[Pkg-logwatch-general] r51 - trunk/patches

Willi Mann willi-guest at costa.debian.org
Fri Sep 22 09:49:41 UTC 2006


Author: willi-guest
Date: 2006-09-22 09:49:41 +0000 (Fri, 22 Sep 2006)
New Revision: 51

Modified:
   trunk/patches/01-unmatchedsecure.diff
Log:
Start for 7.3.1-2: Ignore another line secure, which is reported in pam.


Modified: trunk/patches/01-unmatchedsecure.diff
===================================================================
--- trunk/patches/01-unmatchedsecure.diff	2006-09-21 19:28:58 UTC (rev 50)
+++ trunk/patches/01-unmatchedsecure.diff	2006-09-22 09:49:41 UTC (rev 51)
@@ -1,14 +1,13 @@
-# These are reported in pam_unix in Debian anyway
-diff -ur logwatch-7.3.1.b/scripts/services/secure logwatch-7.3.1/scripts/services/secure
---- logwatch-7.3.1.b/scripts/services/secure	2006-09-15 17:40:58.000000000 +0200
-+++ logwatch-7.3.1/scripts/services/secure	2006-09-21 15:04:53.000000000 +0200
+diff -u logwatch-7.3.1/scripts/services/secure logwatch-7.3.1/scripts/services/secure
+--- logwatch-7.3.1/scripts/services/secure	2006-09-21 15:04:53.000000000 +0200
++++ logwatch-7.3.1/scripts/services/secure	2006-09-22 11:42:03.000000000 +0200
 @@ -174,6 +174,9 @@
        ( $ThisLine =~ /^sshd\(\w+\)\[\d+\]: session /) or
        ( $ThisLine =~ /^ipop3d\[\d+\]:/) or
        ( $ThisLine =~ /^su\[\d+\]: [+-] .+/) or
 +      ( $ThisLine =~ /^su\[\d+\]: FAILED su for \S+ by \S+/) or #debian: done in pam_unix
 +      ( $ThisLine =~ /^login\[\d+\]: ROOT LOGIN  on '\S+'/) or #debian: done in pam_unix (Similar message on other system is reported)
-+      ( $ThisLine =~ /^login\[\d+\]: FAILED LOGIN \(\d+\) on '\S+' FOR `\S+', Authentication failure/) or #debian: done in pam_unix
++      ( $ThisLine =~ /^login\[\d+\]: FAILED LOGIN \(\d+\) on ['`]\S+' FOR `\S+', (Authentication failure|User not known to the underlying authentication module)/) or #debian: done in pam_unix
        ( $ThisLine =~ /^pam_limits\[\d+\]/ ) or
        ( $ThisLine =~ /^kcheckpass(\[\d+\]|):/ ) or   # done in pam_unix
        ( $ThisLine =~ /^cyrus\/lmtpd\[\d+\]: [^ ]+ server step [12]/ ) or




More information about the Pkg-logwatch-general mailing list