######################################################## # Please file all bug reports, patches, and feature # requests under: # https://sourceforge.net/p/logwatch/_list/tickets # Help requests and discusion can be filed under: # https://sourceforge.net/p/logwatch/discussion/ ######################################################## ####################################################### ## Copyright (c) 2008 Kirk Bauer ## Covered under the included MIT/X-Consortium License: ## http://www.opensource.org/licenses/mit-license.php ## All modifications and contributions by other persons to ## this script are assumed to have been donated to the ## Logwatch project and thus assume the above copyright ## and licensing terms. If you want to make contributions ## under your own copyright or a different license this ## must be explicitly stated in the contribution an the ## Logwatch project reserves the right to not accept such ## contributions. If you have made significant ## contributions to this script and want to claim ## copyright please contact logwatch-devel@lists.sourceforge.net. ######################################################### $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0; #$DoLookup = $ENV{'secure_ip_lookup'}; $Ignore = $ENV{'ignore_services'} || 0; $Summarize = $ENV{'summarize_connections'} || 0; $ConsoleLock = 0; $spop3d_opened=0; $spop3d_errors=0; $pwd_file_unknown = 0; $pwd_file_too_short = 0; $Executed_app = 0; $PwdChange = 0; $RequestKeyFailures = 0; %OtherList = (); %RootkitHunter = (); %sshguardAttackers = (); use Logwatch ':ip'; while (defined($ThisLine = )) { chomp($ThisLine); $ThisLine =~ s/^... .. ..:..:.. [^ ]+ //; #Solaris ID filter -mgt $ThisLine =~ s/\[ID [0-9]+ [a-z]+\.[a-z]+\] //; my $temp = $ThisLine; $temp =~ s/^([^[:]+).*/$1/; if ($Ignore =~ /(\s|^)\Q$temp\E(\s|$)/i) { next; } #current sarge if ($ThisLine =~ /^[^ :]*:( [0-9:\[\]\.]+|) \(pam_(unix|securetty)\)/i ) {next; } #Woody - specific, thanks to Michael Stovenour if ($ThisLine =~ /^PAM_unix[\[\]0-9]*:/i ) { next; } if (( $ThisLine =~ /pam_succeed_if(\([a-zA-Z]*:[a-zA-Z]*\))?: requirement \"uid (<|>)=? (5|10)00?\" (was|not) met by user /) or ( $ThisLine =~ /pam_rhosts_auth\[\d+\]: allowed to [^ ]+ as \w+/) or ( $ThisLine =~ /pam_rhosts_auth\([^\)]+\): allowed to [^ ]+ as \w+/) or ( $ThisLine =~ /^(.*)\(pam_unix\)/) or ( $ThisLine =~ /pam_warn\(.*:.*\)/) or ( $ThisLine =~ /pam_unix\(.*:.*\)/) or ( $ThisLine =~ /pam_sss\(.*:.*\)/) or ( $ThisLine =~ m/^[^ ]+\[\d+\]: connect from localhost$/ ) or ( $ThisLine =~ /^halt:/) or ( $ThisLine =~ /^com.apple.SecurityServer: Succeeded authorizing right system.(preferences|login.console|login.tty|login.done|privilege.admin) by process/) or ( $ThisLine =~ /^pam_xauth\[\d+\]: call_xauth: child returned \d/) or ( $ThisLine =~ /^su\[\d+\]: pam_authenticate: Authentication failure/) or ( $ThisLine =~ /^passwd\[\d+\]:/) or ( $ThisLine =~ /^passwd: gkr-pam: .*/) or ( $ThisLine =~ /^reboot:/) or ( $ThisLine =~ /^(?:\/usr\/bin\/)?sudo(?:\[\d+\])?:/) or ( $ThisLine =~ /^su: pam_unix2: session (started|finished) for user [^ ]+, service [^ ]+/) or ( $ThisLine =~ /^xinetd\[\d+\]: USERID: ([^ ]+) (.+)$/ ) or ( $ThisLine =~ /warning: can.t get client address: Connection refused/) or ( $ThisLine =~ /Showing Login Window/) or ( $ThisLine =~ /User Authenticated: continue login process/) or ( $ThisLine =~ /com.apple.SecurityServer: Entering service/) or ( $ThisLine =~ /^(xinetd|xinetd-ipv6)\[\d+\]: EXIT: /) or ( $ThisLine =~ /^crond\(\w+\)\[\d+\]: session /) or ( $ThisLine =~ /pam_systemd\(.+:session\): Moving/) or ( $ThisLine =~ /^sshd\(\w+\)\[\d+\]: authentication failure/) or ( $ThisLine =~ /^sshd\(\w+\)\[\d+\]: check pass; user unknown/) or ( $ThisLine =~ /^sshd\(\w+\)\[\d+\]: session /) or ( $ThisLine =~ /sshd\[\d+\]: Server listening on/) or ( $ThisLine =~ /sshd\[\d+\]: Received signal \d+; terminating/) or ( $ThisLine =~ /sshd\[\d+\]: Disconnected from user/) or ( $ThisLine =~ /sshd\[\d+\]: Received disconnect from/) or ( $ThisLine =~ /sshd\[\d+\]: message repeated/) or ( $ThisLine =~ /pam_systemd(_home)?\(\w+:session\): New sd-bus connection/) or ( $ThisLine =~ /^ipop3d\[\d+\]:/) or ( $ThisLine =~ /^su\[\d+\]: [+-] .+/) or ( $ThisLine =~ /^su\[\d+\]: FAILED su for \S+ by \S+/) or #debian: done in pam_unix ( $ThisLine =~ /^login\[\d+\]: ROOT LOGIN on '\S+'/) or #debian: done in pam_unix (Similar message on other system is reported) ( $ThisLine =~ /^login(?:\[\d+\])?: FAILED LOGIN \(\d+\) on ['`]\S+' FOR `\S+', (Authentication failure|User not known to the underlying authentication module)/) or #debian: done in pam_unix ( $ThisLine =~ /^login: FAILED LOGIN 2 FROM (.*) FOR .