Merge ~bryce/ubuntu/+source/logwatch:fix-unmatched-entries-bionic into ubuntu/+source/logwatch:ubuntu/bionic-devel

[Bryce Harrington]

This is a bionic SRU for most of the patches landed in groovy's logwatch. This omits several changes, including an update to upstream's homepage in d/control (it's not user-visible), and omission of patches for unmatched entries in exim4, pam_unix, and gnome-keyring since the issues in those packages that cause the error messages do not exist in bionic.

PPA: https://launchpad.net/~bryce/+archive/ubuntu/logwatch-unmatched-entries

There is not an autopkgtest for logwatch (yet), but the directions for testing each of the SRU bugs is detailed on the corresponding bug report, and mainly just involves catting the log entries to the appropriate system log, running logwatch, and verifying the entries are no longer marked unmatched.

[Sergio Durigan Junior (sergiodj)]

I will review this one.

[Sergio Durigan Junior (sergiodj)]

Christian told me he will review this one, since he's already reviewing the focal one.

[Bryce Harrington (bryce)]

I've updated this with the review comments from the focal MP, and also added a couple patches for server-next bugs against logwatch. Both of these additional patches are backports already included in the groovy version.

[Christian Ehrhardt  (paelzer)]

As on F-MP, please add some Origin/Forwared (most likely an explicit "no - ubuntu only" given the patch name) to the new ZFS patch

Patch 18 on Focal got:
Origin: vendor, https://sourceforge.net/p/logwatch/git/ci/c827d09423489fcdd840c670528a05573bd90278/
Here it is still missing that info.

review: Needs Fixing

[Bryce Harrington (bryce)]

I've updated patch 0010 with the DEP3.

Note there is also a patch from an old SRU by Karl included, that I forgot to mention. The DEP3 for it looks reasonably complete, and part of it's SRU already landed but worth doublechecking.

[Christian Ehrhardt  (paelzer)]

10 and the fix of Karl LGTM now.
Thanks!

review: Approve

[Bryce Harrington (bryce)]

Thanks, pushed and uploaded to proposed.

diff --git a/debian/changelog b/debian/changelog
index a565b3a..4c1d72e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,36 @@
+logwatch (7.4.3+git20161207-2ubuntu1.2) bionic; urgency=medium
+
+  [ Bryce Harrington ]
+  * d/p/0020-dhcpd-Ignore-lease-age-under-threshold-messages.patch:
+    dhcpd: Ignore lease age under threshold messages
+    (LP: #1578001)
+  * d/p/0018-audit-Treat-Denial-Errors-same-as-Denied.patch:
+    audit: Treat Denial-Errors same as Denied.
+    (LP: #1577948)
+  * d/p/0017-audit-Apparmor-DENIED-entries-don-t-always-include-p.patch:
+    audit: Apparmor DENIED entries don't always include parent=N.
+    (LP: #1577948)
+  * d/p/0014-zz-sys-Suppress-warnings-if-Sys-CPU-or-Sys-MemInfo-a.patch:
+    zz-sys: Suppress warnings if Sys::CPU or Sys::MemInfo are missing.
+    These are not installed by default in Ubuntu's logwatch packaging.
+    (LP: #1890749)
+  * d/p/0012-postfix-Handle-backwards-compatible-mode.patch:
+    postfix: Handle backwards-compatible mode.
+    (LP: #1583705)
+  * d/p/0011-postfix-Ignore-Resolved-loghost-to-127.0.0.1.patch:
+    postfix: Ignore Resolved loghost to 127.0.0.1.
+    (LP: #1583705)
+  * d/p/0010-00-debspecific-disable-su-reporting-in-secure.diff.patch:
+    Use $PATH to determine location of zpool and zfs.
+    (LP: #1880211)
+
+  [ Karl Stenerud ]
+  * d/p/ssh-ignore-disconnected.patch:
+    sshd: ignore disconnected from user USER
+    (LP: #1644057)
+
+ -- Bryce Harrington <[e-mail]>  Thu, 03 Sep 2020 04:21:53 +0000
+
 logwatch (7.4.3+git20161207-2ubuntu1.1) bionic; urgency=medium
 
