October 2002 - syslog-ng - lists.balabit.hu

Re: [syslog-ng]syslog-ng, mysql and web interface for queries
by Michael Earls 13 Oct '02

13 Oct '02

Its listed in the FAQ http://www.campin.net/syslog-ng/faq.html >>> volker_apelt(a)yahoo.de 10/13/02 10:19 AM >>> Some time ago some one posted an article on a web interface for queries to a MySQL database feed by syslog-ng. I tried to find this article in my email archive, but as it seems I've missed it. Do you now where to find this web interface and the software around it? Thank you, Volker -- Volker Apelt volker_apelt .@. yahoo.de (remove the dots, please) Dipl. Chem. +49 6172 31126 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng, mysql and web interface for queries
by Volker Apelt 13 Oct '02

13 Oct '02

Some time ago some one posted an article on a web interface for queries to a MySQL database feed by syslog-ng. I tried to find this article in my email archive, but as it seems I've missed it. Do you now where to find this web interface and the software around it? Thank you, Volker -- Volker Apelt volker_apelt .@. yahoo.de (remove the dots, please) Dipl. Chem. +49 6172 31126

1 0

template keyword for non-file destinations
by David Parker 11 Oct '02

11 Oct '02

Hi list, I am attempting to use templated output directly to a program's stdin instead of relying on a pipe and seperately starting a proxy process to monitor the pipe. For the curious, I'm using libdbi (http://libdbi.sourceforge.net) to write a tiny C wrapper that feeds its standard input into the database. I also saw a similar post at http://lists.balabit.hu/pipermail/syslog-ng/2002-September/003841.html "template() and template_escape() extension for all destination drivers" Is this or a similar patch likely to be included in an upcoming release? Thanks, David -- David Parker <dparker(a)novacoast.com> Lead Developer, Novacoast NovaGuardian http://www.novacoast.com

1 0

Foreground patch for syslog-ng 1.4.16
by Rolf Petter Halle 11 Oct '02

11 Oct '02

Hi! In order to run syslog-ng under supervise control (http://cr.yp.to/daemontools.html) I've added support to start it in the foreground. Hopefully, this patch (or similar functionality) can be added to the source. Rolf Petter Halle

1 0

logging with $HOST and no $HOST
by JR Mayberry 11 Oct '02

11 Oct '02

When I do an lsof on my syslog-ng server I will see entries like (i'm setup with : file(/log/$HOST/$MONTH-$DAY-$YEAR); ) "/log -- 13" (13 because its 1pm now) "/log -- 10-11-2002/13" So, I'm obviously losing logs, I need to know how I can fix this and get these logs (even if it's to a "dump all poorly malformed log packets to a single file" solution) syslog-ng 1.5.15 thanks. __________________________________________________ Do you Yahoo!? Faith Hill - Exclusive Performances, Videos & More http://faith.yahoo.com

1 0

Re: syslog-ng and libol path
by Balazs Scheidler 11 Oct '02

11 Oct '02

On Fri, Oct 11, 2002 at 11:49:12AM +0200, Steve Alberty wrote: > Hi, > > i'm using your excellent syslog-ng application and have to try update > from verson 1.5.17 to 1.5.21. > > The Problem is, in the current version (1.5.21) the configure script can > not recognize an alternative path to libol. > > eg. > > ./configure --prefix=/usr/local/syslog-ng/1.5.21 > --with-libol=/usr/local/libol/0.3.3/bin > > break-up with: > 'libol-config not found in the specified location' > > I think something is wrong in configure.in, because it test if > libol-config is in the given directory is found, but if I specify the > directory to /usr/local/libol/0.3.3/bin, then building breaks with: > > gcc -DHAVE_CONFIG_H -I. -I/usr/src/syslog-ng-1.5.21/src -I. -g -O2 > -Wall -I/usr/src/libol-0.3.3/src -D_GNU_SOURCE -c main.c > In file included from main.c:26: > syslog-ng.h:31: objects.h: file not found --with-libol option is needed if you didn't install libol itself. If you did, simply set your path prior to running configure: PATH=/usr/local/libol/0.3.3/bin:$PATH ./configure --prefix=... Otherwise do not install libol, and use the configure switch: ./configure --with-libol=../libol-0.3.3 --prefix=... -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Security: syslog-ng 1.4.x and 1.5.x is vulnerable to buffer overflow
by Balazs Scheidler 11 Oct '02

