|
Rozmiar: 700
Komentarz: rozbudowa o zfs
|
Rozmiar: 2704
Komentarz: + patchowanie
|
| Usunięcia zostały oznaczone w ten sposób. | Dodatki zostały oznaczone w ten sposób. |
| Linia 6: | Linia 6: |
| == Uprawnienia do plików == | |
| Linia 23: | Linia 24: |
| No i powinno być już OK. | == Patchowanie wybranych plików == === violations.d === {{{#!bsdmake numbers=off --- kernel.orig 2014-12-08 12:24:33.312207000 +0100 +++ kernel 2014-12-09 11:12:54.385550315 +0100 @@ -1,2 +1,2 @@ -^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? [[:alnum:]]+: media error \(bad sector\): status=0x[[:xdigit:]]+ { DriveReady SeekComplete Error }$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? [[:alnum:]]+: media error \(bad sector\): status=0x[[:xdigit:]]+ \{ DriveReady SeekComplete Error \}$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? end_request: I/O error, dev [[:alnum:]]+, sector [[:digit:]]+ }}} === ignore.d.server === {{{#!bsdmake numbers=off --- cyrus.orig 2014-03-18 00:18:27.000000000 +0100 +++ cyrus 2014-07-30 00:47:50.000000000 +0200 @@ -4,3 +4,12 @@ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/lmtpd\[[0-9]+\]: DBERROR db3: [12] lockers$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/notifyd\[[0-9]+\]: MAIL, , [^[:space:]]+, [^[:space:]]+, \"[ [:alnum:][:punct:]]+\"$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/squatter\[[0-9]+\]: (skipping|indexing) mailbox [[:alpha:]^\.]+\.\.\.$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ctl_cyrusdb\[[0-9]+\]: (done )?checkpointing cyrus databases +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3s?\[[0-9]+\]: counts: retr +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3s?\[[0-9]+\]: starttls: TLSv1 with cipher +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3s?\[[0-9]+\]: imapd:Loading hard-coded DH parameters +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (pop3s?|lmtpunix|imap)\[[0-9]+\]: USAGE [^[:space:]]+ user: +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3s?\[[0-9]+\]: Expunged [0-9]+ messages from user +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (pop3s?|imap)\[[0-9]+\]: .* User logged in SESSIONID= +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sieve\[[0-9]+\]: .* User logged in +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (pop3s?|imap)\[[0-9]+\]: .* starttls: }}} |
Konfiguracja logcheck
Uprawnienia do plików
Po zainstalowaniu logcheck (od wersji logcheck-1.2.69_1) trzeba nieco "poprawić" uprawnienia w systemie plików, aby logcheck działał poprawnie:
# dla partycji UFS
#
setfacl -m u:logcheck:rwx /var/log
setfacl -m g:logcheck:r /var/log/security /var/log/auth.log
# dla partycji ZFS
#
setfacl -m u:logcheck:rwx::allow /var/log
setfacl -m g:logcheck:r::allow /var/log/security /var/log/auth.log
chgrp -R logcheck /var/log/sudo/
chown -R logcheck /usr/local/share/logcheck/detectrotate/
Patchowanie wybranych plików
violations.d
--- kernel.orig 2014-12-08 12:24:33.312207000 +0100
+++ kernel 2014-12-09 11:12:54.385550315 +0100
@@ -1,2 +1,2 @@
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? [[:alnum:]]+: media error \(bad sector\): status=0x[[:xdigit:]]+ { DriveReady SeekComplete Error }$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? [[:alnum:]]+: media error \(bad sector\): status=0x[[:xdigit:]]+ \{ DriveReady SeekComplete Error \}$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? end_request: I/O error, dev [[:alnum:]]+, sector [[:digit:]]+
ignore.d.server
--- cyrus.orig 2014-03-18 00:18:27.000000000 +0100
+++ cyrus 2014-07-30 00:47:50.000000000 +0200
@@ -4,3 +4,12 @@
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/lmtpd\[[0-9]+\]: DBERROR db3: [12] lockers$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/notifyd\[[0-9]+\]: MAIL, , [^[:space:]]+, [^[:space:]]+, \"[ [:alnum:][:punct:]]+\"$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/squatter\[[0-9]+\]: (skipping|indexing) mailbox [[:alpha:]^\.]+\.\.\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ctl_cyrusdb\[[0-9]+\]: (done )?checkpointing cyrus databases
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3s?\[[0-9]+\]: counts: retr
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3s?\[[0-9]+\]: starttls: TLSv1 with cipher
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3s?\[[0-9]+\]: imapd:Loading hard-coded DH parameters
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (pop3s?|lmtpunix|imap)\[[0-9]+\]: USAGE [^[:space:]]+ user:
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3s?\[[0-9]+\]: Expunged [0-9]+ messages from user
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (pop3s?|imap)\[[0-9]+\]: .* User logged in SESSIONID=
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sieve\[[0-9]+\]: .* User logged in
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (pop3s?|imap)\[[0-9]+\]: .* starttls:
Wszelkie uwagi proszę kierować do administratora wiki.