|
Rozmiar: 539
Komentarz: INIT
|
Rozmiar: 6167
Komentarz: aktualizacja patchy; poprawka parserów dla patchy
|
| Usunięcia zostały oznaczone w ten sposób. | Dodatki zostały oznaczone w ten sposób. |
| Linia 4: | Linia 4: |
| <<TableOfContents()>> <<BR>> |
|
| Linia 6: | Linia 8: |
| == Uprawnienia do plików == | |
| Linia 9: | Linia 12: |
| # dla partycji UFS # |
|
| Linia 11: | Linia 16: |
# dla partycji ZFS # setfacl -m u:logcheck:rwx::allow /var/log setfacl -m g:logcheck:r::allow /var/log/security /var/log/auth.log |
|
| Linia 15: | Linia 26: |
| No i powinno być już OK. | == Patchowanie wybranych plików == === violations.d === {{{#!diff numbers=off --- kernel.orig 2014-12-08 12:24:33.312207000 +0100 +++ kernel 2014-12-09 11:12:54.385550315 +0100 @@ -1,2 +1,2 @@ -^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? [[:alnum:]]+: media error \(bad sector\): status=0x[[:xdigit:]]+ { DriveReady SeekComplete Error }$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? [[:alnum:]]+: media error \(bad sector\): status=0x[[:xdigit:]]+ \{ DriveReady SeekComplete Error \}$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? end_request: I/O error, dev [[:alnum:]]+, sector [[:digit:]]+ }}} === ignore.d.server === {{{#!diff numbers=off --- cyrus.orig 2014-03-18 00:18:27.000000000 +0100 +++ cyrus 2014-07-30 00:47:50.000000000 +0200 @@ -4,3 +4,12 @@ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/lmtpd\[[0-9]+\]: DBERROR db3: [12] lockers$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/notifyd\[[0-9]+\]: MAIL, , [^[:space:]]+, [^[:space:]]+, \"[ [:alnum:][:punct:]]+\"$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/squatter\[[0-9]+\]: (skipping|indexing) mailbox [[:alpha:]^\.]+\.\.\.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ctl_cyrusdb\[[0-9]+\]: (done )?checkpointing cyrus databases +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3s?\[[0-9]+\]: counts: retr +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3s?\[[0-9]+\]: starttls: TLSv1 with cipher +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3s?\[[0-9]+\]: imapd:Loading hard-coded DH parameters +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (pop3s?|lmtpunix|imap)\[[0-9]+\]: USAGE [^[:space:]]+ user: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3s?\[[0-9]+\]: Expunged [0-9]+ messages from user +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (pop3s?|imap)\[[0-9]+\]: .* User logged in SESSIONID= +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sieve\[[0-9]+\]: .* User logged in +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (pop3s?|imap)\[[0-9]+\]: .* starttls: }}} == gnugrep == Dla systemów FreeBSD, w których jest bsdgrep (jako domyślny w base system), to konieczność jest modyfikacji '''logcheck''' aby korzystał z gnugrep (są jakieś drobne różnice): {{{#!shell numbers=off portupgrade -N gnugrep }}} Oraz zapatchowanie samej binarki: {{{#!diff numbers=off --- /usr/local/sbin/logcheck 2015-06-02 21:58:07.000000000 +0200 +++ /usr/local/sbin/logcheck.new 2015-06-10 21:37:54.000798776 +0200 @@ -204,7 +204,7 @@ debug "cleanrules: ${dir}/${rulefile}" if [ -r "${dir}/${rulefile}" ]; then # pipe to cat on greps to get usable exit status - egrep --text -v '^[[:space:]]*$|^#' "$dir/$rulefile" | cat \ + /usr/local/bin/egrep --text -v '^[[:space:]]*$|^#' "$dir/$rulefile" | cat \ >> "$cleaned/$rulefile" \ || error "Couldn't append to $cleaned/$rulefile." else @@ -227,7 +227,7 @@ if [ "$SYSLOGSUMMARY" -eq 1 ] && [ -x "$SYSLOG_SUMMARY" ]; then debug "report: running syslog-summary - $*" $SYSLOG_SUMMARY "$TMPDIR/checked" | \ - egrep -v "^Summarizing " | cat >> "$TMPDIR/report" \ + /usr/local/bin/egrep -v "^Summarizing " | cat >> "$TMPDIR/report" \ || error "Could not append to report." else if [ "$SYSLOGSUMMARY" -eq 1 ] && [ ! -x "$SYSLOG_SUMMARY" ]; then @@ -309,7 +309,7 @@ debug "greplogoutput: $grepfile" # Raise entries that match - egrep --text -f "$raise/$grepfile" "$TMPDIR/logoutput-sorted" | cat \ + /usr/local/bin/egrep --text -f "$raise/$grepfile" "$TMPDIR/logoutput-sorted" | cat \ > "$TMPDIR/checked" \ || error "Could not output to $TMPDIR/checked." @@ -380,13 +380,13 @@ return $RETURN } -# Process a logfile snippet with egrep. +# Process a logfile snippet with /usr/local/bin/egrep. cleanchecked() { clean="$1" if [ -f "$clean" ]; then debug "cleanchecked - file: $clean" - egrep --text -v -f "$clean" "$TMPDIR/checked" | cat >> "$TMPDIR/checked.1" \ + /usr/local/bin/egrep --text -v -f "$clean" "$TMPDIR/checked" | cat >> "$TMPDIR/checked.1" \ || error "Could not output to $TMPDIR/checked.1." mv "$TMPDIR/checked.1" "$TMPDIR/checked" \ || error "Could not move $TMPDIR/checked.1 to $TMPDIR/checked" @@ -394,7 +394,7 @@ debug "cleanchecked - dir - $clean" for file in $(ls -1 "$clean/"); do debug "cleanchecked - dir - $clean/$file" - egrep --text -v -f "$clean/$file" "$TMPDIR/checked" | cat \ + /usr/local/bin/egrep --text -v -f "$clean/$file" "$TMPDIR/checked" | cat \ >> "$TMPDIR/checked.1" \ || error "Could not output to TMPDIR/checked.1." mv "$TMPDIR/checked.1" "$TMPDIR/checked" \ @@ -641,7 +641,7 @@ || error "Could not mkdir for log files" if [ ! "$LOGFILE" ] && [ -r "$LOGFILES_LIST" ]; then SAVEIFS=$IFS; IFS=$(echo -en "\n\b"); - for file in $(egrep --text -v "(^#|^[[:space:]]*$)" "$LOGFILES_LIST"); do + for file in $(/usr/local/bin/egrep --text -v "(^#|^[[:space:]]*$)" "$LOGFILES_LIST"); do logoutput "$file" done IFS=$SAVEIFS }}} |
Spis Treści
Konfiguracja logcheck
Uprawnienia do plików
Po zainstalowaniu logcheck (od wersji logcheck-1.2.69_1) trzeba nieco "poprawić" uprawnienia w systemie plików, aby logcheck działał poprawnie:
# dla partycji UFS
#
setfacl -m u:logcheck:rwx /var/log
setfacl -m g:logcheck:r /var/log/security /var/log/auth.log
# dla partycji ZFS
#
setfacl -m u:logcheck:rwx::allow /var/log
setfacl -m g:logcheck:r::allow /var/log/security /var/log/auth.log
chgrp -R logcheck /var/log/sudo/
chown -R logcheck /usr/local/share/logcheck/detectrotate/
Patchowanie wybranych plików
violations.d
--- kernel.orig 2014-12-08 12:24:33.312207000 +0100
+++ kernel 2014-12-09 11:12:54.385550315 +0100
@@ -1,2 +1,2 @@
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? [[:alnum:]]+: media error \(bad sector\): status=0x[[:xdigit:]]+ { DriveReady SeekComplete Error }$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? [[:alnum:]]+: media error \(bad sector\): status=0x[[:xdigit:]]+ \{ DriveReady SeekComplete Error \}$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? end_request: I/O error, dev [[:alnum:]]+, sector [[:digit:]]+
ignore.d.server
--- cyrus.orig 2014-03-18 00:18:27.000000000 +0100
+++ cyrus 2014-07-30 00:47:50.000000000 +0200
@@ -4,3 +4,12 @@
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/lmtpd\[[0-9]+\]: DBERROR db3: [12] lockers$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/notifyd\[[0-9]+\]: MAIL, , [^[:space:]]+, [^[:space:]]+, \"[ [:alnum:][:punct:]]+\"$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/squatter\[[0-9]+\]: (skipping|indexing) mailbox [[:alpha:]^\.]+\.\.\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ctl_cyrusdb\[[0-9]+\]: (done )?checkpointing cyrus databases