   * Add d/patches/ignore-ras-correctable-errors.patch to fix false
diff --git a/debian/patches/0010-00-debspecific-disable-su-reporting-in-secure.diff.patch b/debian/patches/0010-00-debspecific-disable-su-reporting-in-secure.diff.patch
new file mode 100644
index 0000000..0afcc6d
--- /dev/null
+++ b/debian/patches/0010-00-debspecific-disable-su-reporting-in-secure.diff.patch
@@ -0,0 +1,34 @@
+From 01136a8b3e14a58660db6cc39138d3e40a852737 Mon Sep 17 00:00:00 2001
+From: bjorn <[e-mail]>
+Date: Sat, 6 Jun 2020 18:03:32 -0700
+Subject: [PATCH] [zz-zfs] Use $PATH to determine location of zpool and zfs. 
+ Reported by          Paride Legovini, and previously by Stephen Sewell.
+
+Signed-off-by: Bryce Harrington <[e-mail]>
+---
+ scripts/services/zz-zfs | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+Origin: upstream, https://sourceforge.net/p/logwatch/git/ci/01136a8b3e14a58660db6cc39138d3e40a852737
+Bug: https://sourceforge.net/p/logwatch/bugs/83
+Ubuntu-Bug: https://bugs.launchpad.net/ubuntu/+source/logwatch/+bug/1880211
+Last-Updated: 2020-09-08
+
+diff --git a/scripts/services/zz-zfs b/scripts/services/zz-zfs
+index 2234403..95eff2c 100644
+--- a/scripts/services/zz-zfs
++++ b/scripts/services/zz-zfs
+@@ -52,8 +52,8 @@ if ($ENV{'LOGWATCH_ONLY_HOSTNAME'} && ($logwatch_hostname ne $host)) {
+   exit 0;
+ }
+ 
+-my $pathto_zpool = $ENV{'pathto_zpool'} || '/usr/sbin/zpool';
+-my $pathto_zfs   = $ENV{'pathto_zfs'}   || '/usr/sbin/zfs';
++my $pathto_zpool = $ENV{'pathto_zpool'} || 'zpool';
++my $pathto_zfs   = $ENV{'pathto_zfs'}   || 'zfs';
+ my $summary_only = $ENV{'summary_only'} || ($detail < 5);
+ my $detail_only  = $ENV{'detail_only'}  || 0;
+ 
+-- 
+2.25.1
+
diff --git a/debian/patches/0011-postfix-Ignore-Resolved-loghost-to-127.0.0.1.patch b/debian/patches/0011-postfix-Ignore-Resolved-loghost-to-127.0.0.1.patch
new file mode 100644
index 0000000..3060a0b
--- /dev/null
+++ b/debian/patches/0011-postfix-Ignore-Resolved-loghost-to-127.0.0.1.patch
@@ -0,0 +1,42 @@
+From 6373191438fb8f4699aaeb8c53aaf7abcd4d8999 Mon Sep 17 00:00:00 2001
+From: Bryce Harrington <[e-mail]>
+Date: Wed, 19 Aug 2020 03:29:42 +0000
+Subject: [PATCH 01/10] postfix: Ignore Resolved loghost to 127.0.0.1
+
+Ref: https://bugs.launchpad.net/ubuntu/+source/logwatch/+bug/1583705
+Signed-off-by: Bryce Harrington <[e-mail]>
+---
+ scripts/services/postfix | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+Origin: vendor
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/logwatch/+bug/1583705
+Forwarded: https://sourceforge.net/p/logwatch/git/merge-requests/46/
+Last-Updated: 2020-08-20
+
+diff --git a/scripts/services/postfix b/scripts/services/postfix
+index b5cb2ec..6550e3d 100644
+--- a/scripts/services/postfix
++++ b/scripts/services/postfix
+@@ -2286,7 +2286,7 @@ sub postfix_postgrey($) {
+       #TDpg unrecognized request type: ''
+       #TDpg rm /var/spool/postfix/postgrey/log.0000000002
+       #TDpg 2007/01/25-14:48:00 Pid_file already exists for running process (4775)... aborting    at line 232 in file /usr/lib/perl5/vendor_perl/5.8.7/Net/Server.pm
+-
++      #TDpg Resolved [localhost]:10023 to [127.0.0.1]:10023, IPv4
+ 
+       $line =~ /^cleaning / or
+       $line =~ /^delayed / or
