fix(logcheck): updated patch for ubuntu-24.04 and debian-12

files/patch-logcheck-replace3

@@ -0,0 +1,36 @@
+--- logcheck.orig	2024-11-17 17:26:14.789270872 +0000
++++ logcheck	2024-12-06 13:00:42.045819802 +0000
+@@ -92,6 +92,7 @@
+ SORTUNIQ=0
+ SUPPORT_CRACKING_IGNORE=0
+ SYSLOGSUMMARY=0
++LINES=10000
+ LOCKDIR=/run/lock/logcheck
+ LOCKFILE="$LOCKDIR/logcheck"
+
+@@ -335,6 +336,15 @@
+ 																 --file -
+ 						return $?
+ 				else
++						outlines="$(wc -l "$TMPDIR/report" | awk '{ print $1 }')"
++						if [ "$LINES" -gt "0" ] && [ "${outlines:=0}" -gt "$LINES" ]; then
++								{
++										printf "Log output has been truncated in this mail\\n"
++										printf "Output is %d lines, truncated to %d.\\n" "$outlines" "$LINES"
++										head -n "$LINES" "$TMPDIR/report"
++								} > "$TMPDIR/report2"
++								mv "$TMPDIR/report2" "$TMPDIR/report"
++						fi
+ 						mime-construct "${MIMECONSTRUCTARGS[@]}" --subject "$subject" --to "$SENDMAILTO" "${ENCODING[@]}" \
+ 													 --file "$TMPDIR/report"
+ 				fi
+@@ -780,7 +790,8 @@
+ # First sort the logs to remove duplicate lines (including from different logfiles with
+ # the same lines) to reduce CPU and memory usage.
+ debug "Sorting logs"
+-$SORT "$TMPDIR/logoutput"/* | sed -e 's/[[:space:]]\+$//' > "$TMPDIR/logoutput-sorted" \
++$SORT "$TMPDIR/logoutput"/* | sed -e 's/[[:space:]]\+$//' \
++		| sed -f /etc/logcheck/logcheck.replace > "$TMPDIR/logoutput-sorted" \
+ 		|| error "Could not save sorted log content to $TMPDIR/logoutput-sorted"
+ debug "After sorting, we have the following log entries to check" "$TMPDIR/logoutput-sorted"
+

vars/Debian-12.yml

@@ -83,7 +83,7 @@ harden_sshd_crypto_mac: 'hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh
 
 sshd_validate: 'sshd -f %s -T -C user=nobody -C host=localhost -C addr=localhost'
 
-harden_logcheck_patch: patch-logcheck-replace2
+harden_logcheck_patch: patch-logcheck-replace3
 
 aptconf_unattended: /etc/apt/apt.conf.d/50unattended-upgrades
 monitrc: /etc/monit/monitrc

vars/Ubuntu-24.04.yml

@@ -79,7 +79,7 @@ harden_sshd_crypto_cipher: 'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
 harden_sshd_crypto_mac: 'hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com'
 sshd_validate: 'sshd -f %s -T -C user=nobody -C host=localhost -C addr=localhost'
 
-harden_logcheck_patch: patch-logcheck-replace2
+harden_logcheck_patch: patch-logcheck-replace3
 
 monitrc: /etc/monit/monitrc
 monit_confdir: /etc/monit/conf-available