*, (Authentication failure|User not known to the underlying authentication module)/) or ( $ThisLine =~ /^login: pam_securetty(.*): unexpected response from failed conversation function/) or ( $ThisLine =~ /^login: pam_securetty(.*): access denied: tty '.*' is not secure/) or ( $ThisLine =~ /^login: pam_securetty(.*): cannot determine username/) or ( $ThisLine =~ /^pam_limits\[\d+\]/ ) or ( $ThisLine =~ /^kcheckpass(\[\d+\]|):/ ) or # done in pam_unix ( $ThisLine =~ /^cyrus\/lmtpd\[\d+\]: [^ ]+ server step [12]/ ) or ( $ThisLine =~ /^cyrus\/imapd\[\d+\]: [^ ]+ server step [12]/ ) or ( $ThisLine =~ /pam_timestamp: updated timestamp file/) or ( $ThisLine =~ /pam_timestamp\(?[^ ]*\)?: timestamp file `([^ ]+)' is only \d+ seconds old, allowing access to ([^ ]+) for user ([^ ]+)/) or ( $ThisLine =~ /pam_timestamp\(?[^ ]*\)?: timestamp file `([^ ]+)' (has unacceptable age \(\d+ seconds\)|is older than oldest login), disallowing access to ([^ ]+) for user ([^ ]+)/) or ( $ThisLine =~ /userhelper\[\d+\]: running '([^ ]+)' with [^ ]+ context/) or ( $ThisLine =~ /pam_timestamp\(.*:session\): updated timestamp file `\/var\/run\/sudo.*'/) or ( $ThisLine =~ /[^ ]*: pam_keyinit(.*:.*): Unable to change GID to [0-9]* temporarily/) or ( $ThisLine =~ /password check failed for user \(\S*\)/) or ( $ThisLine =~ /PAM pam_set_item: attempt to set conv\(\) to NULL/) or ( $ThisLine =~ /PAM pam_get_item: nowhere to place requested item/) or ( $ThisLine =~ /pam_succeed_if\(.*:.*\): error retrieving information about user [a-zA-Z]*/ ) or ( $ThisLine =~ /pam_selinux_permit\(.*:.*\):/ ) or ( $ThisLine =~ /logfile turned over/) or # newsyslog on OpenBSD ( $ThisLine =~ /vmware-authd\[[0-9]+\]: PAM \[error: [^ ]+ cannot open shared object file: No such file or directory\]/) or ( $ThisLine =~ /vmware-authd\[[0-9]+\]: PAM adding faulty module: [^ ]+/) or ( $ThisLine =~ /Connection closed by/) or ( $ThisLine =~ /Conversation error/) or ( $ThisLine =~ /sshd.*: Accepted \S+ for \S+ from [\d\.:a-f]+ port \d+/) or # ssh script reads this log ( $ThisLine =~ /userhelper.*: running (.*) with context (.*)/) or ( $ThisLine =~ /userhelper.*: pam_thinkfinger(.*): conversation failed/) or ( $ThisLine =~ /su: PAM [0-9] more authentication failure; .*/) or ( $ThisLine =~ /su: No passwd entry for user '(.*)'/) or ( $ThisLine =~ /polkit-grant-helper\[\d+\]: granted authorization for [^ ]* to uid [0-9]* \[auth=.*\]/) or ( $ThisLine =~ /polkit-grant-helper\[\d+\]: granted authorization for [^ ]* to session .* \[uid=[0-9]*\]/) or ( $ThisLine =~ /polkit-grant-helper-pam\[\d+\]: pam_thinkfinger\(polkit:auth\): conversation failed/) or ( $ThisLine =~ /polkitd(\(authority=.*\)|\[\d+\])?: (Unr|R)egistered Authentication Agent/) or ( $ThisLine =~ /polkitd(\(authority=.*\)|\[\d+\])?: Operator of unix-session:/) or ( $ThisLine =~ /polkitd(\(authority=.*\)|\[\d+\])?: Acquired the name [^ ]* on the system bus$/) or ( $ThisLine =~ /polkitd(\(authority=.*\)|\[\d+\])?: Lost the name [^ ]* - exiting$/) or ( $ThisLine =~ /polkitd(\(authority=.*\)|\[\d+\])?: Loading rules from directory /) or ( $ThisLine =~ /polkitd(\(authority=.*\)|\[\d+\])?: Reloading rules/) or ( $ThisLine =~ /polkitd(\(authority=.*\)|\[\d+\])?: Finished loading, compiling and executing \d+ rules$/) or ( $ThisLine =~ /polkitd(\(authority=.*\)|\[\d+\])?: Collecting garbage unconditionally/) or ( $ThisLine =~ /(gdm-session-worker|gdm-password|gnome-screensaver-dialog)\[\d+\]: gkr-pam: no password is available for user/) or ( $ThisLine =~ /gkr-pam: the password for the login keyring was invalid/) or ( $ThisLine =~ /gkr-pam: unlocked login keyring/) or ( $ThisLine =~ /groupadd\[\d+\]: group added to /) or # Details in other messages ( $ThisLine =~ /groupmod\[\d+\]: group changed in \/etc\/gshadow /) or # Details in other messages ( $ThisLine =~ /gdm-session-worker\[\d+\]: pam_namespace\(gdm:session\): Unmount of [^ ]* failed, Device or resource busy/) or ( $ThisLine =~ /pkexec: pam_systemd(.*): /) or ( $ThisLine =~ /pkexec(?:\[\d+\])?: \S+: Executing command /) or ( $ThisLine =~ /su: pam_systemd(.*): Failed to parse message: /) or ( $ThisLine =~ /pam_systemd\(su:session\): Cannot create session: Already (running in|occupied by) a session/) or ( $ThisLine =~ /pam_systemd\(su.*:session\): Failed to release session:/) or ( $ThisLine =~ /systemd-logind\[\d+\]: (New|Removed) session/) or ( $ThisLine =~ /systemd-logind\[\d+\]: New seat seat\d+\./) or ( $ThisLine =~ /systemd-logind\[\d+\]: Watching system buttons on /) or ( $ThisLine =~ /systemd-logind\[\d+\]: Failed to start session scope (\S+): Transaction is destructive\./) or ( $ThisLine =~ /systemd-logind\[\d+\]: Session \d+ logged out/) or ( $ThisLine =~ /DIGEST-MD5 common mech free/) or ( $ThisLine =~ /sshguard\[\d+\]: Reloading rotated file /) or ( $ThisLine =~ /sshguard\[\d+\]: Session \d+ logged out/) or ( $ThisLine =~ /sshguard\[\d+\]: Exiting on signal/) or ( $ThisLine =~ /sshguard\[\d+\]: Monitoring attacks from /) or ( $ThisLine =~ /sshguard\[\d+\]: (?:message repeated \d+ times: \[ )?