generate an audit log when a non-whitelist IP is trying to access

satlx · 03-17-2019, 11:46 PM

I have removed the SSH service from firewalld

Code:

firewall-cmd --zone=public --remove-service=ssh

Using rich rule I'm allowing particular IP to access SSH service

Code:

firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="192.163.14.10" service name="ssh" accept'

Now I want to generate an audit log when a non-whitelist IP is trying to access my host. The host should generate an audit log for access denied. Something like Error: Network access denied. Unauthorized IP 111.111.111.111 is trying to access my host.

I tried to find logs in /var/log but no luck.

scasey · 03-18-2019, 05:14 PM

Where does firewalld put it's logs?
On my server, those rejections are written to /var/log/messages.

satlx · 03-18-2019, 11:12 PM

Thanks for the reply.

In /var/log/messages, I found, when ssh service was present in firewalld

Quote:

Mar 19 00:03:09 sshd[6628]: Accepted password for cliadmin from <ip> port 62886 ssh2
Mar 19 00:03:11 sshd[6631]: Accepted password for cliadmin from <ip> port 62888 ssh2

for the wrong it gives log

Quote:

Mar 19 00:06:15 sshd[6697]: Failed password for cliadmin from <ip> port 63004 ssh2

Now, I removed the SSH service from firewalld

Quote:

firewall-cmd --zone=public --remove-service=ssh

And try to ssh uesr@<ip-host> from machine X, will get

Quote:

error : ssh: connect to host <ip-host> port 22: No route to host

Here I'm supposed to get log message in /var/log/messages saying that

Quote:

Network access denied. Unauthorized IP machine X trying to access <ip-host>.

satlx · 03-18-2019, 11:20 PM

I am able to get log messages in /var/log/messages for successful authorization and failure authorization.

I am expecting log messages when the service ssh has been removed from firewalld services.

Run following command on host X

Code:

firewall-cmd --zone=public --remove-service=ssh

Now, try to host ssh host X from host Y

Code:

ssh user@<host-x>
ssh: connect to host <host-x> port 22: No route to host

For this behavior, I'm expecting log like

Quote:

Error: Network access denied. Unauthorized IP <host-Y> is trying to access my host.

scasey · 03-19-2019, 08:45 AM

Quote:

Originally Posted by satlx

Code:

ssh user@<host-x>
ssh: connect to host <host-x> port 22: No route to host

That error says that host y can't find host x, so it can't even attempt to connect to it...there's no way that host x can log a connection attempt when no connection was made.
Check the name resolution and routing on host y.

Honest Abe · 03-27-2019, 07:20 AM

When you are removing ssh service from firewalld, you are basically blocking off the ssh port. Hence the "no route" message.

Are you familiar with hosts.allow and hosts.deny files?

Try putting a known ip in the blacklist (hosts.deny ) and see what happens.
(I forgot the preference order for these two files, I am leaving that part on u to figure out.)

Make sure you have access to console so that you can undo changes easily.

dc.901 · 03-27-2019, 07:32 AM

You can also use fail2ban, and it writes to its own log file so it can be easier than messages log file.