ports/162330: logcheck cannot ignore sshd's PAM message.

[Shuichi KITAGUCHI]

>Number:         162330
>Category:       ports
>Synopsis:       logcheck cannot ignore sshd's PAM message.
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    freebsd-ports-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Nov 06 11:10:08 UTC 2011
>Closed-Date:
>Last-Modified:
>Originator:     Shuichi KITAGUCHI
>Release:        8.2-RELEASE-p2
>Organization:
>Environment:
FreeBSD themis.k.ysnb.net 8.2-RELEASE-p2 FreeBSD 8.2-RELEASE-p2 #0: Sat May 28 22:00:54 JST 2011     root at themis.k.ysnb.net:/usr/obj/usr/src/sys/THEMIS  i386

>Description:
by default, logcheck's ignore rule seems to be matched for Linux's log message.
I noticed that some libpam messages are not same between Linux's and FreeBSD's.

from Linux's libpam...
  case PAM_AUTH_ERR:
    return _("Authentication failure");
  case PAM_USER_UNKNOWN:
    return _("User not known to the underlying authentication module");

from FreeBSD's libpam...
  case PAM_AUTH_ERR:
    return ("authentication error");
  case PAM_USER_UNKNOWN:
    return ("unknown user");

>How-To-Repeat:

>Fix:
attached patch fixes this problem, I think.


Patch attached with submission follows:

--- ssh.old	2011-11-06 19:42:42.000000000 +0900
+++ ssh	2011-11-06 19:43:54.000000000 +0900
@@ -21,8 +21,8 @@
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: \(pam_unix\) check pass; user unknown$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: \(pam_unix\) bad username \[[^]]+\]$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: Could not get shadow information for NOUSER$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: PAM: Authentication failure for( illegal user)? [^[:space:]]+ from ([:.[:xdigit:]]+|UNKNOWN|[-_.[:alnum:]]+)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: PAM: User not known to the underlying authentication module for i(llegal|nvalid) user [^[:space:]]+ from ([:.[:xdigit:]]+|UNKNOWN|[-_.[:alnum:]]+)$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: PAM: authentication error for( illegal user)? [^[:space:]]+ from ([:.[:xdigit:]]+|UNKNOWN|[-_.[:alnum:]]+)$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: PAM: unknown user for i(llegal|nvalid) user [^[:space:]]+ from ([:.[:xdigit:]]+|UNKNOWN|[-_.[:alnum:]]+)$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: error: ssh_msg_send: write$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: fatal: Timeout before authentication for [:[:alnum:].]+$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: fatal: Write failed: (Connection (timed out|reset by peer)|Broken pipe)$


>Release-Note:
>Audit-Trail:
>Unformatted: