Package: logcheck-database
Version: 1.2.54
Severity: wishlist
*** Please type your report below this line ***
There is an issue with the pattern matching for su
in /etc/logcheck/violations.d/su Here are the rules from the above file
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ su\[[0-9]+\]: \(pam_[[:alnum:]]+\) .*$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ su\[[0-9]+\]: .*$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ su\[[0-9]+\]: \+ pts/[0-9]+ [[:alnum:]]+-root
$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ su\[[0-9]+\]: \+ \?\?\? root-[[:alnum:]]+$
The issue resides in 3rd and 4th line, the - character should be : for matching
user:root and root:user strings.
Here are the proofs
Running the 3rd line which gives no matches
node1:# egrep '^\w{3} [ :0-9]{11} [._[:alnum:]-]+ su\[[0-9]+\]: \+ pts/[0-9]+
[[:alnum:]]+-root$' auth.log
Running again the 3rd line but changing the - character to :
node1: # egrep '^\w{3} [ :0-9]{11} [._[:alnum:]-]+ su\[[0-9]+\]: \+ pts/[0-9]+
[[:alnum:]]+[-:]root$' auth.log
Jul 21 09:27:36 hraklhs su[4313]: + pts/0 user:root
Jul 21 10:32:48 hraklhs su[5244]: + pts/1 user:root
Running the 4th line which gives no matches
node1:# egrep '^\w{3} [ :0-9]{11} [._[:alnum:]-]+ su\[[0-9]+\]: \+ \?\?\?
root-[[:alnum:]]+$' auth.log
node1:#
Running again the 4th line but changing the - character to :
node1:# egrep '^\w{3} [ :0-9]{11} [._[:alnum:]-]+ su\[[0-9]+\]: \+ \?\?\? root
[-:] [[:alnum:]]+$' auth.log
Jul 20 07:40:01 hraklhs su[11619]: + ??? root:nobody
Jul 21 07:35:01 hraklhs su[23294]: + ??? root:nobody
Jul 21 07:35:01 hraklhs su[23298]: + ??? root:nobody
Jul 21 07:35:01 hraklhs su[23303]: + ??? root:nobody
In order to reproduce the problem the 1st line
in /etc/logcheck/violations.ignore.d/logcheck-su should be removed or commented
out. BTW this line uses the : character and not the - character for matching
user:root and root:user strings.
-- System Information:
Debian Release: 4.0
APT prefers stable
APT policy: (500, 'stable')
Architecture: i386 (i686)
Shell: /bin/sh linked to /bin/bash
Kernel: Linux 2.6.25.10
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Versions of packages logcheck-database depends on:
ii debconf [debconf-2.0] 1.5.11etch1 Debian configuration management sy
logcheck-database recommends no packages.
-- debconf information:
logcheck-database/conffile-cleanup: false
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
