LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices



Reply
 
Search this Thread
Old 12-03-2010, 08:22 AM   #1
gustavoc
LQ Newbie
 
Registered: Oct 2009
Location: Patagonia, Argentina
Distribution: Slackware 14.1
Posts: 17

Rep: Reputation: 0
Disabling syslog compression


Hi,

Im installing fail2ban to improve the security of a home asterisk server which from time to time becomes the target of some sip account cracker and/or ssh brute force attack.
For those not familiar with fail2ban, this utility monitors log files to find matches with user specified expressions to identify the presence of a brute force attack. Then configures iptables rules to block the offending IP.
Heres an example:

Code:
NOTICE[1734] chan_sip.c: Registration from '"613"<sip:613@xx.xxxx.xxx.xxx>' failed for 'yyy.yyy.yyyy.yyy' - No matching peer found
[Sep 16 01:13:01
NOTICE[1734] chan_sip.c: Registration from '"614"<sip:614@xxx.xxx.xxx.xxx>' failed for 'yyy.yyy.yyy.yyy' - No matching peer found
[Sep 16 01:13:01]
NOTICE[1734] chan_sip.c: Registration from '"615"<sip:615@xxx.xxx.xxx.xxx>' failed for 'yyy.yyy.yyy.yyy' - No matching peer found
This works fine, the problem is that syslog uses a form of compression as in the following example:

Code:
Dec  1 13:49:06 myserver sshd[12138]: Failed password for myuser from 192.168.x.y port 46112 ssh2
Dec  1 13:49:07 myserver last message repeated 2 times
Dec  1 13:49:10 myserver sshd[12142]: Failed password for myuser from 192.168.x.y port 46113 ssh2
Dec  1 13:49:11 myserver last message repeated 2 times
In the second case, fail2ban would count 2 errors (lines 1 and 3 match the expression) when there are 6 failures.
Ive been searching for some syslogd configuration to turn off this behavior but with no luck.
My system is running Slackware 13.0 with standard 2.6.29-smp kernel.
Thanks in advance.

Gustavo
Patagonia
Argentina
 
Old 12-03-2010, 08:25 AM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,415

Rep: Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968
no idea what syslog services slackware uses by default, redhat uses rsyslogd though, and that *used to* have an -e option to not do this, but now it never does it. if slack uses and oldetr rsyslog then try that, or change to a different syslog service, like my personal favourite syslog-ng.
 
  


Reply

Tags
compression, fail2ban, syslogd


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Getting message from syslog disabling irq16 dont_stop_me Linux - Hardware 9 09-23-2011 07:59 PM
Slax with SquashFS-4 new compression algorithm and layered compression ratios? lincaptainhenryjbrown Linux - Software 2 06-19-2009 06:29 PM
I need help getting syslog to log remotely, this is just the regular syslog. abefroman Linux - Software 2 06-05-2008 12:36 PM
LXer: Centralized Syslog Server Using syslog-NG LXer Syndicated Linux News 0 04-28-2006 07:21 PM
message from syslog: disabling 1rq#21 ylts Linux - Hardware 0 02-21-2005 01:18 PM


All times are GMT -5. The time now is 12:30 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration