From 2c1e17071d8cb16d5eb44962a5b6565451b8cc34 Mon Sep 17 00:00:00 2001 From: Maxim Cournoyer Date: Wed, 12 Apr 2023 20:52:39 -0400 Subject: services: syslog: Log auth.info to /var/log/secure in default configuration. This causes authentication failures such as those generated by SSH brute force attacks to appear in /var/log/secure, which is picked up by tools such as fail2ban. * gnu/services/base.scm (%default-syslog.conf): Add a auth.info selector for the /var/log/secure log. Series-to: 62802@debbugs.gnu.org --- gnu/services/base.scm | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'gnu/services') diff --git a/gnu/services/base.scm b/gnu/services/base.scm index 669027f6d1..75d4e7b741 100644 --- a/gnu/services/base.scm +++ b/gnu/services/base.scm @@ -1521,7 +1521,9 @@ Service Switch}, for an example." # The authpriv file has restricted access. # 'fsync' the file after each line (hence the lack of a leading dash). -authpriv.* /var/log/secure +# Also include unprivileged auth logs of info or higher level +# to conveniently gather the authentication data at the same place. +authpriv.*;auth.info /var/log/secure # Log all the mail messages in one place. mail.* -/var/log/maillog -- cgit 1.4.1