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3s?\[[0-9]+\]: counts: retr
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3s?\[[0-9]+\]: starttls: TLSv1 with cipher
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3s?\[[0-9]+\]: imapd:Loading hard-coded DH parameters
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (pop3s?|lmtpunix|imap)\[[0-9]+\]: USAGE [^[:space:]]+ user:
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3s?\[[0-9]+\]: Expunged [0-9]+ messages from user
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (pop3s?|imap)\[[0-9]+\]: .* User logged in SESSIONID=
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sieve\[[0-9]+\]: .* User logged in
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (pop3s?|imap)\[[0-9]+\]: .* starttls:
gnugrep
Dla systemów FreeBSD, w których jest bsdgrep (jako domyślny w base system), to konieczność jest modyfikacji logcheck aby korzystał z gnugrep (są jakieś drobne różnice):
portupgrade -N gnugrep
Oraz zapatchowanie samej binarki:
--- /usr/local/sbin/logcheck 2015-06-02 21:58:07.000000000 +0200
+++ /usr/local/sbin/logcheck.new 2015-06-10 21:37:54.000798776 +0200
@@ -204,7 +204,7 @@
debug "cleanrules: ${dir}/${rulefile}"
if [ -r "${dir}/${rulefile}" ]; then
# pipe to cat on greps to get usable exit status
- egrep --text -v '^[[:space:]]*$|^#' "$dir/$rulefile" | cat \
+ /usr/local/bin/egrep --text -v '^[[:space:]]*$|^#' "$dir/$rulefile" | cat \
>> "$cleaned/$rulefile" \
|| error "Couldn't append to $cleaned/$rulefile."
else
@@ -227,7 +227,7 @@
if [ "$SYSLOGSUMMARY" -eq 1 ] && [ -x "$SYSLOG_SUMMARY" ]; then
debug "report: running syslog-summary - $*"
$SYSLOG_SUMMARY "$TMPDIR/checked" | \
- egrep -v "^Summarizing " | cat >> "$TMPDIR/report" \
+ /usr/local/bin/egrep -v "^Summarizing " | cat >> "$TMPDIR/report" \
|| error "Could not append to report."
else
if [ "$SYSLOGSUMMARY" -eq 1 ] && [ ! -x "$SYSLOG_SUMMARY" ]; then
@@ -309,7 +309,7 @@
debug "greplogoutput: $grepfile"
# Raise entries that match
- egrep --text -f "$raise/$grepfile" "$TMPDIR/logoutput-sorted" | cat \
+ /usr/local/bin/egrep --text -f "$raise/$grepfile" "$TMPDIR/logoutput-sorted" | cat \
> "$TMPDIR/checked" \
|| error "Could not output to $TMPDIR/checked."
@@ -380,13 +380,13 @@
return $RETURN
}
-# Process a logfile snippet with egrep.
+# Process a logfile snippet with /usr/local/bin/egrep.
cleanchecked() {
clean="$1"
if [ -f "$clean" ]; then
debug "cleanchecked - file: $clean"
- egrep --text -v -f "$clean" "$TMPDIR/checked" | cat >> "$TMPDIR/checked.1" \
+ /usr/local/bin/egrep --text -v -f "$clean" "$TMPDIR/checked" | cat >> "$TMPDIR/checked.1" \
|| error "Could not output to $TMPDIR/checked.1."
mv "$TMPDIR/checked.1" "$TMPDIR/checked" \
|| error "Could not move $TMPDIR/checked.1 to $TMPDIR/checked"
@@ -394,7 +394,7 @@
debug "cleanchecked - dir - $clean"
for file in $(ls -1 "$clean/"); do
debug "cleanchecked - dir - $clean/$file"
- egrep --text -v -f "$clean/$file" "$TMPDIR/checked" | cat \
+ /usr/local/bin/egrep --text -v -f "$clean/$file" "$TMPDIR/checked" | cat \
>> "$TMPDIR/checked.1" \
|| error "Could not output to TMPDIR/checked.1."
mv "$TMPDIR/checked.1" "$TMPDIR/checked" \
@@ -641,7 +641,7 @@
|| error "Could not mkdir for log files"
if [ ! "$LOGFILE" ] && [ -r "$LOGFILES_LIST" ]; then
SAVEIFS=$IFS; IFS=$(echo -en "\n\b");
- for file in $(egrep --text -v "(^#|^[[:space:]]*$)" "$LOGFILES_LIST"); do
+ for file in $(/usr/local/bin/egrep --text -v "(^#|^[[:space:]]*$)" "$LOGFILES_LIST"); do
logoutput "$file"
done
IFS=$SAVEIFS
Wszelkie uwagi proszę kierować do administratora wiki.