Różnice pomiędzy wersjami 5 i 7 (Spinanie 2 wersji)
⇤ ← Wersja 5 z 2014-12-09 10:23:42 →
Rozmiar: 6016
Edytor: wtps0n
Komentarz: +toc
← Wersja 7 z 2015-06-10 19:41:29 → ⇥
Rozmiar: 6167
Edytor: wtps0n
Komentarz: aktualizacja patchy; poprawka parserów dla patchy
Usunięcia zostały oznaczone w ten sposób. Dodatki zostały oznaczone w ten sposób.
Linia 29: Linia 29:
{{{#!bsdmake numbers=off {{{#!diff numbers=off
Linia 39: Linia 39:
{{{#!bsdmake numbers=off {{{#!diff numbers=off
Linia 66: Linia 66:
{{{#!bsdmake numbers=off
--- /usr/local/sbin/logcheck.orig 2014-12-08 12:24:33.282207000 +0100
+++ /usr/local/sbin/logcheck 2014-12-09 11:21:14.922515719 +0100		 {{{#!diff numbers=off
--- /usr/local/sbin/logcheck 2015-06-02 21:58:07.000000000 +0200
+++ /usr/local/sbin/logcheck.new 2015-06-10 21:37:54.000798776 +0200
Linia 74: Linia 74:
+ /usr/local/sbin/egrep --text -v '^[[:space:]]*$|^#' "$dir/$rulefile" | cat \ + /usr/local/bin/egrep --text -v '^[[:space:]]*$|^#' "$dir/$rulefile" | cat \
Linia 83: Linia 83:
+ /usr/local/sbin/egrep -v "^Summarizing " | cat >> "$TMPDIR/report" \ + /usr/local/bin/egrep -v "^Summarizing " | cat >> "$TMPDIR/report" \
Linia 92: Linia 92:
+ /usr/local/sbin/egrep --text -f "$raise/$grepfile" "$TMPDIR/logoutput-sorted" | cat \ + /usr/local/bin/egrep --text -f "$raise/$grepfile" "$TMPDIR/logoutput-sorted" | cat \
Linia 96: Linia 96:
@@ -386,7 +386,7 @@ @@ -380,13 +380,13 @@
     return $RETURN
 }

-# Process a logfile snippet with egrep.
+# Process a logfile snippet with /usr/local/bin/egrep.
 cleanchecked() {
     clean="$1"
Linia 101: Linia 108:
+ /usr/local/sbin/egrep --text -v -f "$clean" "$TMPDIR/checked" | cat >> "$TMPDIR/checked.1" \ + /usr/local/bin/egrep --text -v -f "$clean" "$TMPDIR/checked" | cat >> "$TMPDIR/checked.1" \
Linia 110: Linia 117:
+ /usr/local/sbin/egrep --text -v -f "$clean/$file" "$TMPDIR/checked" | cat \ + /usr/local/bin/egrep --text -v -f "$clean/$file" "$TMPDIR/checked" | cat \
Linia 119: Linia 126:
+ for file in $(/usr/local/sbin/egrep --text -v "(^#|^[[:space:]]*$)" "$LOGFILES_LIST"); do + for file in $(/usr/local/bin/egrep --text -v "(^#|^[[:space:]]*$)" "$LOGFILES_LIST"); do
Linia 123: Linia 130:

Spis Treści

  1. Konfiguracja logcheck
    1. Uprawnienia do plików
    2. Patchowanie wybranych plików
      1. violations.d
      2. ignore.d.server
    3. gnugrep


Konfiguracja logcheck

Uprawnienia do plików

Po zainstalowaniu logcheck (od wersji logcheck-1.2.69_1) trzeba nieco "poprawić" uprawnienia w systemie plików, aby logcheck działał poprawnie: 

# dla partycji UFS
#
setfacl -m u:logcheck:rwx /var/log
setfacl -m g:logcheck:r /var/log/security /var/log/auth.log

# dla partycji ZFS
#
setfacl -m u:logcheck:rwx::allow /var/log
setfacl -m g:logcheck:r::allow /var/log/security /var/log/auth.log

chgrp -R logcheck /var/log/sudo/
chown -R logcheck /usr/local/share/logcheck/detectrotate/

Patchowanie wybranych plików

violations.d

--- kernel.orig 2014-12-08 12:24:33.312207000 +0100
+++ kernel      2014-12-09 11:12:54.385550315 +0100
@@ -1,2 +1,2 @@
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? [[:alnum:]]+: media error \(bad sector\): status=0x[[:xdigit:]]+ { DriveReady SeekComplete Error }$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? [[:alnum:]]+: media error \(bad sector\): status=0x[[:xdigit:]]+ \{ DriveReady SeekComplete Error \}$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel:( \[ *[[:digit:]]+\.[[:digit:]]+\])? end_request: I/O error, dev [[:alnum:]]+, sector [[:digit:]]+