+@@ -2301,7 +2301,8 @@ sub postfix_postgrey($) {
+       # unanchored last
+       $line =~ /Pid_file already exists/ or
+       $line =~ /postgrey .* starting!/ or
+-      $line =~ /Server closing!/
++      $line =~ /Server closing!/ or
++      $line =~ /Resolved .*localhost.*IPv4/
+    );
+ 
+    my ($action,$reason,$delay,$host,$ip,$sender,$recip);
+-- 
+2.27.0
+
diff --git a/debian/patches/0012-postfix-Handle-backwards-compatible-mode.patch b/debian/patches/0012-postfix-Handle-backwards-compatible-mode.patch
new file mode 100644
index 0000000..f4261e3
--- /dev/null
+++ b/debian/patches/0012-postfix-Handle-backwards-compatible-mode.patch
@@ -0,0 +1,74 @@
+From 44848e3237ddbdc593a938b543f897117049bb36 Mon Sep 17 00:00:00 2001
+From: Bryce Harrington <[e-mail]>
+Date: Wed, 19 Aug 2020 04:01:24 +0000
+Subject: [PATCH 02/10] postfix: Handle backwards-compatible mode
+
+Fixes: https://bugs.launchpad.net/ubuntu/+source/logwatch/+bug/1583705
+Signed-off-by: Bryce Harrington <[e-mail]>
+---
+ scripts/services/postfix | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+Origin: vendor
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/logwatch/+bug/1583705
+Forwarded: https://sourceforge.net/p/logwatch/git/merge-requests/46/
+Last-Updated: 2020-08-20
+
+diff --git a/scripts/services/postfix b/scripts/services/postfix
+index 6550e3d..253401c 100644
+--- a/scripts/services/postfix
++++ b/scripts/services/postfix
+@@ -2609,6 +2609,7 @@ sub postfix_fatal;
+ sub postfix_error;
+ sub postfix_warning;
+ sub postfix_script;
++sub backwards_compatible;
+ sub postfix_postsuper;
+ sub process_delivery_attempt;
+ sub cleanhostreply;
+@@ -2815,6 +2816,9 @@ sys     0m3.005s
+    if ($p1 =~ /^panic: +(.*)$/)             { postfix_panic($1);   next; }
+    if ($p1 =~ /^error: +(.*)$/)             { postfix_error($1);   next; }
+ 
++   # Backwards compatibility mode
++   if ($p1 =~ /compati/i)                   { backwards_compatible($p1); next; }    # backwards-compatible default settings
++
+    # output by all services that use table lookups - process before specific messages
+    if ($p1 =~ /(?:lookup )?table (?:[^ ]+ )?has changed -- (?:restarting|exiting)$/) {
+       #TD table hash:/var/mailman/data/virtual-mailman(0,lock|fold_fix) has changed -- restarting
+@@ -4806,6 +4810,22 @@ sub postfix_script($) {
+    }
+ }
+ 
++# Handles postfix backwards compatibility mode lines
++#
++sub backwards_compatible($) {
++    my $line = shift;
++
++    if ($line =~ /^Postfix is running with backwards-compatible default settings/o) {
++	$Totals{'backwardscompatible'}++;
++    }
++    elsif ($line =~ /^See http.*COMPATIBILITY_README.html for details/o) {
++	$Totals{'backwardscompatible'}++;
++    }
++    elsif ($line =~ /^To disable backwards compatibility use.*/o) {
++	$Totals{'backwardscompatible'}++;
++    }
++}
++
+ # Clean up a server's reply, to give some uniformity to reports
+ #
+ sub cleanhostreply($ $ $ $) {
+@@ -5213,6 +5233,9 @@ sub build_sect_table() {
+    add_section ($S, 'postfixwaiting',              0, 'd', 'Postfix waiting to terminate');
+    end_section_group ($S, 'postfixstate');
+ 
++   begin_section_group ($S, 'backwardscompatible', "\n");
++   add_section ($S, 'backwardscompatible',         1, 'd', 'Running in backwards compatibile mode');
++   end_section_group ($S, 'backwardscompatible');
+ 
+    if ($Opts{'debug'} & Logreporters::D_SECT) {
+       print "\tSection table\n";
+-- 
+2.27.0
+
diff --git a/debian/patches/0014-zz-sys-Suppress-warnings-if-Sys-CPU-or-Sys-MemInfo-a.patch b/debian/patches/0014-zz-sys-Suppress-warnings-if-Sys-CPU-or-Sys-MemInfo-a.patch
new file mode 100644
index 0000000..67ebf81
--- /dev/null
+++ b/debian/patches/0014-zz-sys-Suppress-warnings-if-Sys-CPU-or-Sys-MemInfo-a.patch
@@ -0,0 +1,52 @@
+From 488a232634c1d383f4ec356d776b4ee292e48b0a Mon Sep 17 00:00:00 2001
+From: Bryce Harrington <[e-mail]>
+Date: Wed, 19 Aug 2020 04:39:22 +0000
+Subject: [PATCH 04/10] zz-sys: Suppress warnings if Sys::CPU or Sys::MemInfo
+ are missing
+
+Neither of these perl modules are installed by default with a logwatch
+installation, by intention, so the missing module warnings are
+inappropriate.  These modules only provide a minor amount of detail when
+installed, and their information is volatile which can trigger false
+test failures in some cases.
+
+Fixes: https://bugs.launchpad.net/ubuntu/+source/logwatch/+bug/1890749
+Signed-off-by: Bryce Harrington <[e-mail]>
+---
+ scripts/services/zz-sys | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+Origin: vendor
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/logwatch/+bug/1890749
+Forwarded: no
+Last-Updated: 2020-08-20
+
+diff --git a/scripts/services/zz-sys b/scripts/services/zz-sys
+index 39f94ce..6bbf3fe 100644
+--- a/scripts/services/zz-sys
++++ b/scripts/services/zz-sys
+@@ -35,8 +35,8 @@
+ 
+ eval "require Sys::CPU";
+ if ($@) {
+-   print STDERR "No Sys::CPU module installed.  To install, execute the command:\n";
+-   print STDERR "   perl -MCPAN -e 'install Sys::CPU' \n\n";
++   # Sys::CPU (and Sys::MemInfo) are intentionally not installed on Ubuntu.
++   # Silently skip this if not present.
+ } else {
+    import Sys::CPU;
+    print "   CPU:     " . Sys::CPU::cpu_count() . " " . Sys::CPU::cpu_type() . " at " . Sys::CPU::cpu_clock() . "MHz\n";
+@@ -52,8 +52,8 @@ print "   Release: $OStitle $release\n";
+ 
+ eval "require Sys::MemInfo";
+ if ($@) {
+-   print STDERR "No Sys::MemInfo module installed.  To install, execute the command:\n";
+-   print STDERR "   perl -MCPAN -e 'install Sys::MemInfo' \n\n";
++   # Sys::CPU (and Sys::MemInfo) are intentionally not installed on Ubuntu.
++   # Silently skip this if not present.
+ } else {
+    import Sys::MemInfo qw(totalmem freemem totalswap freeswap);
+    my $swapused = &totalswap - &freeswap;
+-- 
+2.27.0
+
diff --git a/debian/patches/0017-audit-Apparmor-DENIED-entries-don-t-always-include-p.patch b/debian/patches/0017-audit-Apparmor-DENIED-entries-don-t-always-include-p.patch
new file mode 100644
index 0000000..cacf79e
--- /dev/null
+++ b/debian/patches/0017-audit-Apparmor-DENIED-entries-don-t-always-include-p.patch
@@ -0,0 +1,28 @@
+From: Bryce Harrington <[e-mail]>
+Date: Thu, 20 Aug 2020 04:56:08 +0000
+Subject: [PATCH 07/10] audit: Apparmor DENIED entries don't always include
+ parent=N
+
+Ref: https://bugs.launchpad.net/ubuntu/+source/logwatch/+bug/1577948
+Signed-off-by: Bryce Harrington <[e-mail]>
+---
