August 2000 - openSUSE Security - openSUSE Mailing Lists

/var/log/{messages,firewall,warn}
by Jason P. Stanford 02 Aug '00

02 Aug '00

On my SuSE 6.4 system, I am using the firewal and scanlogd packages. While familiarizing myself with the system, I'd at one point removed those packages, then re-installed them. Now the log files in /var/log don't seem quite what I recall them being originally, but I could be mistaken. I get identical loggings from firewall in /var/log/firewall and /var/log/messages. This results in /var/log/messages getting VERY big, especially due to web traffic to the machine (a lot of ALLOW's). Can I change a config to prevent firewall from making duplicate entries to /var/log/messages? Also, scanlogd does not seem to log any scannings except for those from localhost (127.0.0.1). I've been playing with it, and running nmap on another machine on my local subnet, but these scans (not in any "stealth" mode) never get logged and scanlogd is most definitely running. I don't see any config files for scanlogd, and I didn't see any references to one in the man page. Any help is greatly apprecitated. Thanks! __________________________________________________ Do You Yahoo!? Kick off your party with Yahoo! Invites. http://invites.yahoo.com/

4 4

again ftp-logging
by OKDesign oHG Security Webmaster 02 Aug '00

02 Aug '00

Hi, okay, I got it thanks to Romans hint. But now I have the next problem: Can I exclude special users from being logged that detailed ? I've configured "real" to be command-logged, as anonymous login is not possible on our system. Second, is there a way to have these command-logs being written to a different file ? At the moment this is written to /var/log/messages, can I have it in f.ex. /var/log/ftp.command or something like this ? Third, is there a way NOT to have these annoying messages "[date] [host]: popper: connect from [anywhere]" in my /var/log/messages ? Some clients have configured their systems to check their account on our server every ten minutes, some check it every 30 minutes and so on. Due to this the messages-file is growing rapidly with this stuff. Is there a way to stop this ? Thanks in advance. --- Stephan

1 0

ftpd-logging
by OKDesign oHG Security Webmaster 02 Aug '00

02 Aug '00

Hi, it seemed as if my syslog is only logging when a user sends data to the server via ftp, but not if he is receiving data from the server. I tried it out, and whoops, my logfile /var/log/xferlog only logs incoming transfers. Well, in /etc/ftpaccess there is configured logging inbound as well as outbound. Any ideas what could be the reason ? And is it possible, to log ANY activities when connecting via ftp ? I mean, when the user is just looking around in his tree, without downloading or uploading anything? Thank you in advance. --- Stephan

2 1

RE: [suse-security] ftpd-logging
by Peter Nixon 02 Aug '00

02 Aug '00

I highly recomend that you take a look at ProFTPD. It is very configurable and will allow logging of EVERYTHING. even "ls" ProFTPD comes as a suse package or you can grab it from http://www.proftpd.net/ Cheers _______________________________________________________________ Peter Nixon Systems Engineer Jigsaw Technology Pty Ltd URL: http://www.jigsaw.com.au Address: 21 Boomerang Place Seven Hills NSW 2147 Australia Phone: 02 9672 4222 Fax: 02 9672 4211 Email: peter(a)jigsaw.com.au _______________________________________________________________ > -----Original Message----- > From: OKDesign oHG Security Webmaster [mailto:security@okdesign.de] > Sent: Wednesday, 2 August 2000 5:06 > To: SuSE-Security-List > Subject: [suse-security] ftpd-logging > > > Hi, > it seemed as if my syslog is only logging when a user sends > data to the > server via ftp, but not if he is receiving data from the server. > I tried it out, and whoops, my logfile /var/log/xferlog only > logs incoming > transfers. > Well, in /etc/ftpaccess there is configured logging inbound as well as > outbound. > Any ideas what could be the reason ? > And is it possible, to log ANY activities when connecting via > ftp ? I mean, > when the user is just looking around in his tree, without > downloading or > uploading anything? > Thank you in advance. > > --- Stephan > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

1 0

IPChains file? Where is it?
by Waldack, Jesse (CAP, CARD) 01 Aug '00

01 Aug '00

I am trying to set up a Masq environment on my LAN with my cable modem. I have a DHCP server running and successfully giving IP addresses to new computers on the LAN through 'eth1'. I have internet access working through 'eth0'. But I've noticed on boot that it says /sbin/ipchains is missing. (Which I hope explains why I cannot get outside internet access from 'eth1'. Which package needs to be installed to get ipchains on my system, or where can I download it? Thanks in advance for your assistance.

2 1

/sbin/init.d/masquerade in suse 6.3 / 6.4
by W.Schlich 01 Aug '00

01 Aug '00

hi group! sorry for this "lame" question, perhaps ot: where has the script for masquerading gone in 6.3 / 6.4?! am I too blind to find it?! :) regards | Wolfram Schlich ------------------------------------------------------------------ | E-Mail: wolfram(a)schlich.org * ICQ #: 35713642 | Postal: Berghof * 56626 Andernach * Germany | Tel.: +49-(0)2636-941194 * Fax: -941193

2 2