epylog

epylog@lists.fedorahosted.org

339 discussions

Upstream Location
by James Cassell 09 Apr '18

09 Apr '18

What is the upstream location for epylog? the package in epel-7 lists it as https://fedorahosted.org/epylog/ That redirects to the "retired" page. Is epylog entirely dead? Looks like the last major list activity was in 2012. Thanks! V/r, James Cassell

2 1

Autoconf not found
by Adhiraj Joshi 09 Apr '15

09 Apr '15

Hi All, I downloaded the epylog_1.0.7 package and extracted it. I was planning to configure it by following the steps below, as given in the fedorahosted.org site, but I did not find any autoconf file in the extracted files. # autoconf # ./configure # make # make install How should I go ahead with the configuration? Regards, Adhiraj.

2 1

Updated epylog Debian package (1.0.7)
by Micha vor dem Berge 21 Apr '12

21 Apr '12

Hey there, several moth ago, I posted a bugreport for the debian developers to build a new debian package of epylog. Yesterday I got a mail that this bug was closed - there's a new epylog version for debian available now: http://packages.debian.org/sid/epylog Thanks for your work, it's fun to see an upgraded version in debian! :) In the next days I will test this version and will let you know if there are any issues. Best regards, Micha

1 0

[epylog/stable-1.0.x] Only do summary views for failures.
by Konstantin Ryabitsev 19 Apr '12

19 Apr '12

commit a33f008fa154ac1fbad057653b452d94f784ca35 Author: Konstantin Ryabitsev <mricon(a)kernel.org> Date: Thu Apr 19 11:17:20 2012 -0400 Only do summary views for failures. This fixes the logic -- we were showing summaries for both failed and successful logins, which isn't what we want. modules/logins_mod.py | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/modules/logins_mod.py b/modules/logins_mod.py index 2d2b8a8..b46df71 100644 --- a/modules/logins_mod.py +++ b/modules/logins_mod.py @@ -639,7 +639,7 @@ class logins_mod(InternalModule): action += 10 remote = self._mk_userat(byuser, rhost) - if self.failed_summary_only != '0': + if action == self.root_failure and self.failed_summary_only != '0': restuple = (action, service, 'total failed', '%s%s' % (system, remote)) else: @@ -655,7 +655,7 @@ class logins_mod(InternalModule): tmp = {'system': system, 'rhost': rhost} system = self.untrusted_host % tmp - if self.failed_summary_only != '0': + if action == self.failure and self.failed_summary_only != '0': restuple = (action, service, 'total failed', system) else: # Sanitize user

1 0

[epylog/stable-1.0.x] Add "failed_summary_only" option.
by Konstantin Ryabitsev 18 Apr '12

18 Apr '12

commit e92cade1139f6e74bda15d961ff722cc05115f4b Author: Konstantin Ryabitsev <mricon(a)kernel.org> Date: Wed Apr 18 11:07:22 2012 -0400 Add "failed_summary_only" option. Systems with publicly accessible services that don't use things like fail2ban or denyhosts tend to have a long list of failed attempts in each report. This option lists summary of all failed attempts per service, making the report much more palatable. I leave this option off by default, following the principle of least change. Also, sanitize the username before putting it into the report, as some enteprising souls have apparently tried using "<!--" as the username. etc/modules.d/logins.conf.in | 6 ++++++ modules/logins_mod.py | 21 +++++++++++++++++++-- 2 files changed, 25 insertions(+), 2 deletions(-) --- diff --git a/etc/modules.d/logins.conf.in b/etc/modules.d/logins.conf.in index fa5867d..ad35f48 100644 --- a/etc/modules.d/logins.conf.in +++ b/etc/modules.d/logins.conf.in @@ -37,3 +37,9 @@ safe_domains = .* # If you have too many systems, wide-scale probing may turn ugly. This # will collapse the reports. systems_collapse = 10 +## +# Failed logins reports tend to be long on systems with publicly listening +# services. If you want to see only a summary of failed logins, then +# set this option to 1: +# +failed_summary_only = 0 diff --git a/modules/logins_mod.py b/modules/logins_mod.py index 15d4264..2d2b8a8 100644 --- a/modules/logins_mod.py +++ b/modules/logins_mod.py @@ -176,6 +176,8 @@ class logins_mod(InternalModule): logger.put(0, 'Error compiling domain regex: %s' % domain) logger.put(0, 'Check config for Logins module!') + self.failed_summary_only = opts.get('failed_summary_only', '0') + self.regex_map = regex_map self.pam_service_re = rc('(\S+)$pam_unix$') @@ -636,7 +638,12 @@ class logins_mod(InternalModule): if user == 'root' or user == 'ROOT': action += 10 remote = self._mk_userat(byuser, rhost) - restuple = (action, system, service, remote) + + if self.failed_summary_only != '0': + restuple = (action, service, 'total failed', + '%s%s' % (system, remote)) + else: + restuple = (action, system, service, remote) else: if rhost: match = 0 @@ -647,7 +654,17 @@ class logins_mod(InternalModule): if not match: tmp = {'system': system, 'rhost': rhost} system = self.untrusted_host % tmp - restuple = (action, user, service, system) + + if self.failed_summary_only != '0': + restuple = (action, service, 'total failed', system) + else: + # Sanitize user + user = user.replace('&', '&') + user = user.replace('<', '<') + user = user.replace('>', '>') + + restuple = (action, user, service, system) + return restuple def _mk_dots(self, str, lim):

