Tue Apr 4 07:43:35 UTC 2006

Author: varekova

Update of /cvs/dist/rpms/logwatch/FC-5
In directory cvs.devel.redhat.com:/tmp/cvs-serv14598

Modified Files:
	.cvsignore logwatch.spec sources 
Added Files:
	logwatch-7.2.1-audit.patch logwatch-7.2.1-http.patch 
	logwatch-7.2.1-mountd.patch logwatch-7.2.1-named.patch 
	logwatch-7.2.1-nosegfault.patch logwatch-7.2.1-pam_unix.patch 
	logwatch-7.2.1-secure.patch logwatch-7.2.1-smart.patch 
	logwatch-7.2.1-sshd.patch 
Removed Files:
	logwatch-7.1-audit.patch logwatch-7.1-http.patch 
	logwatch-7.1-http2.patch logwatch-7.1-iptables.patch 
	logwatch-7.1-named.patch logwatch-7.1-pam_unix.patch 
	logwatch-7.1-samba.patch logwatch-7.1-secure.patch 
	logwatch-7.1-sshd.patch 
Log Message:
- update to 7.2.1
- add new service patches


logwatch-7.2.1-audit.patch:
 audit |    3 ++-
 1 files changed, 2 insertions(+), 1 deletion(-)

--- NEW FILE logwatch-7.2.1-audit.patch ---
--- logwatch-7.2.1/scripts/services/audit.pom	2005-12-06 03:36:35.000000000 +0100
+++ logwatch-7.2.1/scripts/services/audit	2006-03-16 13:48:35.655605784 +0100
@@ -63,7 +63,8 @@
 	( $ThisLine =~ /audit_backlog_limit=[0-9]* old=[0-9]*(?: by auid=[0-9]*)?/) or
 	( $ThisLine =~ /SELinux:  unrecognized netlink message type=[0-9]+ for sclass=[0-9]+/) or
 	( $ThisLine =~ /audit\([0-9.]+:[0-9]+\): saddr=[0-9]+/) or
-	( $ThisLine =~ /nargs=[0-9]+ a0=[0-9a-f]+ a1=[0-9a-f]+ a2=[0-9a-f]+ a3=[0-9a-f]+ a4=[0-9a-f]+ a5=[0-9a-f]+/)
+	( $ThisLine =~ /nargs=[0-9]+ a0=[0-9a-f]+ a1=[0-9a-f]+ a2=[0-9a-f]+ a3=[0-9a-f]+ a4=[0-9a-f]+ a5=[0-9a-f]+/) or
+	( $ThisLine =~ /^audit\([0-9.]+:[0-9]+\): ( ?(path|cwd|item|name|flags)=["\/A-Za-z0-9]*)*$/) 
     ) { 
 	# Ignore these entries
     } elsif ( $ThisLine =~ /audit\([0-9]{10}.[0-9]{3}:[0-9]\): initialized$/) {

logwatch-7.2.1-http.patch:
 http |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)

--- NEW FILE logwatch-7.2.1-http.patch ---
--- logwatch-7.2.1/scripts/services/http.pom	2006-01-04 22:26:08.000000000 +0100
+++ logwatch-7.2.1/scripts/services/http	2006-03-15 13:27:31.935011448 +0100
@@ -266,7 +266,7 @@
 #   what to look for as an attack  USE LOWER CASE!!!!!!
 #
 my @exploits = (
-   'null',
+   '^null$',
    '/\.\./\.\./\.\./',
    '\.\./\.\./config\.sys',
    '/\.\./\.\./\.\./autoexec\.bat',

logwatch-7.2.1-mountd.patch:
 mountd |   10 ++++++++++
 1 files changed, 10 insertions(+)

--- NEW FILE logwatch-7.2.1-mountd.patch ---
--- logwatch-7.2.1/scripts/services/mountd.pom	2005-02-24 18:08:04.000000000 +0100
+++ logwatch-7.2.1/scripts/services/mountd	2006-03-16 13:54:42.943769496 +0100
@@ -47,6 +47,9 @@
       $Mount = "      " . $Mount;
       $Mounted{$Name}{$Mount}++;
    }
+   elsif ( ($Number) = ($ThisLine =~ /Caught signal ([0-9]*), un-registering and exiting/) ) {
+      $SignalExit{$Number}++;
+   }
    else {
       # Report any unmatched entries...
       push @OtherList,$ThisLine;
@@ -70,6 +73,13 @@
    }
 }
 
