group.of.nepali.translators team mailing list archive

[Launchpad Bug Tracker <1904362@xxxxxxxxxxxxxxxxxx>]

This bug was fixed in the package logwatch - 7.5.4-0ubuntu3.2

---------------
logwatch (7.5.4-0ubuntu3.2) groovy; urgency=medium

  * d/p/allow-disabling-lookup.patch: Allow skipping ip lookup
    (LP: #1904362)

 -- Bryce Harrington <bryce@xxxxxxxxxxxxx>  Thu, 01 Jul 2021 03:44:20
+0000

** Changed in: logwatch (Ubuntu Groovy)
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1904362

Title:
  [Wishlist] Disable hostname lookup by default for logwatch service
  sshd

Status in logwatch package in Ubuntu:
  Fix Released
Status in logwatch source package in Xenial:
  Won't Fix
Status in logwatch source package in Bionic:
  Fix Committed
Status in logwatch source package in Focal:
  Fix Committed
Status in logwatch source package in Groovy:
  Fix Released
Status in logwatch source package in Hirsute:
  Fix Released
Status in logwatch source package in Impish:
  Fix Released

Bug description:
  [Impact]
  Logwatch looks up hostnames of every reported IP address, which
  increases runtime (and thus increases power and network bandwidth usage)
  especially for high-traffic servers.

  Secondly, the resultant URLs included in Logwatch's report emails can
  trigger spam filters.

  This change adds an option to turn off ip lookup.

  [Test Case]
  1. Log into an lxc container running groovy or earlier
  2. Install logwatch
     $ sudo debconf-set-selections <<< "postfix postfix/mailname string test.hostname.com"
     $ sudo debconf-set-selections <<< "postfix postfix/main_mailer_type string 'Local only'"
     $ sudo apt-get install -y msmtp msmtp-mta logwatch
  3. Force an initial logrotation
     $ sudo /usr/sbin/logrotate -vf /etc/logrotate.conf
  4. Run logwatch manually
     $ sudo logwatch --detail Med --service sshd --range "between

  On a system with sshd exposed to the internet that has been up for some
  time, this may take a considerable amount of time to run

  [Where Problems Could Occur]
  Since logwatch filters logs for errors pertinent to administrators,
  standard things to watch out for are undesired changes in this filtering
  behavior, such as flagging or failing to flag issues differently than
  before, other than the specific messages being filtered with this
  change.  This specific change deals with how IP addresses are translated into hostnames, so particular issues to watch for would be any logic dependent on having textual addresses rather than numerical ones.

  [Original Report]

  By default, logwatch performs a hostname lookup of every IP address
  reported in SSHD logs. This has two negative consequences:

  1. If there are lots of IP addresses to lookup, this increases the run time of logwatch significantly.
  2. If logwatch is set to email logs, some spam filters detect the hostnames as URLs and will flag the email as spam due to the apparently large number of links. See https://serverfault.com/questions/977628/logwatch-emails-marked-as-spam-how-to-stop-reverse-dns-on-bot-hosts/1042679 .

  Following a request for help to disable hostname lookups in sshd...
  https://sourceforge.net/p/logwatch/discussion/1115929/thread/952d84109c/
  a developer committed a change to support this feature...
  https://sourceforge.net/p/logwatch/git/ci/88c0d675f10e425faeddd23316c061f425f39a06/

  This wishlist has two requests:
  1. Backport the patch (which is very easy to apply) to logwatch packages in currently supported LTS versions of Ubuntu. The patch defaults to performing the IP lookup, so this would not change the behavior of any existing installations, but it would expose the ability to disable these lookups if needed.
  2. For future Ubuntu distributions, set the config to disable SSHD IP lookups by default. This could be accomplished by introducing /usr/share/logwatch/dist.conf/services/sshd.conf with contents:
  $sshd_ip_lookup = No

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/logwatch/+bug/1904362/+subscriptions