1 0

html tag truncating report
by Ian Mortimer 10 Apr '12

10 Apr '12

Hi Got some entries like this in the logs this morning sshd[12398]: Invalid user <!-- from 180.186.74.94 The result was that everything in the epylog report after the "User Failures" header was treated as a comment and not displayed. It's simple enough to post edit the report to replace <!-- with <!--- but I was wondering if there's a better way of handling cases like this. Thanks -- Ian

3 3

Minor bug report - epylock missing, cron fails
by Jon Peck 22 Feb '12

22 Feb '12

Hi, Thanks for all the recent development, epylog's a great resource! I think there's a minor oversight in the installer or an OS specific assumption. Full disclosure, I had been using epylog 1.03 on Ubuntu 10.04 LTS, did purge remove and installed 1.07 from source. With that said, I don't think that was the cause of the issue. xxx@yyy:~/tmp/epylog-1.0.7$ sudo /usr/sbin/epylog --cron Traceback (most recent call last): File "/usr/sbin/epylog", line 300, in <module> main(sys.argv) File "/usr/sbin/epylog", line 257, in main epylock() File "/usr/sbin/epylog", line 144, in epylock if not msg.strerror == "File exists": raise msg OSError: [Errno 2] No such file or directory: '/usr/var/run/epylog.pid' xxx@yyy:~/tmp/epylog-1.0.7$ ls -la /usr/var total 12 drwxr-xr-x 3 root root 4096 2011-09-06 13:25 . drwxr-xr-x 13 root root 4096 2011-09-06 13:25 .. drwxr-xr-x 3 root root 4096 2012-02-20 20:20 lib That explains why there's no file. xxx@yyy:~/tmp/epylog-1.0.7$ sudo mkdir -p /usr/var/run Then it executed normally. Best regards, Jon Peck

1 0

[epylog] Created tag v1.0.7
by Konstantin Ryabitsev 10 Feb '12

10 Feb '12

The signed tag 'v1.0.7' was created. Tagger: Konstantin Ryabitsev <mricon(a)kernel.org> Date: Fri Feb 10 22:22:35 2012 -0500 Really tag for 1.0.7 Changes since the last tag 'v1.0.6': Konstantin Ryabitsev (2): Do not return an error on 0-length log files. Quickfix for 1.0.7 (I hate autoconf)

1 0

[epylog] Deleted tag v1.0.7
by Konstantin Ryabitsev 10 Feb '12

10 Feb '12

The signed tag 'v1.0.7' was deleted. It previously pointed to: e2f8780... Do not return an error on 0-length log files.

1 0

[epylog/stable-1.0.x] Quickfix for 1.0.7 (I hate autoconf)
by Konstantin Ryabitsev 10 Feb '12

10 Feb '12

commit bf6188bbb334522a91f0626f6c95c9a854977269 Author: Konstantin Ryabitsev <mricon(a)kernel.org> Date: Fri Feb 10 22:21:38 2012 -0500 Quickfix for 1.0.7 (I hate autoconf) configure.in | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) --- diff --git a/configure.in b/configure.in index b003f4e..fce006f 100644 --- a/configure.in +++ b/configure.in @@ -1,6 +1,6 @@ dnl Process this file with autoconf to produce a configure script -AC_INIT(epylog.spec) +AC_INIT(epylog.in) PACKAGE_TARNAME=epylog PACKAGE_VERSION=1.0.7

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

epylog