+if (keys %SignalExit) {
+   printf "\nExit after catching signal:\n";
+   foreach $Number (keys %SignalExit) {
+      print "   Signal " . $Number. ": " . $SignalExit{$Number} . " Time(s)\n"; 
+   }
+}
+
 if (($Detail >= 5) and (keys %Mounted)) {
    print "\nSuccessful NFS mounts:\n";
    foreach $ThisOne (keys %Mounted) {

logwatch-7.2.1-named.patch:
 named |    3 ++-
 1 files changed, 2 insertions(+), 1 deletion(-)

--- NEW FILE logwatch-7.2.1-named.patch ---
--- logwatch-7.2.1/scripts/services/named.pom	2005-11-30 06:01:44.000000000 +0100
+++ logwatch-7.2.1/scripts/services/named	2006-03-16 13:51:39.351679736 +0100
@@ -130,7 +130,8 @@
       ($ThisLine =~ /sending notifies/) or
       # file syntax error get reported twice and are already caught below
       ($ThisLine =~ /loading master file/) or
-      ($ThisLine =~ /^ succeeded$/)
+      ($ThisLine =~ /^ succeeded$/) or
+      ($ThisLine =~ /\*\*\* POKED TIMER \*\*\*/)
    ) {
       # Don't care about these...
    } elsif (

logwatch-7.2.1-nosegfault.patch:
 kernel.conf |    3 +++
 1 files changed, 3 insertions(+)

--- NEW FILE logwatch-7.2.1-nosegfault.patch ---
--- logwatch-7.2.1/conf/services/kernel.conf.pom	2006-01-04 22:06:53.000000000 +0100
+++ logwatch-7.2.1/conf/services/kernel.conf	2006-03-14 14:01:29.290219488 +0100
@@ -20,6 +20,9 @@
 # Only give lines pertaining to the kernel service...
 *OnlyService = (kernel|SUNW,[-\w]+?)
 *RemoveHeaders
+*Remove = segfault
+*Remove = locate module
+
 
 ########################################################
 # This was written and is maintained by:

logwatch-7.2.1-pam_unix.patch:
 pam_unix |    7 +++++--
 secure   |    1 +
 sshd     |    1 +
 3 files changed, 7 insertions(+), 2 deletions(-)

