diff mbox series

[bug#62802,4/4] services: syslog: Log auth.info to /var/log/secure in default configuration.

Message ID 20230413012408.2759-4-maxim.cournoyer@gmail.com
State New
Headers show
Series Add reload action to syslog service. | expand

Commit Message

Maxim Cournoyer April 13, 2023, 1:24 a.m. UTC 
This causes authentication failures such as those generated by SSH brute force
attacks to appear in /var/log/secure, which is picked up by tools such as
fail2ban.

* gnu/services/base.scm (%default-syslog.conf): Add a auth.info selector for
the /var/log/secure log.

---

 gnu/services/base.scm | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Comments

Ludovic Courtès April 20, 2023, 3:26 p.m. UTC | #1 
Maxim Cournoyer <maxim.cournoyer@gmail.com> skribis:

> This causes authentication failures such as those generated by SSH brute force
> attacks to appear in /var/log/secure, which is picked up by tools such as
> fail2ban.

Nice, go for it!

Ludo’.
Maxim Cournoyer April 21, 2023, 1:36 p.m. UTC | #2 
Hello,

Ludovic Courtès <ludo@gnu.org> writes:

> Maxim Cournoyer <maxim.cournoyer@gmail.com> skribis:
>
>> This causes authentication failures such as those generated by SSH brute force
>> attacks to appear in /var/log/secure, which is picked up by tools such as
>> fail2ban.
>
> Nice, go for it!

Great, the change is now installed.  Thanks for the review!
diff mbox series

Patch

diff --git a/gnu/services/base.scm b/gnu/services/base.scm
index 0cde151e1a..282d36c8b1 100644
--- a/gnu/services/base.scm
+++ b/gnu/services/base.scm
@@ -1515,7 +1515,9 @@  (define %default-syslog.conf
 
 # The authpriv file has restricted access.
 # 'fsync' the file after each line (hence the lack of a leading dash).
-authpriv.*                              /var/log/secure
+# Also include unprivileged auth logs of info or higher level
+# to conveniently gather the authentication data at the same place.
+authpriv.*;auth.info                    /var/log/secure
 
 # Log all the mail messages in one place.
 mail.*                                 -/var/log/maillog