RootForum Community

Code: Select all

#/bin/sh
find . -name "messages" -exec grep "Failed password for" '{}' ; -print > 1
find . -name "messages" -exec grep "Illegal user" '{}' ; -print >> 1 
diff 1 2 > fan
find . -name "fan" -size 0 -exec rm {} ;
MS=`cat fan`
if ls fan > /dev/null 2>&1; then
    echo "$MS" | mail -s "Da hat einer sein PW Vergessen" MAIL@Provider.tld 
fi
rm 2
cp 1 2
rm fan

Code: Select all

dominik@cheffe:~/own-files/debhowto/html/nglayout$ apt-cache show logcheck
Package: logcheck
Priority: optional
Section: admin
Installed-Size: 168
Maintainer: Steve Kemp <skx@debian.org>
Architecture: all
Version: 1.2.14
Depends: exim | mail-transport-agent, cron (>=3.0pl1-68), sysklogd | system-log-daemon, mailx, logtail (= 1.2.14), logcheck-database (= 1.2.14), debianutils (>= 1.16.9), lockfile-progs, debconf (>= 0.5)
Pre-Depends: logtail (>= 1.1.9.1)
Filename: pool/main/l/logcheck/logcheck_1.2.14_all.deb
Size: 29476
MD5sum: 3a62b31c6808c72ab1ac5d2a47d2c263
Description: Mails anomalies in the system logfiles to the administrator
 Logcheck was part of the Abacus Project of security tools, but this
 version has been rewritten.
 .
 Logcheck helps spot problems and security violations in your logfiles
 automatically and will send the results to you in e-mail.

Package: logcheck
Priority: optional
Section: admin
Installed-Size: 176
Maintainer: Rene Mayrhofer <rmayr@debian.org>
Architecture: all
Version: 1.1.1-13.1
Depends: debconf, exim | mail-transport-agent, cron (>=3.0pl1-68), sysklogd | system-log-daemon, mailx, logtail, logcheck-database
Filename: pool/main/l/logcheck/logcheck_1.1.1-13.1_all.deb
Size: 24846
MD5sum: 440ddaaee521b8527d0f50d7b4819292
Description: Mails anomalies in the system logfiles to the administrator
 Logcheck is part of the Abacus Project of security tools. It is a program
 created to help in the processing of UNIX system logfiles generated by the
 various Abacus Project tools, system daemons, Wietse Venema's TCP Wrapper
 and Log Daemon packages, and the Firewall Toolkit© by Trusted Information
 Systems Inc.(TIS).
 .
 Logcheck helps spot problems and security violations in your logfiles
 automatically and will send the results to you in e-mail. This program is
 free to use at any site. Please read the disclaimer before you use any of
 this software.

Code: Select all

trinity:/etc/logcheck# ls -l
total 17
drwx------    2 root     root         1024 Feb 21  2002 cracking.d
lrwxrwxrwx    1 root     root           15 Jun  3 09:02 ignore.d -> ignore.d.server
drwx------    2 root     root         1024 Jun 16 02:57 ignore.d.paranoid
drwx------    2 root     root         1024 Jul 17 21:40 ignore.d.server
drwx------    2 root     root         1024 Jul 17 21:40 ignore.d.workstation
-rw-r--r--    1 root     root           46 Jun  3 09:02 logcheck.conf
-rw-------    1 root     root         1037 Feb 21  2002 logcheck.cracking
lrwxrwxrwx    1 root     root           22 Jun  3 09:02 logcheck.ignore -> logcheck.ignore.server
-rw-------    1 root     root          596 Feb 21  2002 logcheck.ignore.paranoid
-rw-------    1 root     root         1357 Feb 21  2002 logcheck.ignore.server
-rw-------    1 root     root         1417 Feb 21  2002 logcheck.ignore.workstation
-rw-r--r--    1 root     root          274 Jun  3 09:02 logcheck.logfiles
-rw-------    1 root     root          505 Feb 21  2002 logcheck.violations
-rw-------    1 root     root           14 Feb 21  2002 logcheck.violations.ignore
drwx------    2 root     root         1024 Feb 21  2002 violations.d
drwx------    2 root     root         1024 Feb 21  2002 violations.ignore.d

Code: Select all

trinity:~# cat /etc/logcheck/ignore.d/local
# /etc/logcheck/ignored.d/local
#
# Add everything in the logfiles which should be ignored
# and NOT be mailed to root.
#
sshd.*: Accepted publickey for .* from .*
sshd.*: Did not receive identification string from .*

PAM-Wheel.*: Access granted to 'dominik' for 'root'
PAM_unix.*: (su) session opened for user www-user by dominik(uid=1000)

su.*: + pts/.* dominik-root
su.*: + pts/.* dominik-www-user

imapd-ssl: Connection, ip=[.*]
imapd-ssl: LOGIN, user=.*, ip=[.*]
imapd-ssl: LOGOUT, user=.*, ip=[.*], headers=.*, body=.*

Code: Select all

sshd[23736]: PAM pam_putenv: delete non-existent entry; MAIL

Code: Select all

Aug 25 03:00:09 server1 su[27137]: + ??? root-nobody

Code: Select all

Checking `bindshell'... warning, got bogus unix line.