--- NEW FILE logwatch-7.2.1-pam_unix.patch ---
--- logwatch-7.2.1/scripts/services/sshd.pom	2005-12-01 05:13:47.000000000 +0100
+++ logwatch-7.2.1/scripts/services/sshd	2006-03-16 13:42:52.220815808 +0100
@@ -191,6 +191,7 @@
        ($ThisLine =~ m/^pam_ldap: error trying to bind as user "[^"]+" \(Invalid credentials\)/) or
        ($ThisLine =~ m/^pam_ldap: ldap_starttls_s: Can't contact LDAP server/) or
        ($ThisLine =~ m/^\(pam_unix\) .*/) or
+       ($ThisLine =~ m/^pam_unix\(.*:.*\)/) or
        # We won't count the following two because they're always followed by a
        # failed login entry...
        ($ThisLine =~ /^input_userauth_request: (illegal|invalid) user (.*)$/ ) or
--- logwatch-7.2.1/scripts/services/pam_unix.pom	2005-12-01 05:15:04.000000000 +0100
+++ logwatch-7.2.1/scripts/services/pam_unix	2006-03-16 13:42:52.221815656 +0100
@@ -99,12 +99,15 @@
    } elsif ( $line =~ s/^... .. ..:..:.. .+ [^\s:\[\]]+: [0-9:\[\]\.]+ \(pam_unix\) //) {
       $service =~ s/^... .. ..:..:.. .+ ([^\s:\[\]]+): [0-9:\[\]\.]+ \(pam_unix\) .*$/$1/;
    #for debian woody
-   } elsif ( ( $line =~ s/^... .. ..:..:.. .+ PAM_unix\[\d+\]: \((.*?)\) // )) {
+   } elsif ( $line =~ s/^... .. ..:..:.. .+ PAM_unix\[\d+\]: \((.*?)\) // ) {
       $service =~ s/^... .. ..:..:.. .+ PAM_unix\[\d+\]: \(([^ ]*)\) .*/$1/;
+   } elsif ( $line =~ s/^... .. ..:..:.. .+ pam_unix(.+:.+): //  ) {
+      $service =~ s/^... .. ..:..:.. .+ pam_unix\((.+):.+\): .*$/$1/;
+   #new version 
 	} else {
 		next;
 	}
-   #lowercase the service
+   #lowercase the service 
    $service = lc($service); 
 	if (($service eq 'sshd') or ($service eq 'login') or ($service eq 'ftp') or ($service eq 'rsh')) {
 		if ($line =~ s/^session opened for user (.+) by \(uid=\d+\)/$1/) {
--- logwatch-7.2.1/scripts/services/secure.pom	2005-12-06 03:37:34.000000000 +0100
+++ logwatch-7.2.1/scripts/services/secure	2006-03-16 13:42:52.222815504 +0100
@@ -114,6 +114,7 @@
       ( $ThisLine =~ /pam_succeed_if: requirement "uid < 100" (was|not) met by user /) or
       ( $ThisLine =~ /pam_rhosts_auth\[\d+\]: allowed to [^ ]+ as \w+/) or
       ( $ThisLine =~ /^(.*)\(pam_unix\)/) or
+      ( $ThisLine =~ /pam_unix\(.*:.*\)/) or
       ( $ThisLine =~ m/^[^ ]+\[\d+\]: connect from localhost$/ ) or
       ( $ThisLine =~ /^\/usr\/bin\/sudo:/) or
       ( $ThisLine =~ /^halt:/) or

logwatch-7.2.1-secure.patch:
 secure |   15 ++++++++++++++-
 1 files changed, 14 insertions(+), 1 deletion(-)

--- NEW FILE logwatch-7.2.1-secure.patch ---
--- logwatch-7.2.1/scripts/services/secure.pom	2006-03-16 13:40:03.105525240 +0100
+++ logwatch-7.2.1/scripts/services/secure	2006-03-16 13:39:03.000000000 +0100
@@ -133,7 +133,9 @@
       ( $ThisLine =~ /^ipop3d\[\d+\]:/) or
       ( $ThisLine =~ /pam_timestamp: updated timestamp file/) or
       ( $ThisLine =~ /pam_timestamp: timestamp file `([^ ]+)' is only \d+ seconds old, allowing access to ([^ ]+) for user ([^ ]+)/) or
-      ( $ThisLine =~ /pam_timestamp: timestamp file `([^ ]+)' has unacceptable age \(\d+ seconds\), disallowing access to ([^ ]+) for user ([^ ]+)/) 
+      ( $ThisLine =~ /pam_timestamp: timestamp file `([^ ]+)' has unacceptable age \(\d+ seconds\), disallowing access to ([^ ]+) for user ([^ ]+)/) or
+      ( $ThisLine =~ /userhelper\[\d+\]: running '([^ ]+)' with [^ ]+ context/) or
+      ( $ThisLine =~ /pam_timestamp\(.*:session\): updated timestamp file `\/var\/run\/sudo.*'/)   
    ) {
       # Ignore these entries
    } elsif ($ThisLine =~ /^spop3d/ || $ThisLine =~ /^pop\(\w+\)\[\d+\]:/) {
@@ -319,6 +321,8 @@
       $PwdChange{"$User"}++;
    } elsif ( ($User) = ($ThisLine =~ /^cvs: password mismatch for ([^']+): ([^']+) vs. ([^']+)/) ){
       $cvs_passwd_mismatch{$User}++;       
+   } elsif ( ($User,$From,$To) = ($ThisLine =~ /usermod\[[0-9]*\]: change user `([^ ]*)' shell from `([^ ]*)' to `([^ ]*)'/) ) {
+      $ChangedShell{"$User,$From,$To"}++;
    } else {
       # Unmatched entries...
       push @OtherList, "$ThisLine\n";
@@ -592,6 +596,15 @@
    }
 }
 
