#129 dovecot 2.4: handle changed log format for aborted logins

[Martijn Pieters]

Dovecot 2.4 changed the log format for aborted authentication attempts, from

dovecot[123]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 7 secs): user=<user>, method=PLAIN, rip=1.2.3.4, lip=1.2.3.9, TLS: Connection closed, session=<xxxx></xxxx></user>

to

dovecot[123]: imap-login: Login aborted: Connection closed (auth failed, 1 attempts in 7 secs): user=<user>, method=PLAIN, rip=1.2.3.4, lip=1.2.3.9, TLS: Connection closed, session=<xxxx></xxxx></user>

Please support this change.

[Martijn Pieters]

I think the following changes should suffice:

diff --git a/logwatch/scripts/services/dovecot b/logwatch/scripts/services/dovecot
index 5683be70..af8527ad 100755
--- a/logwatch/scripts/services/dovecot
+++ b/logwatch/scripts/services/dovecot
@@ -194,7 +194,7 @@ while (defined(my $ThisLine = <STDIN>)) {
       ($ThisLine =~ /ssl-params: Generating SSL parameters/) or
       ($ThisLine =~ /auth-worker/) or
       ($ThisLine =~ /auth:.*: Connected to/) or

-      ($ThisLine =~ /Disconnected: Connection closed(?! \(auth failed)/) or
+      ($ThisLine =~ /(Disconnected|Login aborted): Connection closed(?! \(auth failed)/) or
       ($ThisLine =~ /Info: Connection closed/) or
       ($ThisLine =~ /IMAP.*: Connection closed bytes/) or
       ($ThisLine =~ /IMAP.* failed with mbox file/) or
@@ -282,9 +282,11 @@ while (defined(my $ThisLine = <STDIN>)) {
    #
    # imap-login:
    #   dovecot[123]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 7 secs): user=<user>, method=PLAIN, rip=1.2.3.4, lip=1.2.3.9, TLS: Connection closed, session=<xxxx>
+   #   dovecot[123]: imap-login: Login aborted: Connection closed (auth failed, 1 attempts in 7 secs): user=<user>, method=PLAIN, rip=1.2.3.4, lip=1.2.3.9, TLS: Connection closed, session=<xxxx>
    #
    # imap-login aborted:
    #   dovecot[123]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 2 secs): user=<info>, method=PLAIN, rip=1.2.3.4, lip=1.2.3.9, TLS, session=<xxxx>
+   #   dovecot[123]: imap-login: Login aborted: Aborted login by logging out (auth failed, 1 attempts in 2 secs): user=<info>, method=PLAIN, rip=1.2.3.4, lip=1.2.3.9, TLS, session=<xxxx>
    #
    } elsif (($User,$IP) = ( $ThisLine =~ /auth: (?:pam|passwd-file)\(([^,]+),([^,\)]+).*\): unknown user/ ) ) {
       $UnknownUsers{$User}{$IP}++;
@@ -293,7 +295,7 @@ while (defined(my $ThisLine = <STDIN>)) {
    } elsif ( ($Host) = ($ThisLine =~ /Login aborted:.*no_auth_attempts.*rip=([^,]+).*/) ) {
       $Host = hostName($Host);
       $Aborted{$Host}++;
-   } elsif ( ($User, $IP) = ($ThisLine =~ /Disconnected: .* \(auth failed, .*\): user=<([^>]+)>,.*rip=([^,]+).*/) ) {
+   } elsif ( ($User, $IP) = ($ThisLine =~ /(Disconnected|Login aborted): .* \(auth failed, .*\): user=<([^>]+)>,.*rip=([^,]+).*/) ) {
       $AuthFail{$User}{$IP}++;
         if ( ($Host) = ($ThisLine =~ /Aborted login.* rip=([0-9\.]+|[a-fA-F:0-9]+)/) ) {
           $Host = hostName($Host);

[Bjorn]

Thanks for the changes.

[Sven Strickroth]

There are also other changes, please see: https://sourceforge.net/p/logwatch/git/merge-requests/90/

[Bjorn]

Can you re-submit the merge request with the new base? Your previous patch was already saved to the repository. So your working dovecot file should be the correct version, with the additional changes.

[Bjorn]

Now I see that both change requests might have overlapped. So maybe submit it as a patch file from the prior dovecot or, even better, as either a patch file or a merge request from the current repository's version.

[Frank Crawford]

Folks, I've picked up items from both of these requests and pushed an update to dovecot for them.

Please check if they address all the issues.