[Logcheck-devel] [PATCH] Added "@" to proftpd "no such user" rules, to catch anonymous at foo.bar

[Frédéric Brière]

Frédéric Brière <fbriere at fbriere.net> wrote:
> -^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]:? [._[:alnum:]-]+ \([:._[:alnum:]-]+\[[.:[:xdigit:]]+\]\)(:| -) USER [-_.[:alnum:]]+: no such user found from [.:_[:alnum:]-]+ \[[.:[:xdigit:]]+\] to [.:[:xdigit:]]+:[[:digit:]]{2,5}$
> +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ proftpd\[[0-9]+\]:? [._[:alnum:]-]+ \([:._[:alnum:]-]+\[[.:[:xdigit:]]+\]\)(:| -) USER [-_.@[:alnum:]]+: no such user found from [.:_[:alnum:]-]+ \[[.:[:xdigit:]]+\] to [.:[:xdigit:]]+:[[:digit:]]{2,5}$

For some reason, 456aef8691bbf408b7884896676ee59520bcc6a1 added the "@"
character to the hostname instead of the user name.  Was this
intentional?


-- 
Packages should build-depend on what they should build-depend.
		-- Santiago Vila on debian-devel