May 2001 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]Filter oddity
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 08 May '01

08 May '01

Chris, You are missing the "and" between authpriv and not. Regards, Drew -----Original Message----- From: Chris Wall [mailto:cwall@interaccess.com] Sent: Monday, May 07, 2001 10:50 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Filter oddity Apologies if this has been covered... I'm trying to fine tune my filtering in syslog-ng combined with some features of 2.4.x iptables/netfilter and portsentry What want to do is log information coming from the log rule in iptables to a specific file without it falling over into my other logs. The default syslog-ng.conf came with this filter: filter f_filter2 { level(info) or facility(mail) or facility(authpriv); }; And I've added this filter: filter f_iptables { level(info) and match(portsentry); }; What I would like to do is use a "not" in the first filter - i.e. filter f_filter2 { level(info) or facility(mail) or facility(authpriv) not match(portsentry); }; however, I get a parse error. I'm using 1.4.11... if I understand the docs right, this ought to be okay, but I'm sure I'm missing something. Any help would be appreciated. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Filter oddity
by Chris Wall 07 May '01

07 May '01

Apologies if this has been covered... I'm trying to fine tune my filtering in syslog-ng combined with some features of 2.4.x iptables/netfilter and portsentry What want to do is log information coming from the log rule in iptables to a specific file without it falling over into my other logs. The default syslog-ng.conf came with this filter: filter f_filter2 { level(info) or facility(mail) or facility(authpriv); }; And I've added this filter: filter f_iptables { level(info) and match(portsentry); }; What I would like to do is use a "not" in the first filter - i.e. filter f_filter2 { level(info) or facility(mail) or facility(authpriv) not match(portsentry); }; however, I get a parse error. I'm using 1.4.11... if I understand the docs right, this ought to be okay, but I'm sure I'm missing something. Any help would be appreciated.

1 0

Solaris8-x86: Missing symbol when linking syslog-ng 1.4.11
by Sander 06 May '01

06 May '01

Hi, I'm trying to compile syslog-ng 1.4.11 on Solaris8-x86 with gcc-2.95.3 and get the following linker error: gcc -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o utils.o syslog-names.o getopt.o getopt1.o -lpthread -ldoor /usr/local/lib/libol.a -lsocket -lnsl -lxnet Undefined first referenced symbol in file yywrap cfg-lex.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 Has anyone had this problem before? What library should this symbol be in? I've compiled it succesfully before on Solaris8-sparc with no problems whatsoever. Thanks in advance, Sander de Boer

4 5

Syslog.conf translator
by Jon Marks 06 May '01

06 May '01

Hi, In order to make the transition to syslog-ng easier for people, I thought it might be useful to have an automated translation from the old syslog.conf to a working syslog-ng.conf. I came up with an awk script which works OK for me. I was targeting Solaris and AIX specifically, but off-hand, RedHat linux syslogd looks the same and I presume other UNIX variants' do, too. Try it, it could work ;) In particular, there are three things to look out for if you're interested in porting this to another UNIX platform: 1) Change the local log device if necessary, from /dev/log to whatever it's supposed to be. 2) Change the device type (i.e. the syslog-ng.conf directive) for the local log device. The script checks 'uname' for SunOS and AIX and sets an appropriate variable; just add to that detection mechanism. A variable would do nicely for the log device, too, but they've got the same name in AIX and Solaris so I didn't worry about it. (I'm not using the "door" device). 3) The script is an awk script, but its invoked by ksh. It's easy to rearrange it so that it's invoked directly as awk, but for what I plan to do with it, I didn't need that. In either case, ksh won't be available on many linux distros, I think, so just change the shell to bash or something. (In this case, I hope the shell you pick is lenient about newlines within a quoted command line argument!) Hope this is useful! -- Jonathan Marks Systems Administrator, Production Systems Group Computing and Communication Services Office University of Illinois at Urbana-Champaign

2 4

Stability of 1.5 tree
by Chris Sibbitt 04 May '01

04 May '01

Just a basic question. How stable is the 1.5 tree compared to the 1.4? I've been using 1.4 for quite awhile, and it seems to hold up well for my purposes, however I'd like the additional functionality that is in 1.5.6. Has anyone been using the latest 1.5 builds in production? What, if any, problems have been experienced? Chris Sibbitt JetNet Internetworking Services Inc. Providing Secure Internet Communications Phone 613-271-6220x228 FAX 613-271-6229 Email csibbitt(a)jetnet.ca Web www.jetnet.ca <http://www.jetnet.ca/>

1 0

syslog-ng 1.5.6 released
by Balazs Scheidler 04 May '01

04 May '01

Hi, I released syslog-ng 1.5.6 with the following enhancements: News for the 1.5.6 release Fri, 4 May 2001 14:38:31 +0200 * added explicit chown/chmoding of files/directories for easier permission management * added the possibility to use sync() on TCP destinations * syslog-ng now outputs connection properties when a connection is broken * added special message parsing used by AIX (last message repeated & Message forwarded from) It can be found at the usual places: http://www.balabit.hu/en/products/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Re: [syslog-ng]Directory permissions/ownership
by John_Delisle＠ceridian.ca 03 May '01

