LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 09-15-2003, 10:00 PM   #1
eniuquine
LQ Newbie
 
Registered: Jul 2003
Posts: 9

Rep: Reputation: 0
Iptables messages... possibly..


A buch of junk appears on my console. It looks something like "IN=eth0 OUT= MAC=ff:ff:ff" etc. Someone from my LUG said that iptables was sending messages to the console and that to stop it I could edit /etc/syslog.conf and restart syslog. I went ahead and changed the two lines that directed to /dev/console and * to /dev/null, but I'm still getting these messages. Even if it had stopped the junk, I would still like to know why iptables is doing this(if it really is iptables) and how to stop it. It all started when I used firestarter for the first time, but there doesn't seem to be any option when it comes to directing messages. Any help or background information would be much appreciated.

Joe
 
Old 09-16-2003, 07:04 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Could you post the non-empty lines of your /etc/syslog.conf?
 
Old 09-16-2003, 08:05 AM   #3
eniuquine
LQ Newbie
 
Registered: Jul 2003
Posts: 9

Original Poster
Rep: Reputation: 0
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.* /dev/null

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages

# The authpriv file has restricted access.
authpriv.* /var/log/secure

# Log all the mail messages in one place.
mail.* /var/log/maillog


# Log cron stuff
cron.* /var/log/cron

# Everybody gets emergency messages
#*.emerg /dev/null

# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler

# Save boot messages also to boot.log
local7.* /var/log/boot.log
 
Old 09-16-2003, 08:22 AM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Change "#kern.* /dev/null" to read "kern.PRIO /dev/console", where PRIO is one of crit or alert*. Restart syslogd.
*Read "man syslog.conf", under "Selectors", the part about priorities.
 
Old 09-16-2003, 09:11 AM   #5
eniuquine
LQ Newbie
 
Registered: Jul 2003
Posts: 9

Original Poster
Rep: Reputation: 0
This is strange. It seems like you get a certain type of message "kern" "emerg" or whatever at a certain priority directed to a certain file/device/whatever. I can't imagine why things would show up on my console when I directed them to /dev/null. I followed your advice and I'm now waiting to see if I get any junk. Thanks much.

Joe
 
Old 09-16-2003, 09:26 AM   #6
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
I'm now waiting to see if I get any junk
for pri in debug info notice warn err crit alert emerg panic; do
logger -p kern.$pri "gimme junk (pri: $pri)"; done
 
Old 09-16-2003, 02:09 PM   #7
eniuquine
LQ Newbie
 
Registered: Jul 2003
Posts: 9

Original Poster
Rep: Reputation: 0
Ummm.... not sure what that meant, but I'm still getting junk. Hmmm...

Joe
 
Old 09-16-2003, 03:39 PM   #8
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Ummm.... not sure what that meant, but I'm still getting junk. Hmmm...
OK, but at what level? Same? What distro?
 
Old 09-16-2003, 04:08 PM   #9
eniuquine
LQ Newbie
 
Registered: Jul 2003
Posts: 9

Original Poster
Rep: Reputation: 0
This is after I changed it to crit "kern.crit /dev/console".... I'm using Red Hat 9... I hope I'm not pissing you off.

Joe
 
Old 09-16-2003, 05:04 PM   #10
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
This is after I changed it to crit "kern.crit /dev/console"
Did you restart syslogd?

I hope I'm not pissing you off.
No. You aren't. Takes a lot more to piss me off :-]
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables event in messages TheRealDeal Linux - Security 1 03-11-2005 03:37 AM
iptables prob in /var/log/messages globeTrotter Linux - Networking 9 11-17-2004 03:02 PM
iptables prob in /var/log/messages pt2 globeTrotter Red Hat 1 11-11-2004 05:23 PM
syslog is filled with iptables DROPPED messages TLV Linux - Networking 3 10-06-2004 04:23 AM
iptables and /var/log/messages Obie Linux - Security 5 08-18-2004 02:02 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 09:30 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration