diff --git a/usr.sbin/periodic/etc/daily/460.status-mail-rejects b/usr.sbin/periodic/etc/daily/460.status-mail-rejects index b33e0062f3d7..a9ec3c8d1a51 100755 --- a/usr.sbin/periodic/etc/daily/460.status-mail-rejects +++ b/usr.sbin/periodic/etc/daily/460.status-mail-rejects @@ -1,78 +1,85 @@ #!/bin/sh # # # If there is a global system configuration file, suck it in. # if [ -r /etc/defaults/periodic.conf ] then . /etc/defaults/periodic.conf source_periodic_confs fi case "$daily_status_mail_rejects_shorten" in [Yy][Ee][Ss]) shorten='cut -d" " -f2,3';; *) shorten=cat;; esac case "$daily_status_mail_rejects_enable" in [Yy][Ee][Ss]) if [ ! -d /etc/mail ] then echo '$daily_status_mail_rejects_enable is set but /etc/mail' \ "doesn't exist" rc=2 elif [ ! -f /var/log/maillog ] then echo '$daily_status_mail_rejects_enable is set but ' \ "/var/log/maillog doesn't exist" rc=2 elif [ "$daily_status_mail_rejects_logs" -le 0 ] then echo '$daily_status_mail_rejects_enable is set but ' \ '$daily_status_mail_rejects_logs is not greater than zero' rc=2 else echo echo Checking for rejected mail hosts: - yesterday=$(date -v-1d '+%b %e') - today=$(date '+%b %e') + # Support both RFC 3164 (traditional) and RFC 5424 syslog timestamps. + today_3164="$(date '+%b %e ')" + today_5424="$(date -I)" + prefix_today="(^${today_3164}|^<[0-9]{1,3}>1 ${today_5424}T)" + + yesterday_3164="$(date -v-1d '+%b %e ')" + yesterday_5424="$(date -v-1d -I)" + prefix_yesterday="(^${yesterday_3164}|^<[0-9]{1,3}>1 ${yesterday_5424}T)" + n=$(($daily_status_mail_rejects_logs - 2)) rc=$({ while [ $n -ge 0 ] do if [ -f /var/log/maillog.$n ] then cat /var/log/maillog.$n elif [ -f /var/log/maillog.$n.gz ] then zcat -fc /var/log/maillog.$n.gz elif [ -f /var/log/maillog.$n.bz2 ] then bzcat -fc /var/log/maillog.$n.bz2 elif [ -f /var/log/maillog.$n.xz ] then xzcat -f /var/log/maillog.$n.xz elif [ -f /var/log/maillog.$n.zst ] then zstdcat -fc /var/log/maillog.$n.zst fi n=$(($n - 1)) done cat /var/log/maillog - } | sed -Ene "/^$today/q" -e "/^$yesterday/{"' + } | sed -En -e "/$prefix_today/q" -e "/$prefix_yesterday/{"' s/.*ruleset=check_relay,.* relay=([^,]+), reject=([^ ]*).*/\2 check_relay \1/p t end s/.*ruleset=check_rcpt,.* arg1=,]+).* reject=([^ ]+) .* ([^ ]+)/\2 check_rcpt \1 \3/p t end s/.*ruleset=check_([^,]+),.* arg1=,]+).* reject=([^ ]+) .* ([^ ]+)/\4 check_\1 \3 \5/p :end }' | eval $shorten | sort -f | uniq -ic | sort -fnr | tee /dev/stderr | wc -l) [ $rc -gt 0 ] && rc=1 fi;; *) rc=0;; esac exit $rc diff --git a/usr.sbin/periodic/etc/security/800.loginfail b/usr.sbin/periodic/etc/security/800.loginfail index 19bf9a4b3b91..91564185b653 100755 --- a/usr.sbin/periodic/etc/security/800.loginfail +++ b/usr.sbin/periodic/etc/security/800.loginfail @@ -1,65 +1,72 @@ #!/bin/sh - # # Copyright (c) 2001 The FreeBSD Project # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. # # # Show login failures # # If there is a global system configuration file, suck it in. # if [ -r /etc/defaults/periodic.conf ] then . /etc/defaults/periodic.conf source_periodic_confs fi LOG="${security_status_logdir}" -yesterday=`date -v-1d "+%b %e "` +# Support both RFC 3164 (traditional) and RFC 5424 syslog timestamps. +yesterday_3164="$(date -v-1d '+%b %e ')" +prefix_3164="^${yesterday_3164}" + +yesterday_5424="$(date -v-1d -I)" +prefix_5424="^<[0-9]{1,3}>1 ${yesterday_5424}T" + +prefix="(${prefix_3164}|${prefix_5424})" catmsgs() { find ${LOG} -name 'auth.log.*' -mtime -2 | sort -t. -r -n -k 2,2 | while read f do zcat -f $f done [ -f ${LOG}/auth.log ] && cat $LOG/auth.log } rc=0 if check_yesno_period security_status_loginfail_enable then echo "" echo "${host} login failures:" - n=$(catmsgs | egrep -ia "^$yesterday.*: .*\b(fail(ures?|ed)?|invalid|bad|illegal|auth.*error)\b" | + n=$(catmsgs | egrep -ia "${prefix}.*\b(fail(ures?|ed)?|invalid|bad|illegal|auth.*error)\b" | tee /dev/stderr | wc -l) [ $n -gt 0 ] && rc=1 || rc=0 fi exit $rc diff --git a/usr.sbin/periodic/etc/security/900.tcpwrap b/usr.sbin/periodic/etc/security/900.tcpwrap index bbbc04a03988..8f6f17ebd756 100755 --- a/usr.sbin/periodic/etc/security/900.tcpwrap +++ b/usr.sbin/periodic/etc/security/900.tcpwrap @@ -1,65 +1,72 @@ #!/bin/sh - # # Copyright (c) 2001 The FreeBSD Project # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. # # # Show tcp_wrapper warning messages # # If there is a global system configuration file, suck it in. # if [ -r /etc/defaults/periodic.conf ] then . /etc/defaults/periodic.conf source_periodic_confs fi LOG="${security_status_logdir}" -yesterday=`date -v-1d "+%b %e "` +# Support both RFC 3164 (traditional) and RFC 5424 syslog timestamps. +yesterday_3164="$(date -v-1d '+%b %e ')" +prefix_3164="^${yesterday_3164}" + +yesterday_5424="$(date -v-1d -I)" +prefix_5424="^<[0-9]{1,3}>1 ${yesterday_5424}T" + +prefix="(${prefix_3164}|${prefix_5424})" catmsgs() { find ${LOG} -name 'messages.*' -mtime -2 | sort -t. -r -n -k 2,2 | while read f do zcat -f $f done [ -f ${LOG}/messages ] && cat $LOG/messages } rc=0 if check_yesno_period security_status_tcpwrap_enable then echo "" echo "${host} refused connections:" - n=$(catmsgs | grep -i "^$yesterday.*refused connect" | + n=$(catmsgs | egrep -ia "${prefix}.*refused connect" | tee /dev/stderr | wc -l) [ $n -gt 0 ] && rc=1 || rc=0 fi exit $rc