11 Oct '02

Hi, I'm writing this mail to announce that syslog-ng 1.4.x and 1.5.x are both vulnerable to a buffer overflow. Exploiting the bug needs a site specific exploit to be written, as the way the buffer is overwritten depends on the local configuration file. The buffer overflow can be triggered when templated output files or filename templates are used. Everybody is urged to upgrade to 1.4.16 or 1.5.21, these are available at the usual place, http://www.balabit.hu/en/downloads/syslog-ng/downloads/ The bug was found be me, so possibly nobody else knows the details. Of course diffing the new version with the previous one unveils the problem. Bugtraq announcement will be sent out soon. Debian package has been released and accepted (though mirrors need time to get the new one) ps: sigh, this was my first BoF :( -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

5 25

Version 1.5.21
by Jerome Peducasse 11 Oct '02

11 Oct '02

Hello, With syslog-ng 1.5.21 (libol 0.3.4), I can't use udp or tcp destination. Example: # cat ./syslog-ng.conf #Minimal configuration file source s_sys { unix-dgram("/dev/log"); internal(); }; destination d_alllog { file("/var/log/all.log" template_escape(off) owner(root) group(sys) perm(0640)); }; destination d_loghost { udp("loghost" port(514)); }; log { source(s_sys); destination(d_alllog); destination(d_loghost); }; # /usr/local/sbin/syslog-ng.1.5.21 -V syslog-ng 1.5.21 # /usr/local/sbin/syslog-ng.1.5.21 -f ./syslog-ng.conf Error creating AF_INET socket (Succès) Error initializing configuration, exiting. # ps auxw | grep -c [s]yslog 0 # /usr/local/sbin/syslog-ng.1.5.18 -V syslog-ng 1.5.18 # /usr/local/sbin/syslog-ng.1.5.18 -f ./syslog-ng.conf # ps auxw | grep [s]yslog root 12680 0.0 0.6 1484 776 ? S 16:28 0:00 /usr/local/sbin/syslog-ng.1.5.18 -f ./syslog-ng.conf # strace /usr/local/sbin/syslog-ng.1.5.21 -f ./syslog-ng.conf .... .... pipe([3, 4]) = 0 fork() = 12727 close(4) = 0 read(3, Error creating AF_INET socket (Succès) Error initializing configuration, exiting. "\1", 1) = 1 --- SIGCHLD (Le processus `enfant' a terminé.) --- _exit(1) = ? Could you help me please? My OS is Linux -- Jerome Peducasse Wanadoo Portails - Sophia Antipolis

1 0

STILL MANGLED MESSAGES! Please Help!
by harald schmidt 11 Oct '02

11 Oct '02

Hi, Syslog-ng 1.5.21 still produces mangled messages into pipes! This happens ca. 10 times a day. Here an example what syslog-ng writes in the pipe: INSERT INTO all_messages_200210 (host, facility, priority, tag, date, time, program, msg) VALUES ( 'clc', 'daemon', 'debug', '1f', '2002-10-10', '11:24:56', 'nrpe', 'nrpe[15656]: Host is asking for command \'check_total_procs\' to be rINSERT INTO all_messages_200210 (host, facility, priority, tag, date, time, program, msg) VALUES ( 'clc', 'daemon', 'debug', '1f', '2002-10-10', '11:24:57', 'nrpe', 'nrpe[15656]: Return Code: 0, Output: OK - 67 processes running' ); the 3rd line should look like this: '2002-10-10', '11:24:56', 'nrpe', 'nrpe[15656]: Host is asking for command \'check_total_procs\' to be run...' ); But syslog-ng doesn't finish that line. Here another example: INSERT INTO all_messages_200210 (host, facility, priority, tag, date, time, program, msg) VALUES ( 'clc', 'daemon', 'debug', '1f', '2002-10-10', '01:26:52', 'nrpe', 'nrpe[15INSERT INTO all_messages_200210 (host, facility, priority, tag, date, time, program, msg) VALUES ( 'clc', 'daemon', 'debug', '1f', '2002-10-10', '01:26:52', 'nrpe', 'nrpe[15387]: Return Code: 1, Output: 2 users currently logged in' ); Here is my syslog-ng.conf: # # Syslog-ng example configuration for for Debian GNU/Linux # # Copyright (c) 1999 anonymous # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.sample,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. # # 1.options options { long_hostnames(off); use_fqdn(yes); sync(0); log_fifo_size (500); gc_busy_threshold(768); use_time_recvd(1); }; # 2.sources source s_kernel { pipe("/proc/kmsg"); internal(); }; source s_stream { unix-stream("/dev/log"); internal(); }; source sn_udp { udp(); }; # 3.destinations destination df_all_messages { file("/var/log/all_messages-$YEAR$MONTH$DAY"); }; destination dq_mysql_all_messages { pipe("/var/pipes/mysql.fifo" template("INSERT INTO all_messages_$YEAR$MONTH (host, facility, priority, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; # 4.Log log { source(s_stream); source(s_kernel); source(sn_udp); destination(df_all_messages); }; log { source(s_stream); source(s_kernel); source(sn_udp); destination(dq_mysql_all_messages); }; And here the Script that reads from the pipe (I'm starting a new database every month): #!/bin/sh datum=$(date +%Y%m) if [ -e /var/pipes/mysql.fifo ]; then while [ -e /var/pipes/mysql.fifo ] do /usr/local/mysql/bin/mysql -vvT syslog_$datum < /var/pipes/mysql.fifo done else mkfifo /var/pipes/mysql.fifo fi My system: # uname -a Linux clc 2.4.10-4GB #1 Tue Sep 25 12:33:54 GMT 2001 i686 unknown Could anyone PLEASE help me? thanks Harald -- Holen Sie sich den Turbo fürs Internet: T-DSL! http://bonus.gmx.net/?gid=46842444&prid=11

