Hi,
I have also spend some time with this exact same issue
but unfortunately I do not have a solution for this,
but it would be wyse to remember that particular port
is the default for a very well known application that
I would seriously advise to log.
The ideal would be to have a separate log just for
this port.
This adds another level of complexity in the issue,
but IMHO it would be the perfect solution ...
Regards,
Pedro
--- "Carlos E. R."
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Hi,
In the /etc/sysconfig/SuSEfirewall2 file I have:
FW_SERVICES_EXT_TCP="4662"
But entries to that port are logged:
Jul 15 14:07:25 nimrodel kernel: SFW2-INext-ACC-TCP IN=eth0 OUT= MAC=00:40:f4:2e:b1:21:00:30:da:70:d7:ea:08:00 SRC=189.... DST=192.168.1... LEN=48 TOS=0x00 PREC=0x00 TTL=112 ID=6454 DF PROTO=TCP SPT=50867 DPT=4662 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (0204058401010402)
As it is a port I opened, I understand it should not be logged, it is not a "critical" port. I have:
FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="yes" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no"
What could I do so that they are not logged? I want other port logged, but not those I explicitly opened myself.
- -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Made with pgp4pine 1.76
iD8DBQFGmg9ZtTMYHG2NR9URArYzAJ9Ty4P6d6pGX4TuOrv/8L4CPCWbsgCgjPOM
lz6ZfwgOR1Eawj7JVyde26k= =ojto -----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security+help@opensuse.org
--------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security+help@opensuse.org