LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 12-18-2002, 03:39 PM   #1
cuss
Member
 
Registered: Dec 2002
Posts: 63

Rep: Reputation: 15
is syslog listening?


Hi,

I've configured syslogd to listen to remote hosts adding -r in the /etc/sysconfig/syslog.

SYSLOGD_OPTIONS="-r -m 0"

I then restarted the daemon and turned it on with chkconfig syslog on. When i type netstat -au I see:

Proto Recv-Q Send-Q Local Address Foreign Address State

udp 0 0 *:syslog *.*

There is nothing under the heading State. Shouldn't this say LISTEN? I am logging to this server from a remote host and I think i've done everything but i'm still only seeing local logs and nothing from the remote host.

I also went into /etc/services and added syslog 514/udp.

Is it my setup of syslogd or the fact the remote host isn't configured properly to send its logs to me?

Thanks.
 
Old 12-18-2002, 04:52 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,369
Blog Entries: 54

Rep: Reputation: 2869Reputation: 2869Reputation: 2869Reputation: 2869Reputation: 2869Reputation: 2869Reputation: 2869Reputation: 2869Reputation: 2869Reputation: 2869Reputation: 2869
If "netstat -an -A inet" doesn't show syslogd listening on local UDP/514, then does the remote host syslog.conf include a rule for logging to remote? You don't have the fw blocking stuff?
Can you test it by forcing a remote message/have netcat listening on the port instead?
 
Old 12-19-2002, 08:13 AM   #3
cuss
Member
 
Registered: Dec 2002
Posts: 63

Original Poster
Rep: Reputation: 15
I tried the "netstat -an -A inet" command and this is what it showed:

Proto Recv-Q Send-Q Local Address Foreign Address State


udp 0 0 0.0.0.0:514 0.0.0.0:*


Nothing under the column State once again. I know with TCP the State says LISTEN when the port is listening....is this not the same with UDP? If the output of the netstat command is correct and infact there should be nothing under the State column then i will check the FW and the remote syslog.conf file. First though I need to make sure that my syslogd is listening.
 
Old 12-19-2002, 09:33 AM   #4
cuss
Member
 
Registered: Dec 2002
Posts: 63

Original Poster
Rep: Reputation: 15
It looks as though syslog messages are coming in (tested with tcpdump), however, it looks like they are getting dropped and aren't going into /var/log/messages. Any suggestions?
 
Old 12-19-2002, 11:47 AM   #5
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,369
Blog Entries: 54

Rep: Reputation: 2869Reputation: 2869Reputation: 2869Reputation: 2869Reputation: 2869Reputation: 2869Reputation: 2869Reputation: 2869Reputation: 2869Reputation: 2869Reputation: 2869
Like it says: "udp 0 0 0.0.0.0:514" means syslogd *is* listening on local UDP/514. Next to that, UDP is a *stateless* protocol.
Btw, last time I TS'ed someones syslogd it was a default fw script blocking. AFAIK, libpcap stuff like Snort or tcpdump go *before* fw routing. If you can't tell from the logs, try to add a log rule to all rejects and denies and it'll show if fw is the culprit.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Ldap is listening but won't do anything Homer Glemkin Linux - Software 1 12-31-2004 02:10 PM
Why is inetd listening? Vincent_Vega Linux - Security 8 09-17-2004 12:38 PM
Sendmail not listening eggoz Linux - Software 6 09-06-2004 04:08 AM
How to stop X listening GrayGhost Slackware 2 11-14-2003 02:41 PM
Listening to Radio idor Linux - Software 0 08-15-2003 09:40 AM


All times are GMT -5. The time now is 01:03 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration