Updated epylog Debian package (1.0.7)
by Micha vor dem Berge
Hey there,
several moth ago, I posted a bugreport for the debian developers to
build a new debian package of epylog. Yesterday I got a mail that this
bug was closed - there's a new epylog version for debian available now:
http://packages.debian.org/sid/epylog
Thanks for your work, it's fun to see an upgraded version in debian! :)
In the next days I will test this version and will let you know if there
are any issues.
Best regards,
Micha
12 years
[epylog/stable-1.0.x] Only do summary views for failures.
by Konstantin Ryabitsev
commit a33f008fa154ac1fbad057653b452d94f784ca35
Author: Konstantin Ryabitsev <mricon(a)kernel.org>
Date: Thu Apr 19 11:17:20 2012 -0400
Only do summary views for failures.
This fixes the logic -- we were showing summaries for both
failed and successful logins, which isn't what we want.
modules/logins_mod.py | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
---
diff --git a/modules/logins_mod.py b/modules/logins_mod.py
index 2d2b8a8..b46df71 100644
--- a/modules/logins_mod.py
+++ b/modules/logins_mod.py
@@ -639,7 +639,7 @@ class logins_mod(InternalModule):
action += 10
remote = self._mk_userat(byuser, rhost)
- if self.failed_summary_only != '0':
+ if action == self.root_failure and self.failed_summary_only != '0':
restuple = (action, service, 'total failed',
'%s%s' % (system, remote))
else:
@@ -655,7 +655,7 @@ class logins_mod(InternalModule):
tmp = {'system': system, 'rhost': rhost}
system = self.untrusted_host % tmp
- if self.failed_summary_only != '0':
+ if action == self.failure and self.failed_summary_only != '0':
restuple = (action, service, 'total failed', system)
else:
# Sanitize user
12 years
[epylog/stable-1.0.x] Add "failed_summary_only" option.
by Konstantin Ryabitsev
commit e92cade1139f6e74bda15d961ff722cc05115f4b
Author: Konstantin Ryabitsev <mricon(a)kernel.org>
Date: Wed Apr 18 11:07:22 2012 -0400
Add "failed_summary_only" option.
Systems with publicly accessible services that don't use things like
fail2ban or denyhosts tend to have a long list of failed attempts
in each report. This option lists summary of all failed attempts per
service, making the report much more palatable. I leave this option
off by default, following the principle of least change.
Also, sanitize the username before putting it into the report,
as some enteprising souls have apparently tried using "<!--" as the
username.
etc/modules.d/logins.conf.in | 6 ++++++
modules/logins_mod.py | 21 +++++++++++++++++++--
2 files changed, 25 insertions(+), 2 deletions(-)
---
diff --git a/etc/modules.d/logins.conf.in b/etc/modules.d/logins.conf.in
index fa5867d..ad35f48 100644
--- a/etc/modules.d/logins.conf.in
+++ b/etc/modules.d/logins.conf.in
@@ -37,3 +37,9 @@ safe_domains = .*
# If you have too many systems, wide-scale probing may turn ugly. This
# will collapse the reports.
systems_collapse = 10
+##
+# Failed logins reports tend to be long on systems with publicly listening
+# services. If you want to see only a summary of failed logins, then
+# set this option to 1:
+#
+failed_summary_only = 0
diff --git a/modules/logins_mod.py b/modules/logins_mod.py
index 15d4264..2d2b8a8 100644
--- a/modules/logins_mod.py
+++ b/modules/logins_mod.py
@@ -176,6 +176,8 @@ class logins_mod(InternalModule):
logger.put(0, 'Error compiling domain regex: %s' % domain)
logger.put(0, 'Check config for Logins module!')
+ self.failed_summary_only = opts.get('failed_summary_only', '0')
+
self.regex_map = regex_map
self.pam_service_re = rc('(\S+)\(pam_unix\)')
@@ -636,7 +638,12 @@ class logins_mod(InternalModule):
if user == 'root' or user == 'ROOT':
action += 10
remote = self._mk_userat(byuser, rhost)
- restuple = (action, system, service, remote)
+
+ if self.failed_summary_only != '0':
+ restuple = (action, service, 'total failed',
+ '%s%s' % (system, remote))
+ else:
+ restuple = (action, system, service, remote)
else:
if rhost:
match = 0
@@ -647,7 +654,17 @@ class logins_mod(InternalModule):
if not match:
tmp = {'system': system, 'rhost': rhost}
system = self.untrusted_host % tmp
- restuple = (action, user, service, system)
+
+ if self.failed_summary_only != '0':
+ restuple = (action, service, 'total failed', system)
+ else:
+ # Sanitize user
+ user = user.replace('&', '&')
+ user = user.replace('<', '<')
+ user = user.replace('>', '>')
+
+ restuple = (action, user, service, system)
+
return restuple
def _mk_dots(self, str, lim):
12 years
html tag truncating report
by Ian Mortimer
Hi
Got some entries like this in the logs this morning
sshd[12398]: Invalid user <!-- from 180.186.74.94
The result was that everything in the epylog report after the
"User Failures" header was treated as a comment and not displayed.
It's simple enough to post edit the report to replace <!-- with
<!--- but I was wondering if there's a better way of handling
cases like this.
Thanks
--
Ian
12 years