+if (keys %ChangedShell) {
+   print "\nChanged users default login shell: \n";
+   foreach (keys %ChangedShell) {
+     ($User,$From,$To) = split ",";
+     print "   User " . $User . " change shell from " . $From . " to " . $To . ": " . $ChangedShell{"$User,$From,$To"} . " Time(s)\n";
+   }
+
+}
+
 if (keys %cvs_passwd_mismatch) {
    print "\n cvs:";
    print "\n   Authentication Failures:\n";

logwatch-7.2.1-smart.patch:
 smartd |   29 ++++++++++++++++++++++++++++-
 1 files changed, 28 insertions(+), 1 deletion(-)

--- NEW FILE logwatch-7.2.1-smart.patch ---
--- logwatch-7.2.1/scripts/services/smartd.pom	2005-12-02 17:41:12.000000000 +0100
+++ logwatch-7.2.1/scripts/services/smartd	2006-03-16 14:37:37.034448232 +0100
@@ -13,7 +13,10 @@
 my %Offsectors = ();
 my %NumOffsectors = ();
 my %Warnings = ();
+my %UnableToReg = ();
 my @OtherList = ();
+my $ShutdownFailed = 0;
+my $StartupFailed = 0;
 
 my $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;
 my $IgnoreUnmatched = $ENV{'smartd_ignore_unmatched'} || 0;
@@ -60,7 +63,10 @@
           || ($ThisLine =~ /smartd received signal 15: Terminated/)
           || ($ThisLine =~ /smartd is exiting \(exit status 0\)/)
           || ($ThisLine =~ /smartd has fork/)
-          || ($ThisLine =~ /smartd startup succeeded/)  ) {
+	  || ($ThisLine =~ /smartd startup succeeded/)
+	  || ($ThisLine =~ /Unable to register device (.*) \(no Directive -d removable\). Exiting/)
+	  || ($ThisLine =~ /Device (.*), SATA disks accessed via libata are not currently supported by smartmontools./) )
+   {
        # ignore
 
 #   } elsif ( ($Device,$Msg) = ($ThisLine =~ /^Device: ([^,]+), (.*)$/)) {
@@ -80,6 +86,12 @@
       $NumOffsectors{$Device} = $Num;
    } elsif ( ( $ThisLine =~ /warning/i ) ) {
       $Warnings{$ThisLine}++;
+   } elsif ( ($ThisLine =~ /smartd startup failed/ ) ) {
+      $StartupFailed++;
+   } elsif ( ($ThisLine =~ /smartd shutdown failed/ ) ) {
+      $ShutdownFailed++;
+   } elsif ( my ($Device) = ($ThisLine =~ /Unable to register SCSI device (.*) at line 1 of file \/etc\/smartd.conf/) ) {
+      $UnableToReg{$Device}++  
    } else {
       # Report any unmatched entries...
       push @OtherList,"$ThisLine\n";
@@ -156,6 +168,21 @@
    }
 }
 
+if ($StartupFailed) {
+   print "\n Smartd startup failed: " . $StartupFailed . " Time(s)\n";
+}
+
+if ($ShutdownFailed) {
+   print "\n Smartd shutdown failed: " . $ShutdownFailed . " Time(s)\n";
+}
+
+if ( (keys %UnableToReg) ) {
+   print "\n Wrong configuration for devices:\n";
+   foreach my $Device (sort keys %UnableToReg) {
+      print "   " . $Device .": ". $UnableToReg{$Device} . " Time(s)\n";
+   }
+}
+
 if (($#OtherList >= 0) and (not $IgnoreUnmatched)){
    print "\n**Unmatched Entries**\n";
    print @OtherList;

logwatch-7.2.1-sshd.patch:
 sshd |   39 ++++++++++++++++++++++++++++++++++++++-
 1 files changed, 38 insertions(+), 1 deletion(-)