+ scripts/services/audit | 1 +
+ 1 file changed, 1 insertion(+)
+
+Origin: vendor
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/logwatch/+bug/1577948
+Forwarded: https://sourceforge.net/p/logwatch/git/merge-requests/46/
+Last-Updated: 2020-08-20
+
+diff --git a/scripts/services/audit b/scripts/services/audit
+index b12f710..46e300e 100644
+--- a/scripts/services/audit
++++ b/scripts/services/audit
+@@ -134,6 +134,7 @@ while ($ThisLine = <STDIN>) {
+         } elsif ( $ThisLine =~ /apparmor="DENIED" operation="([^"]+)" parent=\d+ profile="([^"]+)" name="([^"]+)" pid=\d+ comm="([^"]+)"/ ) {
+             # type=1400 audit(1314853822.672:33649): apparmor="DENIED" operation="mknod" parent=27250 profile="/usr/lib/apache2/mpm-prefork/apache2//example.com" name="/usr/share/wordpress/1114140474e5f13bea68a4.tmp" pid=27289 comm="apache2" requested_mask="c" denied_mask="c" fsuid=33 ouid=33
+             # type=1400 audit(1315353795.331:33657): apparmor="DENIED" operation="exec" parent=14952 profile="/usr/lib/apache2/mpm-prefork/apache2//example.com" name="/usr/lib/sm.bin/sendmail" pid=14953 comm="sh" requested_mask="x" denied_mask="x" fsuid=33 ouid=0
++            # type=1400 audit(1597683992.796:8057): apparmor="DENIED" operation="exec" profile="/usr/bin/evince" name="/usr/lib/uim/uim-helper-server" pid=1687330 comm="evince" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0: 1 Time(s)
+             $denials{$1.' '.$3.' ('.$2.' via '.$4 . ')'}++;
+         } elsif ( $ThisLine =~ /apparmor="ALLOWED" operation="([^"]+)" (info="([^"]+)" )?(error=[+-]?\d+ )?(parent=\d+ )?profile="([^"]+)" (name="([^"]+)" )?pid=\d+ comm="([^"]+)"/ ) {
+             # type=1400 audit(1369519203.141:259049): apparmor="ALLOWED" operation="exec" parent=3733 profile="/usr/sbin/dovecot//null-1c//null-1d" name="/usr/lib/dovecot/pop3-login" pid=24634 comm="dovecot" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 target="/usr/sbin/dovecot//null-1c//null-1d//null-d12"
diff --git a/debian/patches/0018-audit-Treat-Denial-Errors-same-as-Denied.patch b/debian/patches/0018-audit-Treat-Denial-Errors-same-as-Denied.patch
new file mode 100644
index 0000000..1d322d2
--- /dev/null
+++ b/debian/patches/0018-audit-Treat-Denial-Errors-same-as-Denied.patch
@@ -0,0 +1,28 @@
+From: Bryce Harrington <[e-mail]>
+Date: Tue, 25 Aug 2020 18:02:43 -0300
+Subject: audit: Treat Denial Errors same as Denied
+
+Ubuntu Security says, "I think this would be more useful as DENIED, as
+that's how we discuss these line events elsewhere."
+---
+ scripts/services/audit | 3 +++
+ 1 file changed, 3 insertions(+)
+
+Origin: vendor, https://sourceforge.net/p/logwatch/git/ci/c827d09423489fcdd840c670528a05573bd90278/
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/logwatch/+bug/1577948
+Last-Updated: 2020-08-25
+
+diff --git a/scripts/services/audit b/scripts/services/audit
+index 46e300e..a590c5e 100644
+--- a/scripts/services/audit
++++ b/scripts/services/audit
+@@ -136,6 +136,9 @@ while ($ThisLine = <STDIN>) {
+             # type=1400 audit(1315353795.331:33657): apparmor="DENIED" operation="exec" parent=14952 profile="/usr/lib/apache2/mpm-prefork/apache2//example.com" name="/usr/lib/sm.bin/sendmail" pid=14953 comm="sh" requested_mask="x" denied_mask="x" fsuid=33 ouid=0
