Package: logwatch
Version: 7.3.6-1
Severity: normal
Tags: patch
logwatch doesn't seem to like proftpd using other pam modules for
authentication. My
patch just matches any pam module match (hopefully).
My version of proftpd is 1.3.1-7 from testing, and an exmaple of the line in
question is:
> pam_unix(proftpd:auth): authentication failure; logname= uid=0 euid=0 tty=
> ruser=Administrator rhost=222.242.199.136
-- System Information:
Debian Release: lenny/sid
APT prefers testing
APT policy: (900, 'testing'), (600, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.24-1-686 (SMP w/1 CPU core)
Locale: LANG=en_GB, LC_CTYPE=en_GB (charmap=ISO-8859-1)
Shell: /bin/sh linked to /bin/bash
Versions of packages logwatch depends on:
ii perl 5.8.8-12 Larry Wall's Practical Extraction
ii postfix [mail-transport-agen 2.5.2~rc2-1 High-performance mail transport ag
Versions of packages logwatch recommends:
pn libdate-manip-perl <none> (no description available)
-- no debconf information
--- services/proftpd-messages 2008-05-11 20:36:08.000000000 +0100
+++ services.dist/proftpd-messages 2008-05-11 20:11:19.000000000 +0100
@@ -56,7 +56,7 @@
if (
( $ThisLine =~ /^FTP session closed/ ) or
( $ThisLine =~ /^(ANONYMOUS )?FTP login as \'.*\' from [^ ]+ \[.*\]
to .*/ ) or
- ( $ThisLine =~ /PAM.*?\(.*\): Authentication failure/i ) or
+ ( $ThisLine =~ /PAM\(.*\): Authentication failure/ ) or
( $ThisLine =~ /^data_sendfile/ ) or
( $ThisLine =~ /(:| \-) FTP session (closed|opened)/ ) or
( $ThisLine =~ /(:| \-) No certificate files found/ ) or
