diff options
| author | Guilhem Moulin <guilhem@fripost.org> | 2014-03-13 16:43:50 +0100 |
|---|---|---|
| committer | Guilhem Moulin <guilhem@fripost.org> | 2015-06-07 02:51:43 +0200 |
| commit | d72d516f2647a3e03b5e11d891c6ec4e9ddcf9cf (patch) | |
| tree | 3d8e0f75a74d710aa1f0d84ce27daea302acb6e1 /roles/common/files/etc/logcheck/violations.ignore.d/logcheck-sudo | |
| parent | 984708466b7c368e98a8b51c00acff5e6b870bd2 (diff) | |
Make use of Ansible 1.5 new features.
Most notably pipelining=True and sysctl_set=yes.
Diffstat (limited to 'roles/common/files/etc/logcheck/violations.ignore.d/logcheck-sudo')
| -rw-r--r-- | roles/common/files/etc/logcheck/violations.ignore.d/logcheck-sudo | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/roles/common/files/etc/logcheck/violations.ignore.d/logcheck-sudo b/roles/common/files/etc/logcheck/violations.ignore.d/logcheck-sudo new file mode 100644 index 0000000..e474019 --- /dev/null +++ b/roles/common/files/etc/logcheck/violations.ignore.d/logcheck-sudo @@ -0,0 +1,7 @@ +^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sudo: pam_krb5\(sudo:auth\): user [[:alnum:]-]+ authenticated as [[:alnum:]-]+@[.A-Z]+$ +# ignore sudo with custom ENV +#^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sudo:[[:space:]]+[_[:alnum:].-]+ : TTY=(unknown|console|(pts/|tty|vc/)[[:digit:]]+) ; PWD=[^;]+ ; USER=[._[:alnum:]-]+ ; COMMAND=((/(usr|etc|bin|sbin)/|sudoedit ).*|list)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sudo:[[:space:]]+[_[:alnum:].-]+ : TTY=(unknown|console|(pts/|tty|vc/)[[:digit:]]+) ; PWD=[^;]+ ; USER=[._[:alnum:]-]+ (; ENV=([_a-zA-Z]+=\S* )+)?; COMMAND=((/(usr|etc|bin|sbin)/|sudoedit ).*|list)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sudo:[[:space:]]+[_[:alnum:].-]+ : \(command continued\).*$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sudo: pam_[[:alnum:]]+\(sudo:session\): session opened for user [[:alnum:]-]+ by ([[:alnum:]-]+)?\(uid=[0-9]+\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sudo: pam_[[:alnum:]]+\(sudo:session\): session closed for user [[:alnum:]-]+$ |