\S+: not blocking /) or ( $ThisLine =~ /sshguard\[\d+\]: Received EOF from stdin/) or ( $ThisLine =~ /sshguard\[\d+\]: .*has already been blocked/) or 0 # This line prevents blame shifting as lines are added above ) { # Ignore these entries } elsif ($ThisLine =~ /^spop3d/ || $ThisLine =~ /^pop\(\w+\)\[\d+\]:/) { @line=split(": ",$ThisLine); if ($line[1]=~/^session opened for user/) { $spop3d_opened++; @bzz=split(" ",$line[1]); $PopUser= $bzz[4]; $PopLogin{$PopUser}++; } if ($line[1]=~/^authentication failure;/) { # authentication failure; logname= uid=0 euid=0 tty= # ruser= rhost= user=xavier $spop3d_errors++; @bzz=split(" user=",$line[1]); $PopErr=$bzz[1]; $PopErrors{$PopErr}++; } } elsif ( ($Host,$User) = ($ThisLine =~ /^login: FAILED LOGIN \d+ FROM ([^ ]+) FOR ([^,]+),/ ) ) { $FailedLogins->{$User}->{$Host}++; } elsif ( ($Service,$IP) = ($ThisLine =~ /^([^ ]+)\[\d+\]: connect(ion)? from "?(\d+\.\d+\.\d+\.\d+).*/) ) { $Name = LookupIP($IP); if ($Summarize =~ /\Q$Service\E/) { $Connections->{$Service}++; } else { $Connections->{$Service}->{$Name}++; } } elsif ( ($Service,$Name) = ($ThisLine =~ /^(in\.rshd)\[\d+\]: (.*)/) ) { if ($Summarize =~ /\Q$Service\E/) { $Connections->{$Service}++; } else { $Connections->{$Service}->{$Name}++; } } elsif ( ($Service,$Su_msg) = ($ThisLine =~ /^(su)(?:\[\d+\])?:\s+('su \w+' succeeded for \w+) on/) ) { #Solaris su messages -mgt $Connections->{$Service}->{$Su_msg}++; } elsif ( ($Service,$Su_msg) = ($ThisLine =~ /^(su)(?:\[\d+\])?:\s+succeeded: (\w+ changing from \w+ to \w+)/) ) { #Irix su messages -mgt $Connections->{$Service}->{$Su_msg}++; } elsif ( ($Service,$IP) = ($ThisLine =~ /^([^ ]+)\[\d+\]: refused connect from (\d+\.\d+\.\d+\.\d+)$/) ) { $Name = LookupIP($IP); $Refused->{$Service}->{$Name}++; } elsif ( ($Service,$Name) = ($ThisLine =~ /^([^ ]+)\[\d+\]: refused connect from (.*)$/) ) { $Refused->{$Service}->{$Name}++; } elsif ( ($Service,$Name) = ($ThisLine =~ /^([^ ]+)\[\d+\]: connect from ([^\n]+)$/) ) { if ($Summarize =~ /\Q$Service\E/) { $Connections->{$Service}++; } else { $Connections->{$Service}->{$Name}++; } } elsif ( (undef, $Service, $IP) = ($ThisLine =~ /^(xinetd|xinetd-ipv6)\[\d+\]: START: ([^ ]+) pid=\d+ from=([^\n]+)$/) ) { if ($Ignore =~ /\b\Q$Service\E\b/i) { next; } if ($Summarize =~ /\Q$Service\E/) { $Connections->{$Service}++; } else { # the following is intended for the string, but captures # all non-IP addresses if ($IP =~ /^[A-Fa-f\d\.:]+$/ ) { $Name = LookupIP($IP); } else { $Name = $IP; } $Connections->{$Service}->{$Name}++; } #Solaris inetd this works if you start "inetd -s -t" then send daemon.notice to authlog -mgt } elsif ( ($Service, $IP) = ($ThisLine =~ /^inetd\[\d+\]: (\w+)\[\d+\] from ([^ \n]+) \d+$/) ) { if ($Ignore =~ /\b\Q$Service\E\b/i) { next; } if ($Summarize =~ /\Q$Service\E/) { $Connections->{$Service}++; } else { $Name = LookupIP($IP); $Connections->{$Service}->{$Name}++; } } elsif ( ($Service,undef,$Name) = ($ThisLine =~ /^([^ ]+)\[\d+\]: warning: ([^ ]+), line \d+: can't verify hostname: getaddrinfo\(([^ ]+), AF_INET\) failed$/) ) { $NameVerifyFail{$Service}{$Name}++; } elsif ( ($Service,undef,$Name,$IP) = ($ThisLine =~ /^([^ ]+)\[\d+\]: warning: ([^ ]+), line \d+: host name\/name mismatch: ([^ ]+) != ([^ ]+)$/) ) { $NameVerifyFail{$Service}{"$Name != $IP"}++; } elsif ( ($Display, $User) = ($ThisLine =~ /^xscreensaver\[\d+\]: FAILED LOGIN \d ON DISPLAY \"([^ ]+)\", FOR \"([^ ]+)\"$/) ) { $FailedSaver->{$User}->{$Display}++; } elsif ( $ThisLine =~ s/^([^ ]+)\[\d+\]: warning: can\'t get client address: No route to host$/$1/ ) { $NoIP->{$ThisLine}++; } elsif ( $ThisLine =~ s/^([^ ]+)\[\d+\]: warning: can\'t get client address: Network is unreachable$/$1/ ) { $NoIP->{$ThisLine}++; } elsif ( $ThisLine =~ s/^([^ ]+)\[\d+\]: warning: can\'t get client address: Connection reset by peer$/$1/ ) { $NoIP->{$ThisLine}++; } elsif ( $ThisLine =~ s/^([^ ]+)\[\d+\]: warning: can\'t get client address: Connection timed out$/$1/ ) { $NoIP->{$ThisLine}++; } elsif ( $ThisLine =~ s/^([^ ]+)\[\d+\]: connect from unknown$/$1/ ) { $NoIP->{$ThisLine}++; } elsif ( ($Service,$Err) = ($ThisLine =~ /^([^ ]+)\[\d+\]: error: (.+)$/) ) { $Error{$Service}{$Err}++; } elsif ( ($Service,$Err) = ($ThisLine =~ /^([^ ]+): (FAILED LOGIN SESSION FROM [^ ]+ FOR ([^ ]+)?, .*)$/ ) ) { $Error{$Service}{$Err}++; } elsif ( ($Service,$Err) = ($ThisLine =~ /^([^ ]+): (password mismatch for [^ ]+ in [^ ]+):.