--- NEW FILE logwatch-7.2.1-sshd.patch ---
--- logwatch-7.2.1/scripts/services/sshd.pom	2006-03-16 14:17:12.221648080 +0100
+++ logwatch-7.2.1/scripts/services/sshd	2006-03-16 14:20:13.607073304 +0100
@@ -140,6 +140,9 @@
 my %NoShellUsers = ();
 my %DeprecatedOption = ();
 my %MisMatch = ();
+my %KrbAutFail = ();
+my %KrbAutErr = ();
+my %KrbErr = ();
 my @BadRSA = ();
 my @Scanned = ();
 my %OtherList = ();
@@ -195,7 +198,8 @@
        # We won't count the following two because they're always followed by a
        # failed login entry...
        ($ThisLine =~ /^input_userauth_request: (illegal|invalid) user (.*)$/ ) or
-       ($ThisLine =~ m/^(Illegal|Invalid) user (.*) from ([^ ]+)/ )
+       ($ThisLine =~ m/^(Illegal|Invalid) user (.*) from ([^ ]+)/ ) or
+       ($ThisLine =~ /pam_krb5: authentication succeeds for `([^ ]*)'/)
    ) {
       # Ignore these
    } elsif ( my ($Method,$User,$Host,$Port) = ($ThisLine =~ /^Accepted (\S+) for (\S+) from ([\d\.:a-f]+) port (\d+)/) ) {
@@ -311,6 +315,16 @@
       push @Scanned, $IP;
    } elsif ( my ($Line,$Option) = ($ThisLine =~ /^rexec line (\d+): Deprecated option (.*)$/)) {
       $DeprecatedOption{"$Option - line $Line"}++;
+   } elsif ( my ($Pom1,$Pom2,$User) = ($ThisLine =~ /pam_krb5(\[\d*\])?: authentication fails for (`|')([^ ]*)'/)) {
+      $KrbAutFail{$User}++;	 
+   } elsif ( my ($Error) = ($ThisLine =~ /pam_krb5: authenticate error: (.*)$/)) {
+      $KrbAutErr{$Error}++;
+   } elsif ( ($ThisLine =~ /pam_krb5: unable to determine uid\/gid for user$/)) {
+      $KrbAutErr{"unable to determine uid/gid for user"}++;
+   } elsif ( my ($Error) = ($ThisLine =~ /pam_krb5: error removing file (.*)$/)) {
+      $KrbErr{"error removing file " . $Error}++;     
+   } elsif ( my ($Pom,$Error) = ($ThisLine =~ /pam_krb5(\[\d*\]): error resolving user name '[^ ]*' to uid\/gid pai/)) {
+      $KrbErr{"error resolving user name '$Error' to uid\/gid pai"}++;
    } else {
       # Report any unmatched entries...
       unless ($ThisLine =~ /fwd X11 connect/) {
@@ -499,6 +513,29 @@
    }
 }
 
+if (keys %KrbAutFail) {
+   print "\n\Failed pam_krb5 authentication:\n";
+   foreach my $User (sort keys %KrbAutFail) {
+      print "   $User: " .  $KrbAutFail{$User} . " Time(s)\n";
+   }
+}
+	       
+if (keys %KrbAutErr) {
+   print "\n\pam_krb5 authentication errors:\n";
+   foreach my $Error (sort keys %KrbAutErr) {
+      print "   $Error: " .  $KrbAutErr{$Error} . " Time(s)\n";
+   }
+}
+	       
+
+if (keys %KrbErr) {
+   print "\n pam_krb5 errors:\n";
+   foreach my $Error (sort keys %KrbErr) {
+      print "   $Error: " . $KrbErr{$Error} . " Time(s)\n";
+   }
+}
+
+
 if (keys %DisconnectReceived) {
    print "\n\nReceived disconnect:\n";
    foreach my $Reason (sort {$a cmp $b} keys %DisconnectReceived) {


