 06:44:56 UTC
I regularly run a command via sudo which emits the following line through syslog to /var/log/auth.log:

May 11 07:46:04 <auth.info> XX sudo[5684]:    XX : TTY=pts/2 ; PWD=/tmp ; USER=root ; COMMAND=/usr/local/bin/rdist -P ... -l notify=ferror:stdout=warning,nerror,ferror,change,notice -o remove,numchkowner,numchkgroup local4

800.loginfail catches these as the regex part "...|auth.*error)\b" matches
the "auth" of "auth.info" until the "ferror,". This spams the daily security
output, making real login failures to be easily missed.

Instead of trying to refine the regex being currently used (which probably is
almost impossible if we want to deal with all cases like this), we might use
something like a (user) customisable additional regex to filter stuff out, e.g.:

catmsgs | grep -Ev "${security_status_loginfail_ignore_regex}" | egrep -ia "${prefix}.*\b(fail(ures?|ed)?|invalid|bad|illegal|auth.*error)\b"

If people thing this is an option, I try to make up a patch. In this case, should
we do something like

In /etc/defaults/periodic.conf:
security_status_loginfail_ignore_regex=""

In 800.loginfail:
if [ -z "$security_status_loginfail_ignore_regex" ]; then
  catmsgs | egrep -ia "${prefix}.*\b(fail(ures?|ed)?|invalid|bad|illegal|auth.*error)\b"
else
  catmsgs | grep -Ev "${security_status_loginfail_ignore_regex}" | egrep -ia "${prefix}.*\b(fail(ures?|ed)?|invalid|bad|illegal|auth.*error)\b"
fi

OR

In /etc/defaults/periodic.conf:
security_status_loginfail_ignore_regex='$.'

In 800.loginfail:
catmsgs | grep -Ev "${security_status_loginfail_ignore_regex}" | egrep -ia "${prefix}.*\b(fail(ures?|ed)?|invalid|bad|illegal|auth.*error)\b"
Comment 1 Andre Albsmeier 2026-06-13 04:02:50 UTC
Created attachment 271747 [details]
Patch introducing ${security_status_loginfail_ignore}

FWIW, I am now using the attached patch with

security_status_loginfail_ignore="rdistd.*notify=ferror"

in /etc/periodic.conf
Comment 2 Mark Linimon freebsd_committer freebsd_triage 2026-06-14 18:28:04 UTC
Created attachment 271786 [details]
Patch introducing ${security_status_loginfail_ignore}

^Triage: rebase and convert to git diff.
Comment 3 Michael Osipov freebsd_committer freebsd_triage 2026-06-15 11:42:51 UTC
André,

does ${security_status_loginfail_ignore-^$} make more sense?
Comment 4 Andre Albsmeier 2026-06-15 13:11:12 UTC
(In reply to Michael Osipov from comment #3)

You are right -- we can use the simple form which (not) hits only on empty lines (which will never happen since empty lines won't pass the grep before).

But we should use ^\$ instead of ^$ :-)
Comment 5 Michael Osipov freebsd_committer freebsd_triage 2026-06-15 18:46:14 UTC
(In reply to Andre Albsmeier from comment #4)

Please update the patch and create a full git commit. I will try to find one who is willing to commit and MFC it.
Comment 6 Andre Albsmeier 2026-06-16 03:46:02 UTC
(In reply to Michael Osipov from comment #5)
This will be hard as I don't use git. I could try a pull request on github (although this is somehow cumbersome)...
Comment 7 Michael Osipov freebsd_committer freebsd_triage 2026-06-16 07:40:40 UTC
(In reply to Andre Albsmeier from comment #6)

No issue, then just update a patch and a commit message you seem reasonable, I will do the review for you.
Comment 8 Andre Albsmeier 2026-06-19 13:50:51 UTC
Created attachment 271954 [details]
Updated patch

Updated patch honouring michaelo's proposal for a simpler never-match (default) pattern. Document $security_status_loginfail_ignore in the man page.

