Ubuntu
logwatch package

[Wishlist] Disable hostname lookup by default for logwatch service sshd

Bug #1904362 reported by Matthew D. Mower on 2020-11-16

This bug affects 2 people

	Status	Importance	Assigned to
logwatch (Ubuntu)	Fix Released	Wishlist	Unassigned
Xenial	Won't Fix	Wishlist	Unassigned
Bionic	Fix Released	Wishlist	Unassigned
Focal	Fix Released	Wishlist	Unassigned
Groovy	Fix Released	Wishlist	Unassigned
Hirsute	Fix Released	Wishlist	Unassigned
Impish	Fix Released	Wishlist	Unassigned

Bug Description

[Impact]
Logwatch looks up hostnames of every reported IP address, which
increases runtime (and thus increases power and network bandwidth usage)
especially for high-traffic servers.

Secondly, the resultant URLs included in Logwatch's report emails can
trigger spam filters.

This change adds an option to turn off ip lookup.

[Test Case]
1. Log into an lxc container running groovy or earlier
2. Install logwatch
   $ sudo debconf-set-selections <<< "postfix postfix/mailname string test.hostname.com"
   $ sudo debconf-set-selections <<< "postfix postfix/main_mailer_type string 'Local only'"
   $ sudo apt-get install -y msmtp msmtp-mta logwatch
3. Force an initial logrotation
   $ sudo /usr/sbin/logrotate -vf /etc/logrotate.conf
4. Run logwatch manually
   $ sudo logwatch --detail Med --service sshd --range "between

On a system with sshd exposed to the internet that has been up for some
time, this may take a considerable amount of time to run

[Where Problems Could Occur]
Since logwatch filters logs for errors pertinent to administrators,
standard things to watch out for are undesired changes in this filtering
behavior, such as flagging or failing to flag issues differently than
before, other than the specific messages being filtered with this
change. This specific change deals with how IP addresses are translated into hostnames, so particular issues to watch for would be any logic dependent on having textual addresses rather than numerical ones.

[Original Report]

By default, logwatch performs a hostname lookup of every IP address reported in SSHD logs. This has two negative consequences:

1. If there are lots of IP addresses to lookup, this increases the run time of logwatch significantly.
2. If logwatch is set to email logs, some spam filters detect the hostnames as URLs and will flag the email as spam due to the apparently large number of links. See https://serverfault.com/questions/977628/logwatch-emails-marked-as-spam-how-to-stop-reverse-dns-on-bot-hosts/1042679 .

Following a request for help to disable hostname lookups in sshd...
https://sourceforge.net/p/logwatch/discussion/1115929/thread/952d84109c/
a developer committed a change to support this feature...
https://sourceforge.net/p/logwatch/git/ci/88c0d675f10e425faeddd23316c061f425f39a06/

This wishlist has two requests:
1. Backport the patch (which is very easy to apply) to logwatch packages in currently supported LTS versions of Ubuntu. The patch defaults to performing the IP lookup, so this would not change the behavior of any existing installations, but it would expose the ability to disable these lookups if needed.
2. For future Ubuntu distributions, set the config to disable SSHD IP lookups by default. This could be accomplished by introducing /usr/share/logwatch/dist.conf/services/sshd.conf with contents:
$sshd_ip_lookup = No

See original description

Tags:

Related branches

~bryce/ubuntu/+source/logwatch:sru-lp1904362-groovy

Merged into ubuntu/+source/logwatch:ubuntu/groovy-devel at revision 19c3fadbbb510897e1548770fc0e064eaec15226

Christian Ehrhardt  (community): Approve on 2021-07-02

Canonical Server: Pending requested 2021-07-01

~bryce/ubuntu/+source/logwatch:sru-lp1904362-bionic

Merged into ubuntu/+source/logwatch:ubuntu/bionic-devel at revision cfb75adb06a80a71c8d240e6d82d4f8bde3ef583

Christian Ehrhardt  (community): Approve on 2021-07-02

Canonical Server: Pending requested 2021-07-01

~bryce/ubuntu/+source/logwatch:ubuntu/focal-devel

Merged into ubuntu/+source/logwatch:ubuntu/focal-devel at revision e12240b91bd2e349edaa2a297691575b2e1d2941

Christian Ehrhardt  (community): Approve on 2021-07-02

Canonical Server: Pending requested 2021-07-01

Matthew D. Mower (mdmower) on 2020-11-16

description:

updated

Revision history for this message

Lucas Kanashiro (lucaskanashiro) wrote on 2020-11-17:

Hi Matthew,

First thank you for taking the time to file this bug and try to make Ubuntu better.

The upstream patch you provided is straightforward. I am tagging this bug as server-next to put it in our team's queue of work to be done.

tags:	added: server-next
Changed in logwatch (Ubuntu):
status:	New → Triaged

Bryce Harrington (bryce) on 2021-03-26

Changed in logwatch (Ubuntu):
importance:	Undecided → Wishlist
Changed in logwatch (Ubuntu Xenial):
status:	New → Triaged
Changed in logwatch (Ubuntu Bionic):
status:	New → Triaged
Changed in logwatch (Ubuntu Focal):
status:	New → Triaged
Changed in logwatch (Ubuntu Groovy):
status:	New → Triaged
importance:	Undecided → Wishlist
Changed in logwatch (Ubuntu Focal):
importance:	Undecided → Wishlist
Changed in logwatch (Ubuntu Bionic):
importance:	Undecided → Wishlist
Changed in logwatch (Ubuntu Xenial):
importance:	Undecided → Wishlist

Bryce Harrington (bryce) on 2021-03-27

Changed in logwatch (Ubuntu Hirsute):
status:	Triaged → Fix Released

Revision history for this message

Bryce Harrington (bryce) wrote on 2021-07-01:

