Ralf Tempel wrote: [...]

einzudringen? Oder sind die Meldungen eher harmlos?

Ja [...]

Sep 9 23:29:23 Foliant-Linux-Server kernel: SuSE-FW-DROP-DEFAULT IN=ppp0 OUT= MAC= SRC=80.14.80.161 DST=80.129.253.176 LEN=34 TOS=0x00 PREC=0x00 TTL=117 ID=61530 PROTO=UDP SPT=1219 DPT=4665 LEN=14 ^^^^^^^^Edonkey-Chatport

Befrage mal google mit udp 4665 MfG Benn -- #250319 - http://counter.li.org

Ralf Tempel wrote:

Versucht da jemand in den Rechner einzudringen? Oder sind die Meldungen eher harmlos?

Alles was protokolliert wird, wird aufgehalten. Sorgen musst du dir um jedes Paket machen, das nicht protokolliert wird. Peter

Hallo, Am Montag, 9. September 2002 23:53 schrieb Ralf Tempel:

Ich werde alle paar Sekunden mit Meldungen der Firewall bombadiert. Ich habe lleider bisher nichts gefunden, was mir diese Meldungen "übersetzen" könnte. Versucht da jemand in den Rechner einzudringen? Oder sind die Meldungen eher harmlos?

Hat jemand eine anfängerfreundliche deutsche Anleitung für die FW?

Ich hab ein anfängerfreundliches Skript für dich, welches die Ausgaben von SuSEfirewall2 in etwas besser Lesbares "übersetzt": --- schnipp ----- #!/bin/bash # # SuSE-FW-analysis by Hartmut Meyer (c) 2002 # # Felder der SuSE-FW Meldungen in /var/log/messages: # # 1-3: date # 4: hostname # 5: message from (always "kernel") # 6: SuSE-FW classification (typical: "DROP-DEFAULT", \\"UNAUTHORIZED-TARGET" # 7: incoming interface # 8: outgoing interface # 9: MAC address # 10: source IP # 11: destination IP # 12: LEN (?) # 13: TOS (?) # 14: PREC (?) # 15: TTL (time to live) # 16: ID (?) # 17: protocol (ususally TCP or UDP) # 18: source port # 19: destination port # 20-: not of interest # # the varible $INTERESTING defines, which fields of the SuSE-FW output \\in # /var/log/messages we want to keep # # use /etc/services from http://www.seifried.org/security/ports/ for # better results # # for more information on port numbers see # http://isc.incidents.org/port_details.html #set -x # INTERESTING: adjust this to your own needs INTERESTING="1-3,6,10,11,17-19" TEMPDIR=/tmp/SuSE-FW-analysis SERVICES_TCP=$TEMPDIR/services.tcp SERVICES_UDP=$TEMPDIR/services.udp OUTFILE=/var/log/SuSE-FW-analysis # this is where we keep the single files geneerated from \\/var/log/messages # (one file per line) rm -R $TEMPDIR 2> /dev/null mkdir -p $TEMPDIR/vlm cd $TEMPDIR/vlm # generate single files from /var/log/messages (one file per line) grep SuSE-FW /var/log/messages | tr -s " " | sed s/\ DF// | split -l 1 - \\vlm. # collect all source and destination IPs from the vlm files for n in $( ls ) ; do cat $n | cut -d " " -f 10 | sed s/SRC=// >> $TEMPDIR/IP cat $n | cut -d " " -f 11 | sed s/DST=// >> $TEMPDIR/IP done sort $TEMPDIR/IP | uniq > $TEMPDIR/IP.uniq mkdir -p $TEMPDIR/IP.cache # for each IP found, create a file with that IP as the name its DNS # name as content for IP in $( cat $TEMPDIR/IP.uniq ) ; do DNS_NAME=$( host $IP | cut -d " " -f 5 | sed s/.$// ) if [ $(echo $DNS_NAME | cut -d " " -f 2) ]; then DNS_NAME=$(echo $DNS_NAME | cut -d " " -f 2) fi IP_CHECK=$(host $DNS_NAME | cut -d " " -f 4) # if lookup or reverse lookup fail, just stick to the IP if [ "$DNS_NAME" = "3(NXDOMAIN" ] || [ "$IP_CHECK" != "$IP" ] ; then DNS_NAME=$IP fi echo $DNS_NAME > $TEMPDIR/IP.cache/$IP done # create to files from /etc/services: one for UDP and one for TCP cat /etc/services | grep -v ^# | tr "\t" " " | tr -s " " | grep /tcp > \\$SERVICES_TCP cat /etc/services | grep -v ^# | tr "\t" " " | tr -s " " | grep /udp > \\$SERVICES_UDP # for each file/line try to add a "translation" for the numerical # SPT and DPT based on /etc/services for n in $( ls $TEMPDIR/vlm ) ; do SPT=$(cut -d " " -f 18 $n | cut -d "=" -f 2) DPT=$(cut -d " " -f 19 $n | cut -d "=" -f 2) if [ "$( grep "PROTO=TCP" $n )" != "" ] ; then SERVICES=$SERVICES_TCP fi if [ "$( grep "PROTO=UDP" $n )" != "" ] ; then SERVICES=$SERVICES_UDP fi SPT=$( echo $SPT | sed s/$SPT/$SPT\($( echo $( grep " $SPT/" $SERVICES \\) | cut -d " " -f 1 )\)/ ) DPT=$( echo $DPT | sed s/$DPT/$DPT\($( echo $( grep " $DPT/" $SERVICES \\) | cut -d " " -f 1 )\)/ ) cut -d " " -f 1-17 $n > tmp echo "SPT=$SPT DPT=$DPT" >> tmp echo $( cat tmp | tr "\n" " " ) > $n done rm tmp # collect all files (already with translated SPT/DPT) and create # $OUTFILE cat * > $OUTFILE # replace IPs with DNS names for n in $( ls $TEMPDIR/IP.cache ) ; do IP=$n DNS_NAME=$( cat $TEMPDIR/IP.cache/$n ) cat $OUTFILE | sed s/$IP/$DNS_NAME/ > tmp mv tmp $OUTFILE done # reduce output to keep only the $INTERESTING fields cut -d " " -f $INTERESTING $OUTFILE > tmp mv tmp $OUTFILE rm -R $TEMPDIR echo "You can find the output in $OUTFILE" --- schnapp ----- Achtung: in der Mail sind einige Zeilenumbrüche reingekommen, die so in dem Skript nicht sein dürfen: Alle Zeilen, die mit "\\" anfangen gehören ans Ende der vorherigen Zeile. Vielleicht hilft's dir ja. Schöne Grüße aus Bremen hartmut