3 2

FW: [bugtraq] syslog-ng buffer overflow
by Nicholas Berry 10 Oct '02

10 Oct '02

Baszi, Have you (or your group) been notified about this? How valid is the solution given? Will this issue be addressed in the next 1.5 release? Thanks, Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. nberry(a)ragingwire.com -----Original Message----- From: Holtzl Peter [mailto:holtzl.peter@balabit.hu] Sent: Thursday, October 10, 2002 5:44 AM To: bugtraq(a)securityfocus.com Subject: syslog-ng buffer overflow ---------------------------------------------------------------------------- PACKAGE : syslog-ng VERSION : -1.4.15 (stable) and -1.5.20 (development) SUMMARY : buffer overflow TYPE : remote exploit VULNERABLE: : exploitable (not in default configuration) ZORP-OS SPECIFIC : No ZSA-AUTHOR : Balazs Scheidler <balazs.scheidler(a)balabit.com> ZSA-ID : ZSA-2002-014 DATE: : 2002-10-03 15:00 ---------------------------------------------------------------------------- BACKGROUND: Syslog-NG is a portable syslog implementation. Its highlights include regexp based log selection, TCP transport and more. For more information: http://www.balabit.hu/en/downloads/syslog-ng/ Zorp OS is a Debian GNU/Linux based operating system hardened for running Zorp Professional modular application level firewall suite. Its core framework allows the administrator to finetune proxy decisions (with its built-in script language), and fully analyze complex protocols including SSL embedded protocols. For more information: http://www.balabit.hu/en/products/ZorpPro/ DESCRIPTION: To make it easier to specify message destinations, syslog-ng supports macros in destination filenames as the following log snippet shows: destination d_messages_by_host { file("/var/log/$HOST/messages"); }; The same syntax is used when specifying the contents of destination files: destination d_special_messages { file("/var/log/messages" template("$ISODATE $HOST $MSG\n")); }; The problem lies in the way macro expansion handles constant characters. (ie everything other than macro references). As syslog-ng expands macros it usesa buffer, and a variable called 'left', which contains the number of characters available in the buffer. When a constant character is appended, this variable is not decremented, thus when expanding macros incorrect bounds checking is performed. IMPACT: If templated filenames or templated output is used, it is possible to overflow a buffer. The number of bytes exceeding the allocated buffer depends on the exact template being used. It is believed that this overflow can be exploited, given enough constant characters are present in the template string. SOLUTION: Upgrade syslog-ng to 1.5.21 (devel) or 1.4.16 (stable) or apply the following patch: diff -u -r1.52 -r1.53 --- affile.c 21 Aug 2002 14:03:50 -0000 1.52 +++ affile.c 27 Sep 2002 09:11:33 -0000 1.53 @@ -859,7 +859,7 @@ { "SOURCEIP", M_SOURCE_IP } }; char format[cfg->log_msg_size + 1], *format_ptr = format; - int left = sizeof(format); + int left = sizeof(format) - 1; int i, j; i = 0; @@ -888,6 +888,7 @@ *format_ptr = template->data[i]; format_ptr++; i++; + left--; } } *format_ptr = 0; REFERENCES: 1. http://www.balabit.hu/static/zsa/ZSA-2002-014-en.txt 3. http://www.balabit.hu/en/downloads/syslog-ng/ 3. http://www.balabit.hu/en/products/ZorpPro/ Höltzl Péter BalaBit IT Kft | Tel: +36 1 371-0540 | GnuPG Fingerprint: holtzl.peter(a)balabit.hu | Mobil: +36 20 366-9667 | DB30 5E5B 8777 C06F 5A1F http://www.balabit.hu/ | Fax: +36 1 208-0875 | 4586 CEAF 9678 4A89 CFD6

2 1