03 May '01

I've been waiting for such a feature for quite a while!! I know it would be very useful here, we want some logs owned by nobody for use with our httpd. Thanks! John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 |--------+--------------------------------> | | Chris Sibbitt | | | <CSibbitt(a)jetnet.ca> | | | Sent by: | | | syslog-ng-admin(a)lists.| | | balabit.hu | | | | | | | | | 2001/05/03 09:40 AM | | | Please respond to | | | syslog-ng | | | | |--------+--------------------------------> >-----------------------------------------------------------------------------------------------------------| | | | To: "'syslog-ng(a)lists.balabit.hu'" <syslog-ng(a)lists.balabit.hu> | | cc: | | Subject: [syslog-ng]Directory permissions/ownership | >-----------------------------------------------------------------------------------------------------------| After much frustration, I decided to simply add a umask(000) to the beginning of main() in order to alleviate troubles I've been having with the perm() and dir_perm() configuration directives. One thing, though, that I think is needed in the config that doesn't currently exist is dir_user() and dir_group() directives to control the ownership of created directories. Would anyone else find this useful? Chris Sibbitt JetNet Internetworking Services Inc. Providing Secure Internet Communications Phone 613-271-6220x228 FAX 613-271-6229 Email csibbitt(a)jetnet.ca Web www.jetnet.ca ********************************************************************** This e-mail and any files transmitted with it are considered confidential and are intended solely for the use of the individual or entity to whom they are addressed (intended). This communication is subject to agent/client privilege. If you are not the intended recipient (received in error) or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this is e-mail is strictly prohibited. If you have received this e-mail in error please notify the sender immediately. **********************************************************************

1 0

Directory permissions/ownership
by Chris Sibbitt 03 May '01

03 May '01

After much frustration, I decided to simply add a umask(000) to the beginning of main() in order to alleviate troubles I've been having with the perm() and dir_perm() configuration directives. One thing, though, that I think is needed in the config that doesn't currently exist is dir_user() and dir_group() directives to control the ownership of created directories. Would anyone else find this useful? Chris Sibbitt JetNet Internetworking Services Inc. Providing Secure Internet Communications Phone 613-271-6220x228 FAX 613-271-6229 Email csibbitt(a)jetnet.ca Web www.jetnet.ca <http://www.jetnet.ca/>

1 0

$PROGRAM
by Saku Ytti 03 May '01

03 May '01

I'd like to use destination all with $PROGRAM, but rather than creating PROGRAM like it's reported, I'd like to use filename as it is after last '/'. ie. /usr/sbin/cron would be just cron. Also some other magic could be done to check it's sanity. I'm just checking if there is already a patch, so that I wouldn't need to revinvent the wheel. -- ytti