*$/ ) ) { $Error{$Service}{$Err}++; } elsif ( ($Service,$Err) = ($ThisLine =~ /^([^ ]+)\[\d+\]: (changed POP3 password for .*)$/ ) ) { $Error{$Service}{$Err}++; } elsif ( ($Service,$Err) = ($ThisLine =~ /^(su)(?:\[\d+\])?: ('su \w+' failed for \w+)/ ) ) { #Solaris 10 su failed -mgt $Error{$Service}{$Err}++; } elsif ( ($Service,$Err) = ($ThisLine =~ /^(su): (FAILED SU \(to \w+\) \w+ on [^ ]+)/ ) ) { #SuSe su failed $Error{$Service}{$Err}++; } elsif ( ($Service,$Err) = ($ThisLine =~ /^(su): (BAD SU \w+ to \w+ on [^ ]+)/ ) ) { #OpenBSD su failed $Error{$Service}{$Err}++; } elsif ( $ThisLine =~ /^login(\[\d+\])*: ROOT LOGIN\s+(ON|on)\s+`?tty[0-9]+/) { $RootLoginTTY++ } elsif ( $ThisLine =~ /^login(\[\d+\])*: ROOT LOGIN\s+(ON|on)\s+`?xvc[0-9]+/) { $RootLoginXVC++ } elsif ( $ThisLine =~ /^com.apple.SecurityServer: authinternal authenticated user root .*/) { $RootLoginTTY++ } elsif ( (undef,undef,$User) = ($ThisLine =~ /^login(\[\d+\])*: LOGIN ON (tty|pts\/)[0-9]+ BY ([^ ]+)/ )) { $UserLogin{$User}++; } elsif ( ($User,undef) = ($ThisLine =~ /^com.apple.SecurityServer: authinternal authenticated user ([^ ]+) .*/ )) { $UserLogin{$User}++; } elsif ( $ThisLine =~ s/^userdel(?:\[\d+\])?: delete user [`'](.+)'/$1/ ) { $DeletedUsers .= " $ThisLine\n"; } elsif ( $ThisLine =~ s/^(?:useradd|adduser)(?:\[\d+\])?: new user: name=(.+), (?:uid|UID)=(\d+).*$/$1 ($2)/ ) { $NewUsers .= " $ThisLine\n"; } elsif ( $ThisLine =~ s/^userdel(?:\[\d+\])?: remove(?:d)? (?:shadow )?group [`'](\S+)'( owned by \S+)?/$1/ ) { $DeletedGroups .= " $ThisLine\n"; } elsif ( $ThisLine =~ s/^groupdel(?:\[\d+\])?: remove group `(.+)'/$1/ ) { $DeletedGroups .= " $ThisLine\n"; } elsif ( $ThisLine =~ s/^(?:useradd|adduser)(?:\[\d+\])?: new group: name=(.+), (?:gid|GID)=(\d+).*$/$1 ($2)/ ) { $NewGroups .= " $ThisLine\n"; } elsif ( (undef,$User,,undef,$Group) = ($ThisLine =~ /(usermod|useradd)(?:\[\d+\])?: add [`']([^ ]+)' to (shadow ?|)group [`']([^ ]+)'/ )) { $AddToGroup{$Group}{$User}++; } elsif ( ($User,undef,$Group) = ($ThisLine =~ /gpasswd: user (.+) added by (.+) to group (.+)/)) { $AddToGroup{$Group}{$User}++; } elsif ( $ThisLine =~ s/^groupadd(?:\[\d+\])?: new group: name=(.+), (?:gid|GID)=(\d+).*$/$1 ($2)/ ) { $NewGroups .= " $ThisLine\n"; } elsif ( $ThisLine =~ s/^gpasswd(?:\[\d+\])?: set members of // ) { $SetGroupMembers .= " $ThisLine\n"; } elsif ( $ThisLine =~ /^(?:userdel|usermod)(?:\[\d+\])?: delete [`'](.*)' from (shadow |)group [`'](.*)'\s*$/ ) { push @RemoveFromGroup, " user $1 from group $3\n"; # This is an inetd lookup... $1 is the service (i.e. ftp), $2 is the response # I don't think these are important to log at this time } elsif ( $ThisLine =~ /^sudo: ([^\s]+) : (command not allowed)?.+ ; COMMAND=(.*)$/ ) { # sudo unauthorized commands push @SudoList, "$1: $3\n" unless ($2 eq ""); } elsif ( $ThisLine =~ /^\/usr\/bin\/sudo: ([^\s]+) : (command not allowed)?.+ ; COMMAND=(.*)$/ ) { # sudo unauthorized commands push @SudoList, "$1: $3\n" unless ($2 eq ""); } elsif ( ($service, $from) = ($ThisLine =~ /^xinetd\[\d+\]: FAIL: (.+) (?:address|libwrap|service_limit|connections per second) from=([\d.]+)/)) { if ($Ignore =~ /\b\Q$service\E\b/i) { next; } $Refused->{$service}->{$from}++; } elsif ( ($from, $service, $user) = ($ThisLine =~ /^pam_abl\[\d+\]: Blocking access from (.+) to service (.+), user (.+)/)) { if ($Detail >= 5) { $Refused->{$service}->{$from."/".$user}++; } else { $Refused->{$service}->{$from}++; } } elsif ( ($User) = ($ThisLine =~ /^chage\[\d+\]: changed password expiry for ([^ ]+)/)) { $PasswordExpiry{$User}++; } elsif ( ($User) = ($ThisLine =~ /^chfn\[\d+\]: changed user `([^ ]+)' information/)) { $UserInfChange{$User}++; } elsif ( (undef) = ($ThisLine =~ /^pam_console\[\d+\]: console file lock already in place ([^ ]+)/ )) { $ConsoleLock++; } elsif ( ($Message) = ($ThisLine =~ /^pam_xauth\[\d+\]: call_xauth: (.+)/)) { $XauthMessage{$Message}++; } elsif ( ($Group,$NewName) = ($ThisLine =~ /^groupmod\[\d+\]: change group `(.*)' to `(.*)'/)) { $GroupRenamed{"$Group -> $NewName"}++; } elsif ( $ThisLine =~ s/^groupmod\[\d+\]: group changed in \/etc\/group \(group (.+)\/(\d+)\).*/$1 ($2)/) { $GroupChanged{"$ThisLine"}++; } elsif ( $ThisLine =~ s/^groupmod\[\d+\]: group changed in \/etc\/group \(group (.+)\/\d+, new name: (.+)\).*/$1 -> $2/) { $GroupChanged{"$ThisLine"}++; } elsif ( ($Pid,$User,$From,$To) = ($ThisLine =~ /^usermod(\[\d+\])?: ?change user [`'](.*)' home from [`'](.*)' to [`'](.*)'/)) { $HomeChange{$User}{"$From -> $To"}++; } elsif ( ($Pid,$User,$From,$To) = ($ThisLine =~ /^usermod(\[\d+\])?: ?change user [`'](.*)' shell from [`'](.*)' to [`'](.*)'/)) { $ShellChange{$User}{"$From -> $To"}++; } elsif ( ($Pid,$User,$From,$To) = ($ThisLine =~ /^usermod(\[\d+\])?: ?change user [`'](.