<div>    This enhances the regex to include the allowed unix username characters</div><div>    '_' and '.'.</div><div><br></div><div>    reference:</div><div>    <a href="http://pubs.opengroup.org/onlinepubs/000095399/basedefs/xbd_chap03.html#tag_03_426">http://pubs.opengroup.org/onlinepubs/000095399/basedefs/xbd_chap03.html#tag_03_426</a></div>
<div>    <a href="http://pubs.opengroup.org/onlinepubs/000095399/basedefs/xbd_chap03.html#tag_03_276">http://pubs.opengroup.org/onlinepubs/000095399/basedefs/xbd_chap03.html#tag_03_276</a></div><div><br></div><div>Signed-off-by: Daniel Black <<a href="mailto:daniel.black@ingenious.com.au">daniel.black@ingenious.com.au</a>></div>
<div>---</div><div> rulefiles/linux/ignore.d.server/su | 14 +++++++-------</div><div> 1 file changed, 7 insertions(+), 7 deletions(-)</div><div><br></div><div>diff --git a/rulefiles/linux/ignore.d.server/su b/rulefiles/linux/ignore.d.server/su</div>
<div>index e054f38..2c2e332 100644</div><div>--- a/rulefiles/linux/ignore.d.server/su</div><div>+++ b/rulefiles/linux/ignore.d.server/su</div><div>@@ -1,8 +1,8 @@</div><div>-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ su\[[0-9]+\]: (\+|-) (/dev/)?(pts/[0-9]{1,2}|tty[0-9]) [_[:alnum:]-]+:[_[:alnum:]-]+$</div>
<div>-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ su\[[0-9]+\]: Successful su for [[:alnum:]-]+ by [[:alnum:]-]+$</div><div>-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ su\[[0-9]+\]: \(pam_[[:alnum:]]+\) session closed for user [[:alnum:]-]+$</div>
<div>-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ su\[[0-9]+\]: \(pam_[[:alnum:]]+\) session opened for user [[:alnum:]-]+ by ([[:alnum:]-]+)?\(uid=[0-9]+\)$</div><div>-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ su\[[0-9]+\]: \+ \?\?\? root:[_[:alnum:]-]+$</div>
<div>-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ su\[[0-9]+\]: pam_[[:alnum:]]+\(su:session\): session closed for user [[:alnum:]-]+$</div><div>-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ su\[[0-9]+\]: pam_[[:alnum:]]+\(su:session\): session opened for user [[:alnum:]-]+ by ([[:alnum:]-]+)?\(uid=[0-9]+\)$</div>
<div>+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ su\[[0-9]+\]: (\+|-) (/dev/)?(pts/[0-9]{1,2}|tty[0-9]) [_[:alnum:]._-]+:[_[:alnum:]._-]+$</div><div>+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ su\[[0-9]+\]: Successful su for [[:alnum:]-]+ by [[:alnum:]._-]+$</div>
<div>+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ su\[[0-9]+\]: \(pam_[[:alnum:]]+\) session closed for user [[:alnum:]._-]+$</div><div>+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ su\[[0-9]+\]: \(pam_[[:alnum:]]+\) session opened for user [[:alnum:]._-]+ by ([[:alnum:]._-]+)?\(uid=[0-9]+\)$</div>
<div>+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ su\[[0-9]+\]: \+ \?\?\? root:[_[:alnum:]._-]+$</div><div>+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ su\[[0-9]+\]: pam_[[:alnum:]]+\(su:session\): session closed for user [[:alnum:]._-]+$</div>
<div>+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ su\[[0-9]+\]: pam_[[:alnum:]]+\(su:session\): session opened for user [[:alnum:]._-]+ by ([[:alnum:]._-]+)?\(uid=[0-9]+\)$</div><div> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ su\[[0-9]+\]: pam_authenticate: Authentication failure$</div>
<div>-- </div><div>1.7.11.7</div><div><br></div>