1 0

[PATCH] chroot and drop root priviledges
by Tommi Virtanen 02 May '01

02 May '01

# This is for the Debian bug tracking system, see http://bugs.debian.org/94898 forwarded 94898 syslog-ng(a)lists.balabit.hu thanks Here's a patch to implement -C, -u and -g command line options, for chrooting, changing uid and gid, respectively. My syslog-ng is happily chrooted into /var/log/syslog-ng, and runs as syslogng:syslogng. Notes: - it still needs write access to the logs; I just chowned the tree to syslogng - it binds to /dev/log etc before chroot/userid switch, so it still works; however, if you change sources and try to reload config, it probably won't have access to open the new sources. - if you store the config outside the chroot, reload won't work. - I had to change the child->parent notify mechanism, as the old kill(getppid(), SIGTERM) trick didn't work after the uid switch. Now it has a pipe open to parent, parent waits on read(). I took the opportunity to make it signal success to the parent by writing a nil byte; parent changes exit value based on whether it saw the nil or not. diff -Naur syslog-ng-1.5.4.original/src/main.c syslog-ng-1.5.4/src/main.c --- syslog-ng-1.5.4.original/src/main.c Wed Nov 29 13:21:31 2000 +++ syslog-ng-1.5.4/src/main.c Sun Apr 22 21:36:14 2001 @@ -38,6 +38,8 @@ #include <errno.h> #include <string.h> #include <getopt.h> +#include <pwd.h> +#include <grp.h> #include "main.c.x" @@ -186,13 +188,29 @@ return 0; } +#define READ 0 +#define WRITE 1 void go_background() { pid_t pid; - + int pipefd[2]; + char buf; + + if (pipe(pipefd) < 0) { + werror("Cannot pipe(), (%z)\n", strerror(errno)); + exit(1); + } pid = fork(); if (pid == 0) { - int fd = open(pidfilename, O_CREAT | O_WRONLY | O_NOCTTY | O_TRUNC, 0600); + int fd; + if (pipefd[WRITE]!=1) { + if (dup2(pipefd[WRITE], 1) < 0) { + werror("Cannot set pipe as stdout, (%z)\n", strerror(errno)); + exit(1); + } + (void) close(pipefd[WRITE]); + } + fd = open(pidfilename, O_CREAT | O_WRONLY | O_NOCTTY | O_TRUNC, 0600); if (fd != -1) { struct ol_string *pid_s = c_format("%i\n", getpid()); write(fd, pid_s->data, pid_s->length); @@ -205,10 +223,13 @@ werror("Cannot fork(), (%z)\n", strerror(errno)); exit(1); } - signal(SIGTERM, sig_term); - while (sigtermrecvd == 0) - pause(); - exit(0); + + if (read(pipefd[READ], &buf, 1) == 1 + && buf=='\0') { + exit(0); + } else { + exit(1); + } } void usage(void) @@ -221,6 +242,9 @@ " -f <fname>, --cfgfile=<fname> Set config file name, default=" PATH_SYSLOG_NG_CONF "\n" " -V, --version Display version number (" PACKAGE " " VERSION ")\n" " -p <fname>, --pidfile=<fname> Set pid file name, default=" PATH_PIDFILE "\n" + " -C <dir>, --chroot=<dir> Chroot to directory\n" + " -u <user>, --user=<user> Switch to user\n" + " -g <group>, --group=<group> Switch to group\n" #ifdef YYDEBUG " -y, --yydebug Turn on yacc debug messages\n" #endif @@ -233,10 +257,45 @@ extern int yydebug; #endif +void nametouidgid(const char* user, uid_t *uid, gid_t *gid) +{ + struct passwd* pw; + pw = getpwnam(user); + + if (pw) { + *uid=pw->pw_uid; + if (gid) + *gid=pw->pw_gid; + } +} + +void nametogid(const char* group, gid_t *gid) +{ + struct group* gr; + gr = getgrnam(group); + + if (gr) { + *gid=gr->gr_gid; + } +} + +int dropprivileges(uid_t uid, gid_t gid) +{ + if ( setgid(gid) != 0 || setuid(uid) != 0 ) { + return -1; + } else { + return 0; + } +} + + int main(int argc, char **argv) { int do_fork = 1; int opt; + char *chrootdir = NULL; + uid_t uid = 0; + gid_t gid = 0; NEW(syslog_backend, backend); struct option syslog_ng_options[] = { @@ -246,6 +305,9 @@ { "verbose", no_argument, NULL, 'v' }, { "help", no_argument, NULL, 'h' }, { "version", no_argument, NULL, 'V' }, + { "chroot", required_argument, NULL, 'C' }, + { "user", required_argument, NULL, 'u' }, + { "group", required_argument, NULL, 'g' }, #ifdef YYDEBUG { "yydebug", no_argument, NULL, 'y' }, #endif @@ -257,7 +319,7 @@ gc_idle_threshold = 100; gc_busy_threshold = 3000; - while ((opt = getopt_long(argc, argv, "f:p:dvhyV", syslog_ng_options, NULL)) != -1) { + while ((opt = getopt_long(argc, argv, "f:p:dvhC:u:yV", syslog_ng_options, NULL)) != -1) { switch (opt) { case 'f': strncpy(cfgfilename, optarg, sizeof(cfgfilename)); @@ -265,6 +327,21 @@ case 'p': strncpy(pidfilename, optarg, sizeof(pidfilename)); break; + case 'C': + if (!optarg[0]) + usage(); + chrootdir = optarg; + break; + case 'u': + nametouidgid(optarg, &uid, gid ? NULL : &gid); + if (uid == 0 || gid == 0) + usage(); + break; + case 'g': + nametogid(optarg, &gid); + if (gid == 0) + usage(); + break; case 'd': debug_flag++; break; @@ -286,6 +363,8 @@ } } + if (uid == 0 && gid != 0) + werror("Cannot use -g without -u"); init_backend(&backend->super); backend->configuration = make_syslog_config(cfgfilename, &backend->super); @@ -301,17 +380,28 @@ } if (!CONFIG_INIT(backend->configuration, NULL)) { werror("Error initializing configuration, exiting.\n"); - if (do_fork) kill(getppid(), SIGTERM); return 2; } + if (chrootdir) { + if (chroot(chrootdir) < 0) { + werror("Error chrooting, exiting.\n"); + return 3; + } + } + if (uid) { + if (dropprivileges(uid, gid) < 0) { + werror("Error in setuid/setgid, exiting.\n"); + return 4; + } + } if (do_fork) { set_error_internal(); close(0); - close(1); close(2); setsid(); - kill(getppid(), SIGTERM); + write(1, "", 1); + close(1); } notice("syslog-ng version %z starting\n", VERSION); return main_loop(backend); -- tv@{{hq.yok.utu,havoc,gaeshido}.fi,{debian,wanderer}.org,stonesoft.com} unix, linux, debian, networks, security, | First snow, then silence. kernel, TCP/IP, C, perl, free software, | This thousand dollar screen dies mail, www, sw devel, unix admin, hacks. | so beautifully.

2 1