*)' UID from [`'](.*)' to [`'](.*)'/)) { $UidChange{"$User: $From -> $To"}++; } elsif ( ($Pid,$User,$From,$To) = ($ThisLine =~ /^usermod(\[\d+\])?: ?change user [`'](.*)' GID from [`'](.*)' to [`'](.*)'/)) { $GidChange{"$User: $From -> $To"}++; } elsif ( ($Pid,$User,$From,$To) = ($ThisLine =~ /^usermod(\[\d+\])?: ?change user [`'](.*)' expiration from [`'](.*)' to [`'](.*)'/)) { $AccountExpiry{"$User: $From -> $To"}++; # checkpassword-pam } elsif ( ($PID) = ($ThisLine =~ /^checkpassword-pam\[(\d+)\]: Reading username and password/)) { } elsif ( ($PID,$Username) = ($ThisLine =~ /^checkpassword-pam\[(\d+)\]: Username '([^']+)'/)) { $ChkPasswdPam{$PID}{'Username'} = $Username; } elsif ( ($PID) = ($ThisLine =~ /^checkpassword-pam\[(\d+)\]: Password read successfully/)) { } elsif ( ($PID,$Service) = ($ThisLine =~ /^checkpassword-pam\[(\d+)\]: Initializing PAM library using service name '([^']+)'/)) { $ChkPasswdPam{$PID}{'Service'} = $Service; } elsif ( ($PID) = ($ThisLine =~ /^checkpassword-pam\[(\d+)\]: Pam library initialization succeeded/)) { } elsif ( ($PID) = ($ThisLine =~ /^checkpassword-pam\[(\d+)\]: conversation\(\): msg\[0\], style PAM_PROMPT_ECHO_OFF, msg = "Password: "/)) { } elsif ( ($PID) = ($ThisLine =~ /^checkpassword-pam\[(\d+)\]: Authentication passed/)) { $ChkPasswdPam{$PID}{'Success'} = 'true'; } elsif ( ($PID) = ($ThisLine =~ /^checkpassword-pam\[(\d+)\]: Account management succeeded/)) { } elsif ( ($PID) = ($ThisLine =~ /^checkpassword-pam\[(\d+)\]: Setting PAM credentials succeeded/)) { } elsif ( ($PID) = ($ThisLine =~ /^checkpassword-pam\[(\d+)\]: Terminating PAM library/)) { } elsif ( ($PID) = ($ThisLine =~ /^checkpassword-pam\[(\d+)\]: Exiting with status 0/)) { } elsif ( ($User) = ($ThisLine =~ /^pam_tally\[\d+\]: pam_tally: pam_get_uid; no such user ([^ ]+)/)) { $UnknownUser{$User}++; } elsif ( ($User) = ($ThisLine =~ /^pam_tally\[\d+\]: Tally overflowed for user ([^ ]+)$/)) { $TallyOverflow{$User}++; } elsif ( ($User) = ($ThisLine =~ /^pam_pwdfile\[\d+\]: user not found in password database/) ) { $pwd_file_unknown++; } elsif ( ($User) = ($ThisLine =~ /^pam_pwdfile\[\d+\]: wrong password for user ([^ ]+)/)) { $UnknownUser{$User}++; } elsif ($ThisLine =~ /^pam_pwdfile\[\d+\]: password too short or NULL/) { $pwd_file_too_short++; } elsif ( ($User,$Su) = ($ThisLine =~ /^su: ([^ ]+) to ([^ ]+) on \/dev\/ttyp([0-9a-z]+)/) ) { $Su_User{$User}{$Su}++; } elsif ( ($Su,$User) = ($ThisLine =~ /^su: \(to ([^ ]+)\) ([^ ]+) on (?:none|\/dev\/(pts\/|ttyp)([0-9]+))/) ) { $Su_User{$User}{$Su}++; } elsif ( ($Su,$User) = ($ThisLine =~ /^su\[\d+\]: Successful su for (\S+) by (\S+)/) ) { $Su_User{$User}{$Su}++; } elsif ($ThisLine =~ /^userhelper\[\d+\]: running '([^']+)' with ([^']+) privileges on behalf of '([^']+)'/) { $Executed_app{"$1,$2,$3"}++; } elsif ($ThisLine =~ /^polkitd\[\d+\]: Operator of unix-process:\d+:\d+ successfully authenticated as unix-user:([^ ]+) to gain ONE-SHOT authorization for action org\.freedesktop\..* for system-bus-name::[\d.]+ \[([^\]]*)\] \(owned by unix-user:(\w+)\)/) { $Executed_app{"$2,$1,$3"}++; } elsif ( ($User) = $ThisLine =~ /change user [`']([^']+)' password/) { $PwdChange{"$User"}++; } elsif ( ($User) = ($ThisLine =~ /^cvs: password mismatch for ([^']+): ([^']+) vs. ([^']+)/) ){ $cvs_passwd_mismatch{$User}++; } elsif ( ($User,$From,$To) = ($ThisLine =~ /usermod\[[0-9]*\]: change user `([^ ]*)' shell from `([^ ]*)' to `([^ ]*)'/) ) { $ChangedShell{"$User,$From,$To"}++; } elsif ( ($User,$To) = ($ThisLine =~ /chsh\[[0-9]*\]: change user [`']([^ ]*)' shell to [`']([^ ]*)'/) ) { $ChangedShell{"$User,,$To"}++; } elsif ( ($Name1,$Name2) = ($ThisLine =~ /usermod\[[0-9]*\]: change user name `([^ ]*)' to `([^ ]*)'/)) { $ChangedUserName{"$Name1,$Name2"}++; } elsif (($Name,$GID) = ($ThisLine =~ /change GID for `([^ ]*)' to ([0-9]*)/)) { $ChangedGID{"$Name,$GID"}++; } elsif (($Name,$UID1,$UID2) = ($ThisLine =~ /change user `([^ ]*)' UID from `([0-9]*)' to `([^ ]*)'/)) { $ChangedUID{"$Name,$UID1,$UID2"}++; } elsif (($Module,$Service) = ($ThisLine =~ /Deprecated (pam_[^ ]*) module called from service "([^ ]*)"/)) { $DeprecateModule{"$Module,$Service"}++; } elsif ( ($Library) = ($ThisLine =~ /vmware-authd\[\d+\]: PAM unable to dlopen\(([^ ]+)\)/) ) { $MissingLib{"$Library"}++ } elsif ( ($Client,$User) = ($ThisLine =~ /vmware-authd\[\d+\]: login from ([0-9\.]+) as ([^ ]+)/) ) { $UserLogin{$User}++; } elsif ( ($User) = ($ThisLine =~ /vmware-authd\[\d+\]: pam_unix_auth\(vmware-authd:auth\): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= user=([^ ]*)/) ) { } elsif ( ($User) = ($ThisLine =~ /useradd.*failed adding user [`'](.