+             # type=1400 audit(1597683992.796:8057): apparmor="DENIED" operation="exec" profile="/usr/bin/evince" name="/usr/lib/uim/uim-helper-server" pid=1687330 comm="evince" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0: 1 Time(s)
+             $denials{$1.' '.$3.' ('.$2.' via '.$4 . ')'}++;
++        } elsif ( $ThisLine =~ /apparmor="DENIED" operation="([^"]+)" info="([^"]+)" error=-*[0-9]+ profile="([^"]+)" name="([^"]+)" pid=\d+ comm="([^"]+)"/ ) {
++            # type=1400 audit(1597690743.153:8073): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxd-open-iscsi-review-mp389234-groovy_</var/snap/lxd/common/lxd>" name="/run/" pid=1694826 comm="mount" flags="rw, nosuid, nodev, remount": 1 Time(s)
++            $denials{$1.' '.$4.' ('.$3.' via '.$5 .': '.$2. ')'}++;
+         } elsif ( $ThisLine =~ /apparmor="ALLOWED" operation="([^"]+)" (info="([^"]+)" )?(error=[+-]?\d+ )?(parent=\d+ )?profile="([^"]+)" (name="([^"]+)" )?pid=\d+ comm="([^"]+)"/ ) {
+             # type=1400 audit(1369519203.141:259049): apparmor="ALLOWED" operation="exec" parent=3733 profile="/usr/sbin/dovecot//null-1c//null-1d" name="/usr/lib/dovecot/pop3-login" pid=24634 comm="dovecot" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 target="/usr/sbin/dovecot//null-1c//null-1d//null-d12"
+             # type=1400 audit(1369627891.522:447576): apparmor="ALLOWED" operation="capable" parent=1 profile="/usr/sbin/dovecot//null-1c//null-1d" pid=3733 comm="dovecot" capability=5 capname="kill"
diff --git a/debian/patches/0020-dhcpd-Ignore-lease-age-under-threshold-messages.patch b/debian/patches/0020-dhcpd-Ignore-lease-age-under-threshold-messages.patch
new file mode 100644
index 0000000..d73695a
--- /dev/null
+++ b/debian/patches/0020-dhcpd-Ignore-lease-age-under-threshold-messages.patch
@@ -0,0 +1,32 @@
+From b5ba9adac18b8b964f1bc8532ef6b9809656777c Mon Sep 17 00:00:00 2001
+From: Bryce Harrington <[e-mail]>
+Date: Thu, 20 Aug 2020 22:53:30 +0000
+Subject: [PATCH 10/10] dhcpd: Ignore lease age under threshold messages
+
+Fixes: https://bugs.launchpad.net/ubuntu/+source/logwatch/+bug/1578001
+Signed-off-by: Bryce Harrington <[e-mail]>
+---
+ scripts/services/dhcpd | 2 ++
+ 1 file changed, 2 insertions(+)
+
+Origin: vendor
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/logwatch/+bug/1578001
+Forwarded: https://sourceforge.net/p/logwatch/git/merge-requests/46/
+Last-Updated: 2020-08-20
+
+diff --git a/scripts/services/dhcpd b/scripts/services/dhcpd
+index 98e7fa7..87312f7 100644
+--- a/scripts/services/dhcpd
++++ b/scripts/services/dhcpd
+@@ -119,6 +119,8 @@ while (my $line = <STDIN>) {
+       ($line =~ /^of the dhcpd.conf file\./)
+      ) {
+     # Do nothing
++   } elsif ($line =~ /lease age \d+ \(secs\) under \d+% threshold, reply with unaltered, existing lease/) {
++    # Do nothing
+ 
+    } elsif ($line =~ s/^exiting./DHCP server exiting./) {
+       $data{'Generic error'}{$line}++;
+-- 
+2.27.0
+
diff --git a/debian/patches/series b/debian/patches/series
index 35fbd8b..c4a4ac6 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -8,4 +8,12 @@
 0008-postfix-Fix-unaligned-output.patch
 0009-Revert-Changed-encoding-to-UTF-8-as-suggested-by-G-r.patch
 
