Protecting custom rules from upgrades?

Jeff · Post by **Jeff** » 30 Jul 2008, 23:06

Hi,
Really love these programs! But I've needed to customize regex.pm to match my errors messages and also to cover a few other programs. It would be great if there was a method to add new regex patterns and protect them from being over-written during upgrades.

As another example, my smtpauth listens on 25 and 587, so I have to edit within lfd.pl to change this. This should be controlled in a conf file, not within the code itself, don't you think? At least, in this case, it would protect it during upgrades.

Ideally, I'd like to see a way to add in a new parameters for monitoring other daemons. Could this be done using an "include" directory for new LF_* parameters and regex patterns, and then have csf.conf & lfd.pl source the new directory for configuration parameters?

For example, I use lfd to monitor Postfix since I have seen clients who are in an RBL but connect over and over again. I use lfd to monitor this and block connections. The easiest way was to call this "smtpauth", even though it isn't. I'd prefer to have a new service and a new LF_ entry for this. I can edit lfd.pl to do this, but of course I'll lose it as soon as the next version appears.

Jeff

Post by **chirpy** » 01 Aug 2008, 16:12

I'll add the idea of custom login failure entries to the dev list.

Jeff · Post by **Jeff** » 10 Apr 2009, 22:27

I see this is now included as a possible regex.custom.pm. However, I can't find any docs on how this file is to be formatted... the readme says to check the file, but there isn't one. So... how should new rules be added to regex.custom.pm?

Post by **chirpy** » 15 Apr 2009, 09:53

regex.custom.pm is fully documented.

Jeff · Post by **Jeff** » 15 Apr 2009, 17:01

chirpy wrote:regex.custom.pm is fully documented.

Um, where? The readme says "see regex.custom.pm for details", but there is no regex.custom.pm. BUT, this just occurred to me: probably it's not included when I run "csf -u" to protect it from being overwritten, right? Maybe that's why I don't have the file.

Post by **chirpy** » 25 Apr 2009, 10:26

If /etc/csf/regex.custom.pm is empty then either remove it and reinstall csf or look in the file in the installation tarball.