Index: .cvsignore
===================================================================
RCS file: /cvs/dist/rpms/logwatch/FC-5/.cvsignore,v
retrieving revision 1.12
retrieving revision 1.13
diff -u -r1.12 -r1.13
--- .cvsignore	23 Nov 2005 14:30:46 -0000	1.12
+++ .cvsignore	4 Apr 2006 07:43:32 -0000	1.13
@@ -1 +1 @@
-logwatch-7.1.tar.gz
+logwatch-7.2.1.tar.gz


Index: logwatch.spec
===================================================================
RCS file: /cvs/dist/rpms/logwatch/FC-5/logwatch.spec,v
retrieving revision 1.35
retrieving revision 1.36
diff -u -r1.35 -r1.36
--- logwatch.spec	20 Feb 2006 08:42:37 -0000	1.35
+++ logwatch.spec	4 Apr 2006 07:43:33 -0000	1.36
@@ -1,21 +1,21 @@
 Summary: A log file analysis program.
 Name: logwatch
-Version: 7.1
-Release: 8
+Version: 7.2.1
+Release: 1.fc5
 License: MIT
 Group: Applications/System
 URL: http://www.logwatch.org/
 Source: ftp://ftp.kaybee.org/pub/linux/logwatch-%{version}.tar.gz
-Patch2: logwatch-7.0-nosegfault.patch
-Patch3: logwatch-7.1-sshd.patch
-Patch4: logwatch-7.1-samba.patch
-Patch5: logwatch-7.1-named.patch
-Patch6: logwatch-7.1-secure.patch
-Patch7: logwatch-7.1-iptables.patch
-Patch8: logwatch-7.1-audit.patch
-Patch9: logwatch-7.1-http.patch
-Patch10: logwatch-7.1-pam_unix.patch
-Patch11: logwatch-7.1-http2.patch
+Patch2: logwatch-7.2.1-nosegfault.patch
+Patch3: logwatch-7.2.1-pam_unix.patch
+Patch4: logwatch-7.2.1-http.patch
+Patch5: logwatch-7.2.1-sshd.patch
+Patch6: logwatch-7.2.1-smart.patch
+Patch7: logwatch-7.2.1-named.patch
+Patch8: logwatch-7.2.1-audit.patch
+Patch9: logwatch-7.2.1-secure.patch
+Patch10: logwatch-7.2.1-mountd.patch
+
 
 Requires: textutils sh-utils grep mailx
 BuildRoot: %{_tmppath}/logwatch-build
@@ -38,7 +38,6 @@
 %patch8 -p1
 %patch9 -p1
 %patch10 -p1 
-%patch11 -p1
 
 %install
 
@@ -140,6 +139,10 @@
 %doc License project/CHANGES project/TODO
 
 %changelog
+* Tue Apr  4 2006 Ivana Varekova <varekova at redhat.com> 7.2.1-1.fc5
+- update to 7.2.1
+- add new service patches
+
 * Mon Feb 20 2006 Ivana Varekova <varekova at redhat.com> 7.1-8
 - fix http exploit problem #181802
 


Index: sources
===================================================================
RCS file: /cvs/dist/rpms/logwatch/FC-5/sources,v
retrieving revision 1.12
retrieving revision 1.13
diff -u -r1.12 -r1.13
--- sources	23 Nov 2005 14:30:46 -0000	1.12
+++ sources	4 Apr 2006 07:43:33 -0000	1.13
@@ -1 +1 @@
-6abe774abb10f45472c387f5e646a251  logwatch-7.1.tar.gz
+a3b6f24d8976bbcf9e6e956891560635  logwatch-7.2.1.tar.gz


--- logwatch-7.1-audit.patch DELETED ---


--- logwatch-7.1-http.patch DELETED ---


--- logwatch-7.1-http2.patch DELETED ---


--- logwatch-7.1-iptables.patch DELETED ---


--- logwatch-7.1-named.patch DELETED ---


--- logwatch-7.1-pam_unix.patch DELETED ---


--- logwatch-7.1-samba.patch DELETED ---


--- logwatch-7.1-secure.patch DELETED ---


--- logwatch-7.1-sshd.patch DELETED ---


