Handle sshd auto/spew from Buster

Author: quentinmit

ansible/files/scripts-syslog.conf

@@ -31,6 +31,10 @@ ruleset(name="zroot" queue.type="Direct") {
   then {
     call zpublic
   }
+
+  if ($programname == 'audit') then stop
+  if ($programname == 'systemd-logind') then stop
+
   # TODO: Look up ssh keys and annotate with whose key it is
   # Publicly log all root sessions, except cron or sudo
   if (re_match($msg, '^ pam_unix\\([^:]+:session\\): session \\S+ for user root')) then {
@@ -62,7 +66,8 @@ ruleset(name="zroot" queue.type="Direct") {
     if ($msg startswith ' Close session: ') then stop
     if (re_match($msg, '^ Connection from \\S+ port \\S+')) then stop
     if ($msg startswith ' Invalid user') then stop
-    if ($msg startswith ' Disconnecting invalid user') then stop
+    if ($msg startswith ' Did not receive identification string') then stop
+    if ($msg startswith ' Disconnecting') then stop
     if ($msg startswith ' input_userauth_request: invalid user') then stop
     if ($msg startswith ' userauth_hostbased mismatch: ') then stop
     if ($msg startswith ' Received disconnect from ') then stop
@@ -71,9 +76,7 @@ ruleset(name="zroot" queue.type="Direct") {
     if ($msg startswith ' Postponed gssapi-with-mic for ') then stop
     if ($msg startswith ' Failed keyboard-interactive/pam') then stop
     if ($msg startswith ' fatal: Read from socket failed: Connection reset by peer') then stop
-    if ($msg startswith ' error: kex_exchange_identification: read: Connection reset by peer') then stop
-    if ($msg startswith ' error: kex_exchange_identification: read: Connection closed by remote host') then stop
-    if ($msg startswith ' error: kex_exchange_identification: Connection closed by remote host') then stop
+    if ($msg startswith ' error: kex_exchange_identification: ') then stop
     if ($msg startswith ' Connection reset by ') then stop
     if ($msg startswith ' reverse mapping checking getaddrinfo') then stop
     if ($msg startswith ' pam_succeed_if(sshd:auth):') then stop
@@ -109,6 +112,8 @@ ruleset(name="zroot" queue.type="Direct") {
 if \
   $syslogseverity <= '4' \
   or \
+  $syslogfacility-text == 'auth' \
+  or \
   $syslogfacility-text == 'authpriv' \
   or \
   ($syslogfacility-text == 'kern' and ($msg contains 'Out of memory:' or $msg contains 'Killed process')) \