LinuxQuestions.org
Review your favorite Linux distribution.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 06-22-2009, 06:01 AM   #1
MheAd
Member
 
Registered: Jun 2007
Distribution: Ubuntu 14.04
Posts: 186

Rep: Reputation: 36
Log processes in IPTABLES?


Hi there,
Is there an easy way to log the names of the actual processes that initiate, let's say, outbound connections from the Linux machine, for instance track what process initiates an outbound connection to MySQL port to remote machine and stuff like that?

Thanks in advance!
 
Old 06-22-2009, 07:26 AM   #2
fpmurphy
Member
 
Registered: Jan 2009
Location: /dev/ph
Distribution: Fedora, Ubuntu, Redhat, Centos
Posts: 299

Rep: Reputation: 62
Unfortunately - no.
 
Old 06-22-2009, 07:34 AM   #3
MheAd
Member
 
Registered: Jun 2007
Distribution: Ubuntu 14.04
Posts: 186

Original Poster
Rep: Reputation: 36
Ok, thanks for clearing that out.
Is there any other way to do it without way too much hassle?
Thanks in advance!
 
Old 06-22-2009, 08:14 AM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Please try to be clear and avoid vague phrasing like "easy way", "stuff like that" and "without way too much hassle".

A process argv[0], its name, should not be considered as a selector. What is authoritative is that on a "clean" machine each process, however shortlived, will be visible in /proc. So, what you have related to processes are their PIDs and, in terms of filtering, the IP address of the remote machine and a remote port number. The only default Netfilter module that tracks process-related details directly is the "owner" module. Logging that information makes it available for further processing by any logwatcher. Since you didn't specify why you need to go through iptables I'd like to point out that there are other, possibly quicker, ways to get the information. If we assert that MySQL listens on its default port TCP/3306, then running 'netstat -tnpe|awk '/3306/ {print $NF}' will return the PIDs of processes using TCP and port 3306. But running 'lsof -t -P -w -n -i tcp:3306' should be even quicker. Having the PID you can find your name information in /proc/$PID/.* .
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Firewall log file, how to make several different log files with IPTables? newtovanilla Linux - Newbie 5 11-28-2008 12:39 PM
a command or way to log time of iptables LOG entries? dividingbyzero Linux - Security 3 06-06-2008 01:23 AM
Deleted /var/log/messages, can't log any files-iptables chingyenccy Linux - Newbie 7 02-27-2005 04:03 PM
IPtables Log Analyzer from http://www.gege.org/iptables/ brainlego Linux - Software 0 08-11-2003 06:08 AM
iptables, changing log file from /var/log/messages acid2000 Linux - Networking 3 03-11-2003 08:38 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 04:22 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration