periodic/security: Introduce $security_status_loginfail_ignore for 800.loginfail

Introduce a new variable "security_status_loginfail_ignore" to filter unwanted
login failure messages from the daily security checks.

Co-authored-by:	Michael Osipov <[email protected]>
Co-authored-by:	Joseph Mingrone <[email protected]>
PR:		295191
Reviewed by:	jrm
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D57671

share/man/man5/periodic.conf.5

@@ -23,7 +23,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd April 9, 2024
+.Dd June 19, 2026
 .Dt PERIODIC.CONF 5
 .Os
 .Sh NAME
@@ -1036,6 +1036,10 @@ Set to either
 .Dq Li monthly
 or
 .Dq Li NO .
+.It Va security_status_loginfail_ignore
+.Pq Vt str
+Set to an extended regular expression to filter out unwanted messages.
+By default, no messages are filtered.
 .It Va security_status_tcpwrap_enable
 .Pq Vt bool
 Set to

usr.sbin/periodic/etc/security/800.loginfail

@@ -65,6 +65,7 @@ then
 	echo ""
 	echo "${host} login failures:"
 	n=$(catmsgs | egrep -ia "${prefix}.*\b(fail(ures?|ed)?|invalid|bad|illegal|auth.*error)\b" |
+	    grep -Eva "${security_status_loginfail_ignore-^\$}" |
 	    tee /dev/stderr | wc -l)
 	[ $n -gt 0 ] && rc=1 || rc=0
 fi