*)',/) ) { # useradd: failed adding user `rpcuser', data deleted # useradd: failed adding user `mysql', exit code: 9 $FailedAddUsers{$User}++; } elsif (($User,$Reason) = ($ThisLine =~ /dovecot-auth: pam_userdb\(dovecot:auth\): user `(.*)' denied access \((.*)\)/)) { # dovecot-auth: pam_userdb(dovecot:auth): user `bobok' denied access (incorrect password) $DeniedAccess{"$User,$Reason"}++; } elsif ($ThisLine =~ /^request-key: Cannot find command to construct key/) { $RequestKeyFailures++; } elsif (my ($type,$from,$response,$client,$service,$e) = ($ThisLine =~ /krb5kdc\[[0-9]*\]: (AS_REQ|TGS_REQ) \([0-9]+ etypes \{[ 0-9]+}\) ([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+): (ISSUE|UNKNOWN_SERVER): authtime [0-9]+, (?:etypes \{rep=[0-9]+ tkt=[0-9]+ ses=[0-9]+},)? ([^ ]+) for ([^ ,]+)(?:, )?(.*)$/)) { if($service=~/^krbtgt\/([^@]+)@\1/) { $service='Login'; } if($response eq 'UNKNOWN_SERVER' && $e eq 'Server not found in Kerberos database') { $response=$e; $e=''; } $KerbList{$response}{$type}{$from}{$service}{$client}{$e}++; } elsif (my ($type,$from,$response,$client,$service,$e) = ($ThisLine =~ /krb5kdc\[[0-9]*\]: (AS_REQ|TGS_REQ) \([0-9]+ etypes \{[ 0-9]+}\) ([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+): (NEEDED_PREAUTH|PREAUTH_FAILED|CLIENT_NOT_FOUND): ([^ ]+) for ([^ ,]+)(?:, )?(.*)$/)) { if($service=~/^krbtgt\/([^@]+)@\1/) { $service='Login'; } if($response eq 'CLIENT_NOT_FOUND' && $e eq 'Client not found in Kerberos database') { $response=$e; $e=''; } elsif($response eq 'NEEDED_PREAUTH' && $e eq 'Additional pre-authentication required') { next unless($Detail > 9||$type ne 'AS_REQ'); $response=$e; $e=''; } $KerbList{$response}{$type}{$from}{$service}{$client}{$e}++; } elsif ($ThisLine =~ /(Rootkit Hunter|rkhunter)(\[\d+\])?:/ ) { if ($ThisLine =~ /Please inspect this machine/) { $RootkitHunter{'inspect'}++; } elsif ($ThisLine =~ /check started/) { $RootkitHunter{'runs'}++; } elsif (my ($mins, $secs) = ($ThisLine =~ /Scanning took ([0-9]*) minutes? and ([0-9]*) seconds?/)) { $RootkitHunter{'time'}+= $mins*60 + $secs; } } elsif ($ThisLine =~ /systemd-logind(?:\[\d+\])?: New session \d+ of user (\w+)\./){ $UserLogin{$1}++; } elsif ($ThisLine =~ /sshguard\[\d+\]: Blocking (.*) for (.*)/) { my ($attacker, $details) = ($1, $2); $sshguardAttackers{$attacker} = $details; } else { # Unmatched entries... $ThisLine =~ s/\[\d+\]:/:/; $OtherList{$ThisLine}++; } } ####################################### if ($NewUsers) { print "New Users:\n$NewUsers\n"; } if ($DeletedUsers) { print "Deleted Users:\n$DeletedUsers\n"; } if (keys %FailedAddUsers) { print "Failed adding users:\n"; foreach $User (keys %FailedAddUsers) { print " $User: ". $FailedAddUsers{$User}. " Time(s)\n"; } print"\n"; } if ($NewGroups) { print "New Groups:\n$NewGroups\n"; } if ($DeletedGroups) { print "Deleted Groups:\n$DeletedGroups\n"; } if (keys %GroupRenamed) { print "Renamed groups:\n"; foreach $Group (sort {$a cmp $b} keys %GroupRenamed) { print " $Group\n"; } } if (keys %GroupChanged) { print "Changed groups:\n"; foreach $Group (sort {$a cmp $b} keys %GroupChanged) { print " $Group\n"; } } if (keys %AddToGroup) { print "\nAdded User to group:\n"; foreach $Group (sort {$a cmp $b} keys %AddToGroup) { print " $Group:\n"; foreach $User (sort {$a cmp $b} keys %{$AddToGroup{$Group}}) { print " $User\n"; } } } if ($SetGroupMembers) { print "Set Members of Group:\n$SetGroupMembers\n"; } if (@RemoveFromGroup) { print "\nRemoved From Group:\n".join('',@RemoveFromGroup)."\n"; } if (keys %HomeChange) { print "\nChanged users home directory:\n"; foreach $User (sort {$a cmp $b} keys %HomeChange) { print " $User:\n"; # No sorting here - show it by time... foreach $Home (keys %{$HomeChange{$User}}) { print " $Home\n"; } } } if (keys %ShellChange) { print "\nChanged shell:\n"; foreach $User (sort {$a cmp $b} keys %ShellChange) { # No sorting here - show it by time... foreach $Shell (keys %{$ShellChange{$User}}) { print " $User: $Shell\n"; } } } if (keys %UidChange) { print "\nChanged users UID:\n"; foreach $Entry (sort {$a cmp $b} keys %UidChange) { print " $Entry\n"; } } if (keys %GidChange) { print "\nChanged users GID:\n"; foreach $Entry (sort {$a cmp $b} keys %GidChange) { print " $Entry\n"; } } if (keys %PwdChange) { print "\nChanged users password:\n"; foreach $Entry (keys %PwdChange) { print " $Entry changed password: $PwdChange{$Entry} Time(s)\n"; } } if (keys %UnknownUser) { print "\nUnknown users:\n"; foreach $User (sort {$a cmp $b} keys %UnknownUser) { print " $User : $UnknownUser{$User} Time(s)\n"; } } if ($pwd_file_unknown > 0) { print "\nUsers unknown in password database (pwd_file): $pwd_file_unknown\n"; } if ($pwd_file_too_short > 0) { print "\nPassword too short or NULL (pwd_file): $pwd_file_too_short Time(s)\n"; } if (keys %{$Connections}) { print "\nConnections:\n"; foreach $ThisOne (keys %{$Connections}) { if ($Summarize =~ /\Q$ThisOne\E/) { print " Service " . $ThisOne . ": " . $Connections->{$ThisOne} . " Connection(s)\n"; } else { my $service_check = 0; if ($ENV{"secure_$ThisOne"}) { $service_check = $ENV{"secure_$ThisOne"}; print " Service " . $ThisOne . " [Connection(s) more than $service_check per day]:\n"; } else { print " Service " . $ThisOne . " [Connection(s) per day]:\n"; } my $Total_Con = 0; foreach $OtherOne (sort SortIP keys %{$Connections->{$ThisOne}}) { $Total_Con = $Total_Con + $Connections->{$ThisOne}->{$OtherOne}; if ( $Connections->{$ThisOne}->{$OtherOne} >= $service_check) { print " " . $OtherOne . ": " . $Connections->{$ThisOne}->{$OtherOne} . " Time(s)\n"; } } print " Total Connections: $Total_Con\n"; } } } if (keys %{$Refused}) { print "\nRefused Connections:\n"; foreach $ThisOne (sort {$a cmp $b} keys %{$Refused}) { print " Service " . $ThisOne . ":\n"; foreach $OtherOne (sort SortIP keys %{$Refused->{$ThisOne}}) { print " " . $OtherOne . ": " . $Refused->{$ThisOne}->{$OtherOne} . " Time(s)\n"; } } } if (keys %{$FailedLogins}) { print "\nFailed logins:\n"; foreach $ThisOne (sort {$a cmp $b} keys %{$FailedLogins}) { print " User " . $ThisOne . ":\n"; foreach $OtherOne (sort {$a cmp $b} keys %{$FailedLogins->{$ThisOne}}) { print " " . $OtherOne . ": " . $FailedLogins->{$ThisOne}->{$OtherOne} . " Time(s)\n"; } } } if (keys %{$FailedSaver}) { print "\nFailed screensaver disable:\n"; foreach $User (sort {$a cmp $b} keys %{$FailedSaver}) { print " User $User on displays:\n"; foreach $Display (sort {$a cmp $b} keys %{$FailedSaver->{$User}}) { print " $Display : " . $FailedSaver->{$User}->{$Display} . " Time(s)\n"; } } } if (keys %DeniedAccess) { print "\ndovecot-auth: Denied access\n"; foreach (keys %DeniedAccess) { ($User,$Reason) = split ","; print " for user " . $User . " (reason: " . $Reason . ") :" . $DeniedAccess{"$User,$Reason"} . " Time(s)\n"; } } if (keys %NoIP) { print "\nCouldn't get client IPs for connections to:\n"; foreach $ThisOne (sort {$a cmp $b} keys %NoIP) { print " $ThisOne: $NoIP{$ThisOne} Time(s)\n"; } } if (keys %NameVerifyFail) { print "\nHostname verification failed:\n"; foreach $Service (sort {$a cmp $b} keys %NameVerifyFail) { print " Service $Service:\n"; foreach my $Namev (sort {$a cmp $b} keys %{$NameVerifyFail{$Service}}) { print " $Namev: $NameVerifyFail{$Service}{$Namev} Time(s)\n"; } } } if (keys %Error) { print "\nErrors:\n"; foreach $Service (sort {$a cmp $b} keys %Error) { print " Service $Service:\n"; foreach $Err (sort {$a cmp $b} keys %{$Error{$Service}}) { print " $Err: $Error{$Service}{$Err} Time(s)\n"; } } } if ($RootLoginTTY) { print "\nRoot logins on ttys: $RootLoginTTY Time(s).\n"; } if ($RootLoginXVC) { print "\nRoot logins on xvcs: $RootLoginXVC Time(s).\n"; } if (keys %UserLogin) { print "\nUser Logins:\n"; foreach $User (sort {$a cmp $b} keys %UserLogin) { print " $User : $UserLogin{$User} Time(s)\n"; } } if (keys %Su_User) { print "\nUsers performing Su Changes:\n"; foreach $User (sort {$a cmp $b} keys %Su_User) { print " $User:\n"; foreach $Su ( keys %{$Su_User{$User}}) { my $val = $Su_User{$User}{$Su}; print " $Su $val time(s)\n"; } } } if ($ConsoleLock > 0) { print "\nConsole file lock already in place: $ConsoleLock Time(s).\n"; } if (keys %AccountExpiry) { print "\nChanged account expiry for users:\n"; foreach $User (sort {$a cmp $b} keys %AccountExpiry) { print " $User : $AccountExpiry{$User} Time(s)\n"; } } if (keys %PasswordExpiry) { print "\nChanged password expiry for users:\n"; foreach $User (sort {$a cmp $b} keys %PasswordExpiry) { print " $User : $PasswordExpiry{$User} Time(s)\n"; } } if (keys %UserInfChange) { print "\nChanged user information:\n"; foreach $User (sort {$a cmp $b} keys %UserInfChange) { print " $User : $UserInfChange{$User} Time(s)\n"; } } if (keys %XauthMessage) { print "\nReported by call_xauth:\n"; foreach $Message (sort {$a cmp $b} keys %XauthMessage) { print " $Message : $XauthMessage{$Message} Time(s)\n"; } } if (keys %PopLogin) { print "\nspop3d user connections:\n"; foreach $PopUser (sort {$a cmp $b} keys %PopLogin) { print " $PopUser\:\t$PopLogin{$PopUser} Time(s)\n"; } } if (keys %PopErrors) { print "\nspop3d connection failures:\n"; foreach $PopErr (sort {$a cmp $b} keys %PopErrors) { print " $PopErr\:\t$PopErrors{$PopErr} Time(s)\n"; } } if ($spop3d_opened > 0) { print "\nspop3d connections(sum):\t".$spop3d_opened."\n"; } if ($spop3d_errors > 0) { print "spop3d connection errors:\t".$spop3d_errors."\n"; } if ($#SudoList >= 0) { print "\nUnauthorized sudo commands attempted (" . ($#SudoList + 1) . "):\n"; print @SudoList; } if (keys %ChkPasswdPam) { print "\ncheckpassword-pam (SUID root PAM client):\n"; foreach $PID (sort {$a cmp $b} keys %ChkPasswdPam) { $ServiceUsernamePair = $ChkPasswdPam{$PID}{'Username'}.' => '.