Questions[logwatch](ubuntu)

How do I find specific lines in Log Files that are referenced by Ubuntu Logwatch like the ones marked below... within Amavis and postfix?

Going by date I can grep all the instances of "warning" or any other words (which I have been doing), but there must be a better way to identify those specific lines without guessing.

Is there a way to make the Watchlog logfile quote the exact line from the actual system logfile below the warning or state log line number?

How do you digest your Logwatch log file?

**text of the actual line** marks those lines, it seems within a codeblock there is now way to turn things Bold (at least I couldn't find it)

################### Logwatch 7.4.3 (12/07/16) #################### 
        Processing Initiated: Tue Sep 22 06:25:23 2020
        Date Range Processed: yesterday
                              ( 2020-Sep-21 )
                              Period is day.
        Detail Level of Output: 0
        Type of Output/Format: mail / text
        Logfiles for Host: mail
 ################################################################## 
 
 --------------------- Amavisd-new Begin ------------------------ 

      **1   *Warning: Security risk**
      **4   Miscellaneous warnings**
 
        9   Total messages scanned ------------------  100.00%
  212.600K  Total bytes scanned                        217,702
    ...
 
 ---------------------- Amavisd-new End ------------------------- 
    ...
 --------------------- Postfix Begin ------------------------ 

        2   SASL authentication failed                       2
      **1   Miscellaneous warnings                           1**
 
  363.644K  Bytes accepted                             372,371
    ...
 
 ---------------------- Postfix End ------------------------- 
 
 ###################### Logwatch End ######################### 

The error message says to check:

See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html for more details.

But I'm not 100% sure how to fix it.

I looked in /etc/default/intel-microcode and found this:

# Configuration script for intel-microcode version 3

#
# initramfs helper
#

# Set this to "no" to disable automatic microcode updates on boot;
# Set this to "auto" to use early initramfs mode automatically (default);
# Set this to "early" to always attempt to create an early initramfs;
# IUCODE_TOOL_INITRAMFS=auto

# Set this to "yes" (default) to use "iucode_tool --scan-system" to reduce
# the initramfs size bloat, by detecting which Intel processors are active
# in this system, and installing only their microcodes.
#
# Set this to "no" to either include all microcodes, or only the microcodes
# selected through the use of IUCODE_TOOL_EXTRA_OPTIONS below.
#
# WARNING: including all microcodes will increase initramfs size greatly.
# This can cause boot issues if the initramfs is already large.
# IUCODE_TOOL_SCANCPUS=yes

# Extra options to pass to iucode_tool, useful to forbid or to
# force the inclusion of microcode for specific processor signatures.
# See iucode_tool(8) for details.
#IUCODE_TOOL_EXTRA_OPTIONS=""

which I changed to this:

# Configuration script for intel-microcode version 3

#
# initramfs helper
#

# Set this to "no" to disable automatic microcode updates on boot;
# Set this to "auto" to use early initramfs mode automatically (default);
# Set this to "early" to always attempt to create an early initramfs;
IUCODE_TOOL_INITRAMFS=auto

# Set this to "yes" (default) to use "iucode_tool --scan-system" to reduce
# the initramfs size bloat, by detecting which Intel processors are active
# in this system, and installing only their microcodes.
#
# Set this to "no" to either include all microcodes, or only the microcodes
# selected through the use of IUCODE_TOOL_EXTRA_OPTIONS below.
#
# WARNING: including all microcodes will increase initramfs size greatly.
# This can cause boot issues if the initramfs is already large.
IUCODE_TOOL_SCANCPUS=yes

# Extra options to pass to iucode_tool, useful to forbid or to
# force the inclusion of microcode for specific processor signatures.
# See iucode_tool(8) for details.
#IUCODE_TOOL_EXTRA_OPTIONS=""

Previously, I turned off hyper threading in the BIOS and I also changed the settings in /etc/default/grub to this:

GRUB_CMDLINE_LINUX_DEFAULT="quiet splash maxcpus=6"

As, I have six physical CPUs on my machine.

Ubuntu 18.04 LTS provides the versions shown below of logwatch, postfix, and postfix-policyd-spf-python. This particular release of logwatch is old, and does not correctly process some of the messages produced by postfix-policyd-spf-python. As a result, reports from logwatch are noisy with false alerts. The current release of logwatch from upstream (7.5.2) contains code which handles the messages involved.

A simple workaround is to extract the .../scripts/services/postfix file and install it under /etc/logwatch, but the reason for using a package manager is precisely to avoid having to make this kind of intervention.

How should this version incompatibility best be escalated to the Ubuntu LTS maintenance (or release engineering) team?

$ apt list -a postfix logwatch postfix-policyd-spf-python
Listing... Done
logwatch/bionic-updates,bionic-updates,now 7.4.3+git20161207-2ubuntu1.1 all [installed]
logwatch/bionic,bionic 7.4.3+git20161207-2ubuntu1 all

postfix/bionic-updates,now 3.3.0-1ubuntu0.2 amd64 [installed]
postfix/bionic 3.3.0-1 amd64

postfix-policyd-spf-python/bionic,bionic,now 2.0.2-1 all [installed]

$ 

Logwatch shows

A total of 13 possible successful probes were detected (the following URLs
 contain strings that match one or more of a listing of strings that
 indicate a possible exploit):

    /wp-content/themes/NativeChurch/download/download.php?file=../../../../wp-config.php HTTP Response 301 
....

I enter

find / -name "NativeChurch"

I get zero results.

I enter

find / -name "wp-config.php"

I get two results.

/var/www/vhosts/result1/httpdocs/wp-config.php
/var/www/vhosts/result2/httpdocs/wp-config.php

I enter

cd /var/www/vhosts/result1/httpdocs
cd wp-content/themes/NativeChurch

I get

No such file or directory

I enter

cd /var/www/vhosts/result2/httpdocs
cd wp-content/themes/NativeChurch

I get

No such file or directory

Why can I not find the file? The server is the right one. The logwatch is current.

EDIT:

find / -name NativeChurch -type d

I get zero results.

I got fail2ban and logwatch running on my server. Each day I have a few IP:s that's been probing my server and also a few "Attempts to use known hacks", as it states in the daily mail.

I would like to block these IP:s using the knowledge of logwatch, since it apparently knows what "known hacks" are. By looking trough the apache access logs I don't quite understand what logwatch refers to.

As I said, fail2ban is installed and uses UFW as block action. Is there somehow possible to block these IP:s that are recognized by logwatch? fail2ban doesn't seem to block them.

Thanks, Daniel