<HTML>
<HEAD>
<TITLE>Re: [syslog-ng] Issues with SYSLOG-NG 2.0.10 and relaying via a SSH tunnel</TITLE>
</HEAD>
<BODY>
<FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'>I think this has something to do with a feature that has been removed from the Linux Kernel at one point or other. The source IP will now always be overwritten when using an ssh tunnel or stunnel (somebody correct me if I’m wrong).<BR>
<BR>
However, I think I somewhere saw a kernel patch that can be applied (I even think I saw on the syslog-ng forums, otherwise google it). The patch will enable IP source spoof (for lack of a better word).<BR>
<BR>
For now to get around this, chain your hostnames so with your setup you will get a host field that looks like this:<BR>
<HOST FIELD IN SYSLOG>/<SENDER>/<SENDER WHICH SHOULD BE MACHINE A’s IP/DNS BUT IS 127.0.0.1><BR>
<BR>
cheers<BR>
/Marc<BR>
<BR>
<BR>
On 07/01/09 14.47, "Dean Thompson" <<a href="Dean.Thompson@dtdataservices.com">Dean.Thompson@dtdataservices.com</a>> wrote:<BR>
<BR>
</SPAN></FONT><BLOCKQUOTE><FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'><BR>
<BR>
Hi Everybody,<BR>
<BR>
I was wondering whether somebody might be able to help me with a problem<BR>
which appears to have been discussed before but is still continuing to<BR>
be a problem for an environment that I am working within. The issue<BR>
relates to one host forwarding SYSLOG messages to another host via a SSH<BR>
tunnel.<BR>
<BR>
Scenario:<BR>
=========<BR>
<BR>
<Device> --SYSLOG MESSAGE--> Machine A <--SSH Tunnel--> Machine B<BR>
<BR>
Items to note include Machine B setting up a reverse SSH tunnel with<BR>
Machine A. Machine A has a local port of 5514 that it uses to forward<BR>
syslog messages to which sents them to machine B. This connectivity is<BR>
working without any problems.<BR>
<BR>
The issue that I am currently experiencing is on Machine B when looking<BR>
at the logs delivered via Machine A. It would appear that Machine B<BR>
thinks that all the logs are coming from the IP address of 127.0.0.1. I<BR>
have checked the configuration of syslog-ng on machine A and machine B<BR>
and they look as if they are configured correctly.<BR>
<BR>
Syslog-NG 2.0.10 on Machine A is configured as follows:<BR>
=======================================================<BR>
<BR>
options {<BR>
log_fifo_size(1000);<BR>
long_hostnames(off);<BR>
use_dns(no);<BR>
use_fqdn(no);<BR>
keep_hostname(yes);<BR>
check_hostname(yes);<BR>
log_msg_size(16384);<BR>
};<BR>
<BR>
source s_network {<BR>
udp(ip(0.0.0.0) port(514));<BR>
tcp(ip(0.0.0.0) port(514) max_connections(1000));<BR>
};<BR>
<BR>
destination d_syslogmgr { tcp("127.0.0.1" port(5514)); };<BR>
<BR>
[...]<BR>
<BR>
<BR>
Syslog-NG 2.0.10 on Machine B is configured as follows:<BR>
=======================================================<BR>
<BR>
options {<BR>
log_fifo_size(1000);<BR>
long_hostnames(off);<BR>
use_dns(no);<BR>
use_fqdn(no);<BR>
keep_hostname(yes);<BR>
check_hostname(yes);<BR>
log_msg_size(16384);<BR>
};<BR>
<BR>
[...]<BR>
<BR>
<BR>
Output that is being observed:<BR>
==============================<BR>
<BR>
Jan 7 12:32:34 127.0.0.1 172.XX.YY.1 3317162: 3339552: Jan 7<BR>
12:37:09.608: %LINK-3-UPDOWN: Interface FastEthernet0/7, changed state<BR>
to up<BR>
Jan 7 12:32:34 127.0.0.1 172.XX.YY.1 3317163: 3339553: Jan 7<BR>
12:37:10.457: %LINK-3-UPDOWN: Interface FastEthernet0/7, changed state<BR>
to down<BR>
Jan 7 12:32:34 127.0.0.1 172.XX.YY.1 23:37:07 accept 172.XX.YY.242<BR>
> >eth-s2p2c3 src: 192.168.17.48; dst: 192.168.19.167; proto: tcp; rule:<BR>
22; product: VPN-1 & FireWall-1; service: 9999; s_port: 3310;<BR>
Jan 7 12:32:34 127.0.0.1 172.XX.YY.1 23:37:07 accept 172.XX.YY.242<BR>
> >eth-s2p4c1 src: XXX.YYY.235.195; dst: 192.168.108.1; proto: udp; rule:<BR>
5; product: VPN-1 & FireWall-1; service: 53; s_port: 5707;<BR>
Jan 7 12:32:34 127.0.0.1 172.XX.YY.1 23:37:07 accept 172.XX.YY.242<BR>
> >eth-s2p4c1 src: XXX.YYY.235.197; dst: 192.168.108.1; proto: udp; rule:<BR>
5; product: VPN-1 & FireWall-1; service: 53; s_port: 11639;<BR>
Jan 7 12:32:34 127.0.0.1 172.XX.YY.1 23:37:08 accept 172.XX.YY.242<BR>
> >eth-s2p4c1 src: XXX.YYY.235.196; dst: 192.168.108.1; proto: udp; rule:<BR>
5; product: VPN-1 & FireWall-1; service: 53; s_port: 1325;<BR>
Jan 7 12:32:34 127.0.0.1 172.XX.YY.1 8023816: Jan 7 23:37:09.028:<BR>
%SYS-CFC8-2-MMAP: mmap failed for size 24576 bytes Caller PC 0x72B12BCC<BR>
errno 12 : ios-base : (PID=20499, TID=23) :<BR>
-Traceback=(c6lc2-sp-4-dso-b.so+0x1F9AD0) ([19:0]+0x204790)<BR>
([19:0]+0x20CEDC) ([16:-2]np.+0x84BD4) ([21:0]+0x855B8)<BR>
([9:-3]1-dso-b+0x1FE904) ([9:-3]0-dso-bn+0xD354C) ([20:0]+0xD2658)<BR>
([20:0]+0xD29D0) ([9:-3]2-dso-b+0x4E4684) ([19:0]+0x4E465C)<BR>
<BR>
Ideally, I would prefer that the 127.0.0.1 was actually the 172.XX.YY.1<BR>
IP address, but it appears that there is a re-write of IP addresses<BR>
going on. I have placed a packet sniffer on the line and I can see that<BR>
the packet which is actually sent to MACHINE B is correct (including the<BR>
correct IP addresses). To me it would appear that the issue is in the<BR>
processing of the message at MACHINE B, but the issue may lie elsewhere.<BR>
<BR>
Is there anything obvious with the configurations which would be<BR>
contributing to this problem, or is my basic understanding of how<BR>
SYSLOG-NG works when wanting to keep hostnames and IP addresses flawed ?<BR>
<BR>
Regards,<BR>
<BR>
Dean<BR>
<BR>
______________________________________________________________________________<BR>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><BR>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a><BR>
FAQ: <a href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a><BR>
<BR>
<BR>
</SPAN></FONT></BLOCKQUOTE>
</BODY>
</HTML>