|
logcheck runs as the logcheck user:
# grep logcheck /etc/passwd
logcheck:*:915:915:Logcheck system account:/var/db/logcheck:/usr/local/bin/bash
This user is created by the install process. I'm assuming you have the ports
tree intact.
cd /usr/ports/security/logcheck
make install clean
If the cd fails, you need to do this first because you probably don't have a
ports tree checked out:
portsnap fetch && portsnap extract
If you do not alter the permission and update some configuration files, you'll
soon get one of these emails:
To: root@ngaio.example.org
Subject: Logcheck: ngaio.example.org 2009-11-20 12:02 exiting due to errors
Message-Id: <20091120120201.7ACFF17104@ngaio.example.org>
Date: Fri, 20 Nov 2009 12:02:01 +0000 (GMT)
From: logcheck@ngaio.example.org (Logcheck system account)
Warning: If you are seeing this message, your log files may not have been
checked!
Details:
Could not run logtail or save output
Check temporary directory: /tmp/logcheck.ZOjfJO
Also verify that the logcheck user can read all files referenced in
/etc/logcheck/logcheck.logfiles!
declare -x HOME="/var/db/logcheck"
declare -x LOGNAME="logcheck"
declare -x MAILTO="root"
declare -x OLDPWD
declare -x PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin"
declare -x PWD="/var/db/logcheck"
declare -x SHELL="/bin/sh"
declare -x SHLVL="1"
declare -x USER="logcheck"
The email contains the wrong location for the file. It is assuming an
installation location which has been changed at configuration/install time
and /usr/local/sbin/logcheck has not been refreshed accordingly.
I have submitted a patch for that.
Check the permissions for the files listed in
/usr/local/etc/logcheck/logcheck.logfiles:
# ls -l /var/log/messages /var/log/auth.log /var/log/maillog
-rw------- 1 root wheel 6564 Nov 28 21:13 /var/log/auth.log
-rw-r----- 1 root wheel 60 Nov 28 00:00 /var/log/maillog
-rw-r--r-- 1 root wheel 83127 Nov 28 22:00 /var/log/messages
As you can see, the logcheck user will be unable to read auth.log and maillog.
We can change that.
# chgrp logcheck /var/log/auth.log /var/log/maillog
# chmod g+r /var/log/auth.log
# ls -l /var/log/messages /var/log/auth.log /var/log/maillog
-rw-r----- 1 root logcheck 6564 Nov 28 21:13 /var/log/auth.log
-rw-r----- 1 root logcheck 60 Nov 28 00:00 /var/log/maillog
-rw-r--r-- 1 root wheel 83277 Nov 28 22:05 /var/log/messages
logcheck will now be able to read the files, but as you know, these files are
rotated by newsyslog.conf. So let's see the entries for them:
# egrep "/var/log/auth.log|/var/log/maillog" /etc/newsyslog.conf
/var/log/auth.log 600 7 100 * JC
/var/log/maillog 640 7 * @T00 JC
The above is before my changes, the following is after:
# egrep "/var/log/auth.log|/var/log/maillog" /etc/newsyslog.conf
/var/log/auth.log root:logcheck 640 7 100 * JC
/var/log/maillog root:logcheck 640 7 * @T00 JC
Note that you have to add the root:logcheck to both *and* change the mode
for auth.log to 640.
| 