diff options
| -rwxr-xr-x | usr.sbin/periodic/etc/daily/460.status-mail-rejects | 13 | ||||
| -rwxr-xr-x | usr.sbin/periodic/etc/security/800.loginfail | 11 | ||||
| -rwxr-xr-x | usr.sbin/periodic/etc/security/900.tcpwrap | 11 |
3 files changed, 28 insertions, 7 deletions
diff --git a/usr.sbin/periodic/etc/daily/460.status-mail-rejects b/usr.sbin/periodic/etc/daily/460.status-mail-rejects index b33e0062f3d7..a9ec3c8d1a51 100755 --- a/usr.sbin/periodic/etc/daily/460.status-mail-rejects +++ b/usr.sbin/periodic/etc/daily/460.status-mail-rejects @@ -36,8 +36,15 @@ case "$daily_status_mail_rejects_enable" in echo echo Checking for rejected mail hosts: - yesterday=$(date -v-1d '+%b %e') - today=$(date '+%b %e') + # Support both RFC 3164 (traditional) and RFC 5424 syslog timestamps. + today_3164="$(date '+%b %e ')" + today_5424="$(date -I)" + prefix_today="(^${today_3164}|^<[0-9]{1,3}>1 ${today_5424}T)" + + yesterday_3164="$(date -v-1d '+%b %e ')" + yesterday_5424="$(date -v-1d -I)" + prefix_yesterday="(^${yesterday_3164}|^<[0-9]{1,3}>1 ${yesterday_5424}T)" + n=$(($daily_status_mail_rejects_logs - 2)) rc=$({ while [ $n -ge 0 ] @@ -61,7 +68,7 @@ case "$daily_status_mail_rejects_enable" in n=$(($n - 1)) done cat /var/log/maillog - } | sed -Ene "/^$today/q" -e "/^$yesterday/{"' + } | sed -En -e "/$prefix_today/q" -e "/$prefix_yesterday/{"' s/.*ruleset=check_relay,.* relay=([^,]+), reject=([^ ]*).*/\2 check_relay \1/p t end s/.*ruleset=check_rcpt,.* arg1=<?([^>,]+).* reject=([^ ]+) .* ([^ ]+)/\2 check_rcpt \1 \3/p diff --git a/usr.sbin/periodic/etc/security/800.loginfail b/usr.sbin/periodic/etc/security/800.loginfail index 19bf9a4b3b91..91564185b653 100755 --- a/usr.sbin/periodic/etc/security/800.loginfail +++ b/usr.sbin/periodic/etc/security/800.loginfail @@ -39,7 +39,14 @@ fi LOG="${security_status_logdir}" -yesterday=`date -v-1d "+%b %e "` +# Support both RFC 3164 (traditional) and RFC 5424 syslog timestamps. +yesterday_3164="$(date -v-1d '+%b %e ')" +prefix_3164="^${yesterday_3164}" + +yesterday_5424="$(date -v-1d -I)" +prefix_5424="^<[0-9]{1,3}>1 ${yesterday_5424}T" + +prefix="(${prefix_3164}|${prefix_5424})" catmsgs() { find ${LOG} -name 'auth.log.*' -mtime -2 | @@ -57,7 +64,7 @@ if check_yesno_period security_status_loginfail_enable then echo "" echo "${host} login failures:" - n=$(catmsgs | egrep -ia "^$yesterday.*: .*\b(fail(ures?|ed)?|invalid|bad|illegal|auth.*error)\b" | + n=$(catmsgs | egrep -ia "${prefix}.*\b(fail(ures?|ed)?|invalid|bad|illegal|auth.*error)\b" | tee /dev/stderr | wc -l) [ $n -gt 0 ] && rc=1 || rc=0 fi diff --git a/usr.sbin/periodic/etc/security/900.tcpwrap b/usr.sbin/periodic/etc/security/900.tcpwrap index bbbc04a03988..8f6f17ebd756 100755 --- a/usr.sbin/periodic/etc/security/900.tcpwrap +++ b/usr.sbin/periodic/etc/security/900.tcpwrap @@ -39,7 +39,14 @@ fi LOG="${security_status_logdir}" -yesterday=`date -v-1d "+%b %e "` +# Support both RFC 3164 (traditional) and RFC 5424 syslog timestamps. +yesterday_3164="$(date -v-1d '+%b %e ')" +prefix_3164="^${yesterday_3164}" + +yesterday_5424="$(date -v-1d -I)" +prefix_5424="^<[0-9]{1,3}>1 ${yesterday_5424}T" + +prefix="(${prefix_3164}|${prefix_5424})" catmsgs() { find ${LOG} -name 'messages.*' -mtime -2 | @@ -57,7 +64,7 @@ if check_yesno_period security_status_tcpwrap_enable then echo "" echo "${host} refused connections:" - n=$(catmsgs | grep -i "^$yesterday.*refused connect" | + n=$(catmsgs | egrep -ia "${prefix}.*refused connect" | tee /dev/stderr | wc -l) [ $n -gt 0 ] && rc=1 || rc=0 fi |