LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (http://www.linuxquestions.org/questions/linux-security-4/)
-   -   portsentry separate logs and TCPwrappers (http://www.linuxquestions.org/questions/linux-security-4/portsentry-separate-logs-and-tcpwrappers-429964/)

gabsik 03-30-2006 07:55 AM

portsentry separate logs and TCPwrappers
 
I have a debian sarge 3.1 2.6 stable and i have installed portsentry with APT .I want portsentry to have a separate log file but the only documentation i have found related to this subject it is about portsentry.tar.gz where you have to modify a Makefile to rich this,if i'm not wrong!How can i have separate LOGS for portsentry?Then i wanted to ask what is the point for portsentry to list dynamic ips in tcpwrappers?

Grazie!

gabsik 03-30-2006 08:02 AM

portsentry separate logs and TCPwrappers
 
I answer to myself cause i read a related topic it's obvious i have to go and modify syslod.conf how shall i call portsentry to mention it in syslog.conf ?A sort of local/n !What's the proper way of doing it?
grazie!
GGG

unSpawn 03-30-2006 10:35 AM

i have to go and modify syslod.conf how shall i call portsentry to mention it in syslog.conf ?
Yes, you'll have to recompile Portsentry to use the a syslog facility (LOCAL).
Then find a free "local" facility slot in your /etc/syslog.conf where n is between zero and 7. Example:
local7.*<TAB><TAB>/var/log/portsentry.log
Make sure you honour tab usage equally to the rest of your syslog.conf lines. Restart syslog. Ready.


* BTW, there's not much software I would advice against using, but Portsentry sure is one application that is deprecated: use Snort. If you want to know more details please search this forum for posts I made plus the term portsentry.

gabsik 03-30-2006 04:44 PM

How do i compile it if i have installed portsentry with APT ?It would not be enough just to mension the local/n in syslog.conf !

unSpawn 03-31-2006 06:01 AM

How do i compile it if i have installed portsentry with APT ?
Like manually? Download sourcecode tarball from Sourceforge.

gabsik 04-05-2006 09:08 AM

I wish doing it on the one i already have installed ...


All times are GMT -5. The time now is 12:23 PM.