if there is an issue with configuration -- please open a new bug
report...
in a wheezy chroot installed pure-ftpd... trying to login and getting:
following log changes
==> syslog <==
Jun 21 10:40:05 novo pure-ftpd: (?@localhost) [INFO] New connection from
localhost
Jun 21 10:40:05 novo pure-ftpd: (?@localhost) [INFO] PAM_RHOST enabled. Getting
the peer address
==> auth.log <==
Jun 21 10:40:05 novo pure-ftpd: pam_unix(pure-ftpd:auth): check pass; user
unknown
Jun 21 10:40:05 novo pure-ftpd: pam_unix(pure-ftpd:auth): authentication
failure; logname= uid=0 euid=0 tty=pure-ftpd ruser=anonymous rhost=localhost
==> syslog <==
Jun 21 10:40:13 novo pure-ftpd: (?@localhost) [WARNING] Authentication failed
for user [anonymous]
Jun 21 10:40:13 novo pure-ftpd: (?@localhost) [INFO] Logout.
and indeed current pure-ftpd filter (upstream master) is
[Definition]
# Error message specified in multiple languages
__errmsg = (?:Authentication failed for user|Erreur d'authentification pour
l'utilisateur)
#
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values: TEXT
#
failregex = pure-ftpd(?:\[\d+\])?: \(.+?@<HOST>\) \[WARNING\] %(__errmsg)s
\[.+\]\s*$
so syslog would be the appropriate one to monitor while failures in auth.log
could be picked up with pam-generic
I fixed it up in git, so will be there with next upload (some time soon)
On Fri, 21 Jun 2013, Laurent Léonard wrote:
> Hi,
> The log path should be "/var/log/syslog" instead of "/var/log/auth.log".
> Thank you,
--
Yaroslav O. Halchenko, Ph.D.
http://neuro.debian.net http://www.pymvpa.org http://www.fail2ban.org
Senior Research Associate, Psychological and Brain Sciences Dept.
Dartmouth College, 419 Moore Hall, Hinman Box 6207, Hanover, NH 03755
Phone: +1 (603) 646-9834 Fax: +1 (603) 646-1419
WWW: http://www.linkedin.com/in/yarik
--
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]