Summary: Introduce $security_status_loginfail_ignore for security/800.loginfail

Introduce a new variable "security_status_loginfail_ignore" to filter out false positives which are no failed logins but would spam the output of the standard daily security checks.
Comment 9 commit-hook freebsd_committer freebsd_triage 2026-06-20 20:35:39 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=6a7c8c92245562cfd9b900dedacab99a13d5ca86

commit 6a7c8c92245562cfd9b900dedacab99a13d5ca86
Author:     Andre Albsmeier <mail@fbsd2.e4m.org>
AuthorDate: 2026-06-19 13:50:00 +0000
Commit:     Michael Osipov <michaelo@FreeBSD.org>
CommitDate: 2026-06-20 20:34:30 +0000

    periodic/security: Introduce $security_status_loginfail_ignore for 800.loginfail

    Introduce a new variable "security_status_loginfail_ignore" to filter unwanted
    login failure messages from the daily security checks.

    Co-authored-by: Michael Osipov <michaelo@FreeBSD.org>
    Co-authored-by: Joseph Mingrone <jrm@FreeBSD.org>
    PR:             295191
    Reviewed by:    jrm
    MFC after:      1 week
    Differential Revision:  https://reviews.freebsd.org/D57671

 share/man/man5/periodic.conf.5               | 6 +++++-
 usr.sbin/periodic/etc/security/800.loginfail | 1 +
 2 files changed, 6 insertions(+), 1 deletion(-)
Comment 10 commit-hook freebsd_committer freebsd_triage 2026-06-28 20:19:06 UTC
A commit in branch stable/15 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=624e0bf29d72c008c6cdd641d6e47a44599660b1

commit 624e0bf29d72c008c6cdd641d6e47a44599660b1
Author:     Andre Albsmeier <mail@fbsd2.e4m.org>
AuthorDate: 2026-06-19 13:50:00 +0000
Commit:     Michael Osipov <michaelo@FreeBSD.org>
CommitDate: 2026-06-28 20:17:47 +0000

    periodic/security: Introduce $security_status_loginfail_ignore for 800.loginfail

    Introduce a new variable "security_status_loginfail_ignore" to filter unwanted
    login failure messages from the daily security checks.

    Co-authored-by: Michael Osipov <michaelo@FreeBSD.org>
    Co-authored-by: Joseph Mingrone <jrm@FreeBSD.org>
    PR:             295191
    Reviewed by:    jrm
    MFC after:      1 week
    Differential Revision:  https://reviews.freebsd.org/D57671

    (cherry picked from commit 6a7c8c92245562cfd9b900dedacab99a13d5ca86)

 share/man/man5/periodic.conf.5               | 6 +++++-
 usr.sbin/periodic/etc/security/800.loginfail | 1 +
 2 files changed, 6 insertions(+), 1 deletion(-)
Comment 11 commit-hook freebsd_committer freebsd_triage 2026-06-28 20:23:08 UTC
A commit in branch stable/14 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=1807800b7986ad9ba9d517d06d9d77f1797fbbab

commit 1807800b7986ad9ba9d517d06d9d77f1797fbbab
Author:     Andre Albsmeier <mail@fbsd2.e4m.org>
AuthorDate: 2026-06-19 13:50:00 +0000
Commit:     Michael Osipov <michaelo@FreeBSD.org>
CommitDate: 2026-06-28 20:21:28 +0000

    periodic/security: Introduce $security_status_loginfail_ignore for 800.loginfail

    Introduce a new variable "security_status_loginfail_ignore" to filter unwanted
    login failure messages from the daily security checks.

    Co-authored-by: Michael Osipov <michaelo@FreeBSD.org>
    Co-authored-by: Joseph Mingrone <jrm@FreeBSD.org>
    PR:             295191
    Reviewed by:    jrm
    MFC after:      1 week
    Differential Revision:  https://reviews.freebsd.org/D57671

    (cherry picked from commit 6a7c8c92245562cfd9b900dedacab99a13d5ca86)

 share/man/man5/periodic.conf.5               | 6 +++++-
 usr.sbin/periodic/etc/security/800.loginfail | 1 +
 2 files changed, 6 insertions(+), 1 deletion(-)