bin/60506: default syslog.conf spams console with ssh/http attacks

["campbell+netbsd%mumble.net@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60506
>Category:       bin
>Synopsis:       default syslog.conf spams console with ssh/http attacks
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Jul 26 02:55:00 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, 9, ...
>Organization:
The NetBSD Spamdation, Inconsolate
>Environment:
>Description:

	The default /etc/syslog.conf has the following line:

*.err;kern.*;auth.notice;authpriv.none;mail.crit	/dev/console

	The `auth.notice' and `*.err' parts mean that:

	- ssh login failures get logged to the console
	- bogus requests to bozohttpd get logged to the console

	For a host on the internet with ssh access and an http server,
	that's a lot of spam on the console.

	I think these are bad defaults.  They lead to warning fatigue
	and, under load like a network denial of service attack that
	prevents ssh access, make the console unusable for diagnostics
	and remediation of the load.

	I have run into this repeatedly lately with TNF's own
	infrastructure for the repository migration, so for the new
	infrastructure I've already set it up to deploy a quieter
	console.

>How-To-Repeat:

	1. run sshd and bozohttpd (or apache2/nginx with syslog)
	2. connect to the internet

>Fix:

	Change it to:

*.err;kern.*;auth.none;ftp.none;authpriv.none;mail.crit	/dev/console

	I.e., replace auth.notice by auth.none, and add ftp.none.  This
	way, the *.err pattern won't match ssh login faliures or bad
	http requests.