ignore.d.server

--- cyrus.orig  2014-03-18 00:18:27.000000000 +0100
+++ cyrus       2014-07-30 00:47:50.000000000 +0200
@@ -4,3 +4,12 @@
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/lmtpd\[[0-9]+\]: DBERROR db3: [12] lockers$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/notifyd\[[0-9]+\]: MAIL, , [^[:space:]]+, [^[:space:]]+,  \"[ [:alnum:][:punct:]]+\"$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cyrus/squatter\[[0-9]+\]: (skipping|indexing) mailbox [[:alpha:]^\.]+\.\.\.$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ctl_cyrusdb\[[0-9]+\]: (done )?checkpointing cyrus databases
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3s?\[[0-9]+\]: counts: retr
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3s?\[[0-9]+\]: starttls: TLSv1 with cipher
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3s?\[[0-9]+\]: imapd:Loading hard-coded DH parameters
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (pop3s?|lmtpunix|imap)\[[0-9]+\]: USAGE [^[:space:]]+ user:
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pop3s?\[[0-9]+\]: Expunged [0-9]+ messages from user
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (pop3s?|imap)\[[0-9]+\]: .* User logged in SESSIONID=
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sieve\[[0-9]+\]: .* User logged in
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ (pop3s?|imap)\[[0-9]+\]: .* starttls:

gnugrep

Dla systemów FreeBSD, w których jest bsdgrep (jako domyślny w base system), to konieczność jest modyfikacji logcheck aby korzystał z gnugrep (są jakieś drobne różnice): 

portupgrade -N gnugrep

Oraz zapatchowanie samej binarki: 

--- /usr/local/sbin/logcheck    2015-06-02 21:58:07.000000000 +0200
+++ /usr/local/sbin/logcheck.new        2015-06-10 21:37:54.000798776 +0200
@@ -204,7 +204,7 @@
                debug "cleanrules: ${dir}/${rulefile}"
                if [ -r "${dir}/${rulefile}" ]; then
                        # pipe to cat on greps to get usable exit status
-                       egrep --text -v '^[[:space:]]*$|^#' "$dir/$rulefile" | cat \
+                       /usr/local/bin/egrep --text -v '^[[:space:]]*$|^#' "$dir/$rulefile" | cat \
                                >> "$cleaned/$rulefile" \
                        || error "Couldn't append to $cleaned/$rulefile."
                else
@@ -227,7 +227,7 @@
        if [ "$SYSLOGSUMMARY" -eq 1 ] && [ -x "$SYSLOG_SUMMARY" ]; then
            debug "report: running syslog-summary - $*"
            $SYSLOG_SUMMARY "$TMPDIR/checked" | \
-               egrep -v "^Summarizing " | cat >> "$TMPDIR/report" \
+               /usr/local/bin/egrep -v "^Summarizing " | cat >> "$TMPDIR/report" \
                    || error "Could not append to report."
        else
            if [ "$SYSLOGSUMMARY" -eq 1 ] && [ ! -x "$SYSLOG_SUMMARY" ]; then
@@ -309,7 +309,7 @@
        debug "greplogoutput: $grepfile"

        # Raise entries that match
-       egrep --text -f "$raise/$grepfile" "$TMPDIR/logoutput-sorted" | cat \
+       /usr/local/bin/egrep --text -f "$raise/$grepfile" "$TMPDIR/logoutput-sorted" | cat \
            > "$TMPDIR/checked" \
            || error "Could not output to $TMPDIR/checked."

@@ -380,13 +380,13 @@
     return $RETURN
 }

-# Process a logfile snippet with egrep.
+# Process a logfile snippet with /usr/local/bin/egrep.
 cleanchecked() {
     clean="$1"

     if [ -f "$clean" ]; then
        debug "cleanchecked - file: $clean"
-        egrep --text -v -f "$clean" "$TMPDIR/checked" | cat >> "$TMPDIR/checked.1"  \
+        /usr/local/bin/egrep --text -v -f "$clean" "$TMPDIR/checked" | cat >> "$TMPDIR/checked.1"  \
            || error "Could not output to $TMPDIR/checked.1."
        mv "$TMPDIR/checked.1" "$TMPDIR/checked" \
            || error "Could not move $TMPDIR/checked.1 to $TMPDIR/checked"
@@ -394,7 +394,7 @@
        debug "cleanchecked - dir - $clean"
        for file in $(ls -1 "$clean/"); do
        debug "cleanchecked - dir - $clean/$file"
-           egrep --text -v -f "$clean/$file" "$TMPDIR/checked" | cat \
+           /usr/local/bin/egrep --text -v -f "$clean/$file" "$TMPDIR/checked" | cat \
                >> "$TMPDIR/checked.1" \
                    || error "Could not output to TMPDIR/checked.1."
            mv "$TMPDIR/checked.1" "$TMPDIR/checked" \
@@ -641,7 +641,7 @@
     || error "Could not mkdir for log files"
 if [ ! "$LOGFILE" ] && [ -r "$LOGFILES_LIST" ]; then
     SAVEIFS=$IFS; IFS=$(echo -en "\n\b");
-    for file in $(egrep --text -v "(^#|^[[:space:]]*$)" "$LOGFILES_LIST"); do
+    for file in $(/usr/local/bin/egrep --text -v "(^#|^[[:space:]]*$)" "$LOGFILES_LIST"); do
        logoutput "$file"
     done
     IFS=$SAVEIFS

{i} Wszelkie uwagi proszę kierować do administratora wiki.

LogCheck (ostatnio edytowane 2018-02-15 00:46:52 przez wtps0n)