Xenial has passed its end of standard support

Changed in logwatch (Ubuntu Xenial):
status:	Triaged → Won't Fix

Bryce Harrington (bryce) on 2021-07-01

description:

updated

Revision history for this message

Christian Ehrhardt  (paelzer) wrote on 2021-07-02 (last edit on 2021-07-02):

- (removed my comment that was not meant to be on the bug but the MRs) -

Bryce Harrington (bryce) on 2021-07-02

description:

updated

Revision history for this message

Brian Murray (brian-murray) wrote on 2021-07-06: Please test proposed package

Hello Matthew, or anyone else affected,

Accepted logwatch into groovy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/logwatch/7.5.4-0ubuntu3.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-groovy to verification-done-groovy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-groovy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in logwatch (Ubuntu Groovy):
status:	Triaged → Fix Committed
tags:	added: verification-needed verification-needed-groovy
Changed in logwatch (Ubuntu Focal):
status:	Triaged → Fix Committed
tags:	added: verification-needed-focal

Revision history for this message

Brian Murray (brian-murray) wrote on 2021-07-06:

Hello Matthew, or anyone else affected,

Accepted logwatch into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/logwatch/7.5.2-1ubuntu1.3 in a few hours, and then in the -proposed repository.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in logwatch (Ubuntu Bionic):
status:	Triaged → Fix Committed
tags:	added: verification-needed-bionic

Revision history for this message

Brian Murray (brian-murray) wrote on 2021-07-06:

Hello Matthew, or anyone else affected,

Accepted logwatch into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/logwatch/7.4.3+git20161207-2ubuntu1.4 in a few hours, and then in the -proposed repository.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Revision history for this message

Matthew D. Mower (mdmower) wrote on 2021-07-07:

@brian-murray - I performed the following test.

System info:
$ uname -a
Linux linodeusw01 5.4.0-74-generic #83-Ubuntu SMP Sat May 8 02:35:39 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 20.04.2 LTS
Release: 20.04
Codename: focal

Package update:
$ wget https://launchpad.net/ubuntu/+source/logwatch/7.5.2-1ubuntu1.3/+build/21758051/+files/logwatch_7.5.2-1ubuntu1.3_all.deb
$ sudo dpkg -i logwatch_7.5.2-1ubuntu1.3_all.deb

Testing:
1) Removed my custom config /etc/logwatch/conf/services/sshd.conf and script /etc/logwatch/scripts/services/sshd
2) Ran logwatch and inspected section "Illegal users from:" within " --------------------- SSHD Begin ------------------------"
  Sample line:
  27.151.56.7 (7.56.151.27.broad.fz.fj.dynamic.163data.com.cn): 5 Times
3) Created /etc/logwatch/conf/services/sshd.conf with contents:
  # Set to No to disable IP lookups
  $sshd_ip_lookup = No
4) Ran logwatch and inspected section "Illegal users from:" within " --------------------- SSHD Begin ------------------------"
  Sample line:
  27.151.56.7: 5 Times

Results:
This patch is working as expected on focal.

tags:

added: verification-done-focal
removed: verification-needed-focal

Revision history for this message

Utkarsh Gupta (utkarsh) wrote on 2021-07-16:

Hello,

In a Groovy LXD container, I repro'd the bug & then installed 7.5.4-0ubuntu3.2 and found out that the fix works as expected.

Similarly, in a Bionic LXD container, I repro'd the bug and installed 7.4.3+git20161207-2ubuntu1.4 and verified that the fix works as expected.

Thank you!

tags:

added: verification-done verification-done-bionic verification-done-groovy
removed: verification-needed verification-needed-bionic verification-needed-groovy

Revision history for this message

Launchpad Janitor (janitor) wrote on 2021-07-19:

This bug was fixed in the package logwatch - 7.5.4-0ubuntu3.2

---------------
logwatch (7.5.4-0ubuntu3.2) groovy; urgency=medium

* d/p/allow-disabling-lookup.patch: Allow skipping ip lookup
(LP: #1904362)

-- Bryce Harrington <email address hidden> Thu, 01 Jul 2021 03:44:20 +0000

Changed in logwatch (Ubuntu Groovy):
status:	Fix Committed → Fix Released

Revision history for this message

Brian Murray (brian-murray) wrote on 2021-07-19: Update Released

#10

The verification of the Stable Release Update for logwatch has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message

Launchpad Janitor (janitor) wrote on 2021-07-20:

#11

This bug was fixed in the package logwatch - 7.5.2-1ubuntu1.3

---------------
logwatch (7.5.2-1ubuntu1.3) focal; urgency=medium

* d/p/allow-disabling-lookup.patch: Allow skipping ip lookup
(LP: #1904362)

-- Bryce Harrington <email address hidden> Thu, 01 Jul 2021 03:44:37 +0000

Changed in logwatch (Ubuntu Focal):
status:	Fix Committed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2021-07-20:

#12

This bug was fixed in the package logwatch - 7.4.3+git20161207-2ubuntu1.4

---------------
logwatch (7.4.3+git20161207-2ubuntu1.4) bionic; urgency=medium

* d/p/allow-disabling-lookup.patch: Allow skipping ip lookup
(LP: #1904362)

-- Bryce Harrington <email address hidden> Thu, 01 Jul 2021 03:13:23 +0000

Changed in logwatch (Ubuntu Bionic):
status:	Fix Committed → Fix Released

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

Ubuntulogwatch package

[Wishlist] Disable hostname lookup by default for logwatch service sshd

Bug Description

Related branches

Other bug subscribers

Remote bug watches

Ubuntu
logwatch package