$ChkPasswdPam{$PID}{'Service'}; if ($ChkPasswdPam{$PID}{'Success'} eq 'true') { $Successes{$ServiceUsernamePair}++; } else { $Failures{$ServiceUsernamePair}++; } } foreach $ServiceUsernamePair (sort {$a cmp $b} keys %Successes) { $S = $Successes{$ServiceUsernamePair} ? $Successes{$ServiceUsernamePair} : 0; $F = $Failures{$ServiceUsernamePair} ? $Failures{$ServiceUsernamePair} : 0; print " $ServiceUsernamePair : $S success(es), $F failure(s)\n"; } } if (keys %TallyOverflow) { print "\nTally overflowed for user:\n"; foreach $User (sort {$a cmp $b} keys %TallyOverflow) { print " $User : $TallyOverflow{$User} Time(s)\n"; } } if (keys %Executed_app) { print "\nUserhelper executed applications:\n"; foreach (keys %Executed_app) { ($longapp,$asuser,$user) = split ","; $longapp_orig = $longapp; $i = index($longapp, " "); if ($i > 0) { $longapp = substr($longapp, 0, $i); } $app = substr($longapp,rindex($longapp,"/")+1); print " $user -> $app as $asuser: ".$Executed_app{"$longapp_orig,$asuser,$user"}." Time(s)\n"; } } if (keys %ChangedUserName) { print "\nChanged users names:\n"; foreach (keys %ChangedUserName) { ($Name1,$Name2) = split ","; print " User " . $Name1 . " change name to " . $Name2 . $ChangedUserName . "\n"; } } if (keys %ChangedUID) { print "\nChanged UID:\n"; foreach (keys %ChangedUID) { ($Name,$UID1,$UID2) = split ","; print " User " . $Name . " changed UID from " . $UID1 . " to " . $UID2 . "\n"; } } if (keys %ChangedShell) { print "\nChanged users default login shell: \n"; foreach (keys %ChangedShell) { ($User,$From,$To) = split ","; if ($From ne '') { print " User " . $User . " change shell from " . $From . " to " . $To . ": " . $ChangedShell{"$User,$From,$To"} . " Time(s)\n"; } else { print " User " . $User . " change shell to " . $To . ": " . $ChangedShell{"$User,$From,$To"} . " Time(s)\n"; } } } if (keys %ChangedGID) { print "\nChanged GID:\n"; foreach (keys %ChangedGID) { ($Name,$GID) = split ","; print " Group " . $Name . " change GID to " . $GID . "\n"; } } if (keys %cvs_passwd_mismatch) { print "\ncvs:"; print "\n Authentication Failures:\n"; foreach $User (keys %cvs_passwd_mismatch) { print " $User : $cvs_passwd_mismatch{$User} Time(s)\n"; } } if (keys %DeprecateModule){ print "\nDeprecated pam module:\n"; foreach (keys %DeprecateModule) { ($Module,$Service) = split ","; print " deprecated module $Module called from service $Service: " . $DeprecateModule{"$Module,$Service"} . " Time(s)\n"; } } if ($RequestKeyFailures) { print "\nRequest Key Failures (nfs-utils/kernel mismatch): $RequestKeyFailures Time(s)\n"; } if (keys %KerbList) { print "\nKerberos Entries:\n"; foreach my $response (sort {$a cmp $b} keys %KerbList) { print " $response:\n"; foreach my $type (sort {$a cmp $b} keys %{$KerbList{$response}}) { print " $type:\n"; foreach my $from (sort {$a cmp $b} keys %{$KerbList{$response}{$type}}) { print " $from:\n"; foreach my $service (sort {$a cmp $b} keys %{$KerbList{$response}{$type}{$from}}) { print " $service:\n"; foreach my $client (sort {$a cmp $b} keys %{$KerbList{$response}{$type}{$from}{$service}}) { if(scalar(keys %{$KerbList{$response}{$type}{$from}{$service}{$client}})==1&&defined($KerbList{$response}{$type}{$from}{$service}{$client}{''})){ print " $client: $KerbList{$response}{$type}{$from}{$service}{$client}{''} Time(s)\n"; }else{ print " $client:\n"; foreach my $e (sort {$a cmp $b} keys %{$KerbList{$response}{$type}{$from}{$service}{$client}}) { print " $e: $KerbList{$response}{$type}{$from}{$service}{$client}{$e} Time(s)\n"; } } } } } } } } if (keys %RootkitHunter) { use integer; my ($mins, $secs) = ($RootkitHunter{'time'} / 60, $RootkitHunter{'time'} % 60); $RootkitHunter{'inspect'} = 0 unless $RootkitHunter{'inspect'}; print "\nRootkitHunter:\n"; print " Runs: $RootkitHunter{'runs'}\n"; print " Suggested Inspection: $RootkitHunter{'inspect'} Time(s)\n"; print " Total Runtime: $mins minute(s) $secs second(s)\n"; } if (keys %sshguardAttackers) { print "\nSSHGuard blocked:\n"; foreach $attacker (sort {$a cmp $b} keys %sshguardAttackers) { my $details = $sshguardAttackers{$attacker}; print " $attacker: $details\n"; } } if (keys %OtherList) { print "\n**Unmatched Entries**\n"; foreach $line (sort {$a cmp $b} keys %OtherList) { print " $line: $OtherList{$line} Time(s)\n"; } } if (keys %MissingLib) { print "\n Missing libraries:\n"; foreach $Lib (keys %MissingLib) { print " $Lib : $MissingLib{$Lib} Time(s)\n"; } } exit(0); # vi: shiftwidth=3 tabstop=3 syntax=perl et # Local Variables: # mode: perl # perl-indent-level: 3 # indent-tabs-mode: nil # End: