[Logwatch] logwatch 2.6: patch to "secure" script

Jay Berkenbilt ejb@ql.org
Sun, 14 Jul 2002 13:42:28 -0400


Attached is a patch to correct a small bug in the "secure" script.
This same bug may exist in other scripts as well; I haven't checked.
The problem is that the $ignore_services variable is converted to
lower-case but the lines that are matched against it are not.  The
result is that it is impossible to ignore a service that logs its name
in mixed case.  The fix is trivial: do a case-insensitive match
between $ignore_services and the log entry's service name.

--
Jay Berkenbilt <ejb@ql.org>
http://www.ql.org/q/



---------------------------------------------------------------------------

--- scripts/services/secure.qdist	Mon Apr 15 17:21:54 2002
+++ scripts/services/secure	Sun Jul 14 12:48:48 2002
@@ -85,7 +85,7 @@
    my $temp = $ThisLine;
    $temp =~ s/^([^[]+).*/$1/;
    #print "Ignore: $Ignore [temp: $temp]\n";
-   if ($Ignore =~ /$temp/) { 
+   if ($Ignore =~ /$temp/i) { 
       next;
    }
    if ( ($Host,$User) = ($ThisLine =~ /^login: FAILED LOGIN \d+ FROM ([^ ]+) FOR ([^,]+),/ ) ) {