Your message dated Mon, 22 Feb 2010 21:42:58 +0000 with message-id <e1njg3o-00014a...@ries.debian.org> and subject line Bug#567317: fixed in logcheck 1.3.7 has caused the Debian Bug report #567317, regarding Add "disconnected by user" ignore for recent openssh-client to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 567317: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=567317 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
--- Begin Message ---Package: logcheck-database Version: 1.3.5 Severity: normal Tags: patch User: ubuntu-de...@lists.ubuntu.com Usertags: origin-ubuntu lucid ubuntu-patch Hi With the most recent openssh-client in Ubuntu lucid (10.04), I get new warnings with an Ubuntu karmic (9.10) openssh-server. I think openssh in Ubuntu and Debian are really close, so I believe this will hit Debian pretty soon too. Please find a patch to address these. According to the OpenSSH maintainer these are expected: 10:53 < lool> cjwatson: Hi, since a recent upgrade of the ssh client on lucid, I get warnings in logcheck from auth.log; the following lines now appear everytime I close a ssh connection: 10:53 < lool> Jan 28 10:52:51 fox sshd[26563]: Received disconnect from 192.168.0.119: 11: disconnected by user 10:53 < lool> (before pam session is closed) 10:54 < lool> cjwatson: I don't know whether this is expected or not, in which case I'll update the logcheck rules 12:52 < cjwatson> lool: it appears to be intentional 12:52 < cjwatson> lool: from what I can tell it was part of the preparation for roaming support Thanks, -- Loïc Minierdiff -Nru logcheck-1.3.5ubuntu1/debian/changelog logcheck-1.3.5ubuntu2/debian/changelog --- logcheck-1.3.5ubuntu1/debian/changelog 2010-01-21 23:36:34.000000000 +0100 +++ logcheck-1.3.5ubuntu2/debian/changelog 2010-01-28 18:10:35.000000000 +0100 @@ -1,3 +1,11 @@ +logcheck (1.3.5ubuntu2) lucid; urgency=low + + * rulefiles/linux/ignore.d.server/ssh: Add "disconnected by user" re in the + "Received disconnect from" series; this now occurs frequently with lucid + ssh clients. + + -- Loïc Minier <loic.min...@ubuntu.com> Thu, 28 Jan 2010 18:09:22 +0100 + logcheck (1.3.5ubuntu1) lucid; urgency=low * rulefiles/linux/ignore.d.paranoid/cron: make /usr/sbin/ optional in diff -Nru logcheck-1.3.5ubuntu1/rulefiles/linux/ignore.d.server/ssh logcheck-1.3.5ubuntu2/rulefiles/linux/ignore.d.server/ssh --- logcheck-1.3.5ubuntu1/rulefiles/linux/ignore.d.server/ssh 2009-09-05 12:45:08.000000000 +0200 +++ logcheck-1.3.5ubuntu2/rulefiles/linux/ignore.d.server/ssh 2010-01-28 18:09:15.000000000 +0100 @@ -13,6 +13,7 @@ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Received disconnect from [:.[:xdigit:]]+: [12]: Timeout, server not responding\.$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Received disconnect from [:[:xdigit:].]+: [[:digit:]]+: Client disconnect$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Received disconnect from [:[:xdigit:].]+: [[:digit:]]+: Disconnect requested by Windows SSH Client\.$ +^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Received disconnect from [:[:xdigit:].]+: [[:digit:]]+: disconnected by user$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Server listening on [:[:xdigit:].]+ port [[:digit:]]+\.$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: User [-_.[:alnum:]]+ from [-_.[:alnum:]]+ not allowed because (listed in Deny|not listed in Allow)Users$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: \(pam_[[:alnum:]]+\) session opened for user [^[:space:]]+( by ([[:alnum:]-]+)?\(uid=[[:digit:]]+\))?$
--- End Message ---
--- Begin Message ---Source: logcheck Source-Version: 1.3.7 We believe that the bug you reported is fixed in the latest version of logcheck, which is due to be installed in the Debian FTP archive: logcheck-database_1.3.7_all.deb to main/l/logcheck/logcheck-database_1.3.7_all.deb logcheck_1.3.7.dsc to main/l/logcheck/logcheck_1.3.7.dsc logcheck_1.3.7.tar.gz to main/l/logcheck/logcheck_1.3.7.tar.gz logcheck_1.3.7_all.deb to main/l/logcheck/logcheck_1.3.7_all.deb logtail_1.3.7_all.deb to main/l/logcheck/logtail_1.3.7_all.deb A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 567...@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Hannes von Haugwitz <han...@vonhaugwitz.com> (supplier of updated logcheck package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmas...@debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.8 Date: Fri, 19 Feb 2010 07:16:32 +0100 Source: logcheck Binary: logcheck logcheck-database logtail Architecture: source all Version: 1.3.7 Distribution: unstable Urgency: low Maintainer: Debian logcheck Team <logcheck-devel@lists.alioth.debian.org> Changed-By: Hannes von Haugwitz <han...@vonhaugwitz.com> Description: logcheck - mails anomalies in the system logfiles to the administrator logcheck-database - database of system log rules for the use of log checkers logtail - Print log file lines that have not been read (deprecated) Closes: 546004 567150 567317 567842 570207 Changes: logcheck (1.3.7) unstable; urgency=low . [ Hannes von Haugwitz ] * Added src/logcheck-test and docs/logcheck-test.1 * ignore.d.server/wu-ftpd: - adjusted rule to match optional pid (closes: #570207) * src/logcheck: - use 7bit encoding for sending mail * ignore.d.workstation/kernel: - added rules for inserted and removed SD cards * ignore.d.server/mountd: new - added rule for authenticated mount/unmount requests, thanks to Paweł Hajdan, Jr. (closes: #567842) * docs/logcheck.sgml: clarify that "server" rules are included in "workstation" level * ignore.d.server/klogind: new - added rule for "connect from" message * ignore.d.server/login: - added rule for root logins on pseudo terminals * ignore.d.server/bind: - added rules for "received notify for zone" and "zone is up to date" message * Makefile: - added an empty "all" make target, thanks to Paweł Hajdan, Jr. (closes: #567150) - renamed BINDIR to SBINDIR - added logtail2 script to "clean" make target * ignore.d.server/ssh: - added rule for "disconnected by user" message (closes: #567317) * ignore.d.workstation/ifplugd: - added rule for "client: OK" message * debian/control: - bumped to Standards-Version 3.8.4 (no changes necessary) - added ${misc:Depends} to logtail Depends . [ Hanspeter Kunz ] * ignore.d.server/dovecot: - added an optional prefix "dovecot: " to the deliver rule - added rule to ignore various sieve messages (stored mail, forwards, vacation replies and discards) . [ Frédéric Brière ] * ignore.d.server/kernel: - added IPv6 support to "Treason uncloaked!" rule (closes: #546004) - added "Peer unexpectedly shrunk window" alternate rule - allow '-' in usbcore interface driver names (e.g. snd-usb-audio) * ignore.d.workstation/kernel: - added UDF-fs "readonly partition" and "Mounting volume" rules - usbhid no longer prints the source filename in its messages - allow ':' and arbitrary paths for input devices - adjusted "USB HID" rule to match generic devices - adjusted "USB HID" rule for newer kernels - adjusted agpgart rules for newer kernels Checksums-Sha1: 831eb68c007c231839da1ef3b3509d28dfab6d0f 1260 logcheck_1.3.7.dsc 1a0e7a5cb763e40857e9abed487e0596275faed9 152953 logcheck_1.3.7.tar.gz f01cdc840ce2cbafc766149d9c03cf11d432f568 74774 logcheck_1.3.7_all.deb 622067c8ddfab2937d806e82e7a5a7fd02691c91 114776 logcheck-database_1.3.7_all.deb 96aab023b10a1a712cc8a99bd8941e683d2d99c6 57494 logtail_1.3.7_all.deb Checksums-Sha256: a73324dd411f597e4f67fb8f2430f5cbdda0555c8a896fea44a61945554fe783 1260 logcheck_1.3.7.dsc dcfb68a128b3deab4a411e323c92e887eb9cd4ae4b330211f5c0ae7ed261a909 152953 logcheck_1.3.7.tar.gz d45135f16fef7a906e70b02e8974b28d1a982b83d507d134749471dc0eb195b4 74774 logcheck_1.3.7_all.deb 2d96da464708f362b2080d925fe314441e4ca82c3b35b4e0217b37992260e452 114776 logcheck-database_1.3.7_all.deb 6aadc7e4b40a330637c905d30da4087aa6c8fb2eeace7a4a9c8feabf45bad08e 57494 logtail_1.3.7_all.deb Files: f13e6ab476ecbf719549135180337fc9 1260 admin optional logcheck_1.3.7.dsc 3bfa692ff9e2e507250a6be9f8fd3494 152953 admin optional logcheck_1.3.7.tar.gz ad2232486c067e95c20c1ee7543b73e6 74774 admin optional logcheck_1.3.7_all.deb cdd30530e5240f4521a2b73cb4de8ddf 114776 admin optional logcheck-database_1.3.7_all.deb 7927e4041ebdd3db14392c3a37f3ba02 57494 admin optional logtail_1.3.7_all.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iEYEARECAAYFAkuC7ZwACgkQELuA/Ba9d8ZhGACdGHZD3isVZ9cVUI0PXmVBj/Fn yXEAoJVL+nXWo3uwPTGWhpAUNUwdw90b =Ot/6 -----END PGP SIGNATURE-----
--- End Message ---
_______________________________________________ Logcheck-devel mailing list Logcheck-devel@lists.alioth.debian.org http://lists.alioth.debian.org/mailman/listinfo/logcheck-devel