+ssh-ignore-disconnected.patch
 ignore-ras-correctable-errors.patch
+0010-00-debspecific-disable-su-reporting-in-secure.diff.patch
+0011-postfix-Ignore-Resolved-loghost-to-127.0.0.1.patch
+0012-postfix-Handle-backwards-compatible-mode.patch
+0014-zz-sys-Suppress-warnings-if-Sys-CPU-or-Sys-MemInfo-a.patch
+0017-audit-Apparmor-DENIED-entries-don-t-always-include-p.patch
+0018-audit-Treat-Denial-Errors-same-as-Denied.patch
+0020-dhcpd-Ignore-lease-age-under-threshold-messages.patch
diff --git a/debian/patches/ssh-ignore-disconnected.patch b/debian/patches/ssh-ignore-disconnected.patch
new file mode 100644
index 0000000..ed1c0c3
--- /dev/null
+++ b/debian/patches/ssh-ignore-disconnected.patch
@@ -0,0 +1,23 @@
+Description: [sshd] ignore disconnected from user USER
+Author: Karl Stenerud <[e-mail]>
+Origin: https://sourceforge.net/u/jsoref/logwatch/ci/f8aae45768d5ddf01e55b86afa9af90757530089/
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=855539
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/logwatch/+bug/1644057
+Applied-Upstream: https://sourceforge.net/u/jsoref/logwatch/ci/f8aae45768d5ddf01e55b86afa9af90757530089/
+Last-Update: 2018-08-31
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+diff --git a/scripts/services/sshd b/scripts/services/sshd
+index a7edb41..5ff18dd 100755
+--- a/scripts/services/sshd
++++ b/scripts/services/sshd
+@@ -297,7 +297,8 @@ while (defined(my $ThisLine = <STDIN>)) {
+        ($ThisLine =~ /Starting session: (forced-command|subsystem|shell|command)/ ) or
+        ($ThisLine =~ /Found matching \w+ key:/ ) or
+        ($ThisLine =~ /User child is on pid \d/ ) or
+-       ($ThisLine =~ /Nasty PTR record .* is set up for [\da-fA-F.:]+, ignoring/)
++       ($ThisLine =~ /Nasty PTR record .* is set up for [\da-fA-F.:]+, ignoring/) or
++       ($ThisLine =~ /Disconnected from (?:user \S+ |)[\da-fA-F.:]* port \d*/ )
+    ) {
+       # Ignore these
+    } elsif ( my ($Method,$User,$Host,$Port,$Key) = ($ThisLine =~ /^Accepted (\S+) for ((?:invalid user )?\S+) from ([\d\.:a-f]+) port (\d+) ssh[12](?:: (\w+))?/) ) {