August 2004 - syslog-ng - lists.balabit.hu

FAQ-seeding: chroot jail procedure for Syslog-ng
by Michael D. (Mick) Bauer 24 Jan '05

24 Jan '05

Hi, all. In researching/writing the Syslog-ng coverage for the new edition of my book, I've encountered a total lack of published info, anywhere, on how to create a Syslog-ng chroot jail. So in the interests of seeding the FAQ (or at least Google), here's a procedure that works for me. Naturally, anyone should feel free to correct anything I've gotten wrong! Any and all feedback is appreciated. ************************************************ How To Create A Chroot Jail For Syslog-ng 1.6x ************************************************ 1. su to root if you're not root already 2. Create an unprivileged group-account for syslog-ng, e.g., by adding the following line to /etc/group: syslogng:x:77: 3. Create an unprivileged system account for syslog-ng, e.g., via the following command: useradd -d /var/syslog-ng-jail -g syslogng -r syslogng (Note that in Linux, the "-r" flag tells useradd that this will be a system account, causing useradd to automatically set the account's shell to /bin/false and to choose an appropriately low value for its UID.) 4. Create the jail: mkdir -p /var/syslog-ng-jail/var/log (Our actual changed root will be /var/syslog-ng-jail, but we may as well create the var/log subdirectory at the same time) 5. At this point the whole jail should be owned by root:root, which is cool so long as the changed-root-directory itself (/var/syslog-ng-jail) is "other-executable," e.g., rwxr-xr-x. But syslog-ng *will* need to create/write files in the jail's var/log subdirectory, so we need to tweak the latter's group-ownership and -permissions, like so: chgrp syslogng /var/syslog-ng-jail/var/log chmod g+wx /var/syslog-ng-jail/var/log 6. That's it! We may now start syslog-ng like this: syslog-ng -C /var/syslog-ng-jail -u syslogng -g syslogng The syslog-ng process will still read its config from /etc/syslog-ng/syslog-ng.conf (not /var/syslog-ng-jail/etc/...), but immediately after that it will chroot itself to the specified jail. Note, however, that the paths you specify in syslog-ng.conf "file()" statements should all be relative to the changed root. E.g., use file("/var/log/messages"), *not* file("/var/syslog-ng-jail/var/log/messages"). Any path you specify in syslog-ng.conf will end up with "/var/syslog-ng-jail" prepended to it. Naturally, there's nothing to stop you from dropping the "var/log/" subdirectory altogether, and simply specify, e.g., file("/messages") as a destination (resulting in things being written to /var/syslog-ng-jail/messages, a less unwieldy path). ******* So far I haven't noticed that anything else needs to be added to the chroot jail (e.g., stuff from /dev or /etc), but if anyone knows differently please speak up! Regards, Mick P.S. Baszi, you really ought to add "-u" & "-g" to the syslog-ng manpage. After all, running anything in a chroot jail as root is futile, no? :-) P.P.S. BTW, 1.6x rocks! /-------------------------------------------------\ | Michael D. (Mick) Bauer | | Security Editor, Linux Journal | | Dir. of Value-Subtracted Svcs., Wiremonkeys.org | \-------------------------------------------------/

6 12

Problems with Netscreen log entries
by Paul Mindeman 06 Jan '05

06 Jan '05

Running sylog-ng 1.6.4 on Solaris 9 Log entries from my UNIX devices log fine. Log entries from my Netscreen devices seem to be missing the end of line terminator, as the entries run together in the log file. The default syslog daemon was able to handle these entries fine. Any ideas on how to fix this? The options in the syslog-ng.conf file are: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; Thanks -- Paul Mindeman BTInet Systems Administrator 701-355-5587 mindeman(a)btinet.net

3 2

/proc/kmsg and chrooted syslog-ng
by Michael D. (Mick) Bauer 01 Oct '04

01 Oct '04

One more ignorance-betraying question about Syslog-ng chroot-jails: what should one do about /proc/kmsg? Maybe "touch /var/logjail/proc/kmsg; ln -s /var/logjail/proc/kmsg /proc/kmsg"? And do I take it that, per another recent posting, one should similarly create a new dev/log in the jail and link to it from /dev/log? I'd like to post a revised Syslog-ng chroot jail procedure later this week. Thanks to the two of you who've replied so far! Mick /-------------------------------------------------\ | Michael D. (Mick) Bauer | | Security Editor, Linux Journal | | Dir. of Value-Subtracted Svcs., Wiremonkeys.org | \-------------------------------------------------/

3 2

Logging to syslog without facility mail
by Laurent CARON 31 Aug '04

31 Aug '04

Hello I'm trying to exclude certain messages from my syslog (facility mail which are inferior to warning) I tried filter f_syslog { not facility(auth, authpriv) and not facility(mail); }; It removes all the mail facility from syslog and then filter f_syslog { not facility(auth, authpriv) or facility(mail) and level(warn .. emerg); }; which is not better at all. Does anyone have a clue about it? Thanks Laurent

2 1

Automatic starting of syslog-ng
by Thomas Reidy 30 Aug '04

30 Aug '04

Running on Red Hat 9.. the application is running, logging perfectly.. I built it w/o the RPMs, and need to know how to get this to start automatically during startup.. its been a long day, so this may be obvious.. Am I right to assume if I reboot the box, I won't get logging until I manually start the script? I could just put something simple in /etc/init.d, etc but need to know what the file should say.. the init scripts never just seem to launch the programs... Thanks in advance... -- --- Tom t_r_e_i_d_y_(a)-g-m-a-i-l-.-c-o-m

3 3

Anyone Get Syslog-NG To Compile on Red Hat?
by Rhugga 27 Aug '04

27 Aug '04

I am trying to get syslog-ng 1.6.5 compiled on a RH 9 system. I compiled libol into /usr/local/libol-0.3.14. I tried the following configuration options when trying to build sysllg-ng: ./configure --prefix=/usr/local/syslog-ng-1.6.5 --with-libol=/usr/local/libol-0.3.14/lib --with-libnet=/usr/local/libol-0.3.14/bin/ ./configure --prefix=/usr/local/syslog-ng-1.6.5 --with-libol=/usr/local/libol-0.3.14/lib --with-libnet=/usr/local/libol-0.3.14 ./configure --prefix=/usr/local/syslog-ng-1.6.5 --with-libol=/usr/local/libol-0.3.14/lib --with-libnet=/usr/local/libol-0.3.14/bin/libol-config Each time is complains that it cannot find libol-config: <snip> checking for strptime... yes checking for TCP wrapper library... -lwrap checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... no checking whether to enable spoof_source support... no checking libol version >= 0.3.14... configure: error: libol-config not found in the specified location Here is libol-config: syslog:~/syslog-ng-1.6.5 #ls -la /usr/local/libol-0.3.14/bin/ total 36 drwxr-xr-x 2 root root 4096 Aug 27 07:22 . drwxr-xr-x 5 root root 4096 Aug 27 07:22 .. -rwxr-xr-x 1 root root 1288 Aug 27 07:22 libol-config -rwxr-xr-x 1 root root 24264 Aug 27 07:22 make_class It finds the libol library correctly, otherwise it dies before it reaches this error. It just doesn't properly detect libol-config. Anyone have any ideas? Thanks, CC

3 5

Question Regarding Syslog-NG Capabilities
by Rhugga 27 Aug '04

27 Aug '04

If I simply want to have the syslogd daemons on my Solaris boxes send their logs to a remote loghost running syslog-ng, I don't need syslog-ng on the solaris boxes correct? So on my solaris box, /etc/syslog.conf would contain an entry like this: auth.info @loghost Loghost of course would be defined in /etc/hosts and contain the IP address of the Linux system running syslog-ng. Will this config work? Some of the documentation confused me implying that syslog-ng is also needed on the client side. I will be using a standard TCP listener with syslog-ng on the loghost machine, likely using port 514. Thanks, rhugga

2 1

Openbsd 3.5 on SPARC64 not login network hostname
by Darren J. Wise 26 Aug '04

26 Aug '04

Hi, I have a Sun Ultra 5 that I am setting up as a log server using OpenBSD 3.5 with the stable port of syslog-ng 1.5.24. In the syslog-ng.conf file I have got the following options: options { sync(0); time_reopen (10); log_fifo_size (1000); long_hostnames (no); use_dns (yes); use_fqdn (no); create_dirs(yes); chain_hostnames (no); keep_hostname (yes); perm (0600); }; And the following network related source, destination and log options: source s_net { udp(); }; destination d_net { file("/export/syslog-ng/$HOST/messages"); }; log { source(s_net); destination(d_net); }; I have got a Sparc Solaris 9 box and Linux box logging to this machine using the default Solaris/Linux syslog. The problem that I am seeing is that the log server logs all messages as if they have came from the localhost, an example from the Linux machine on the log server (loghost-test is the name of the log server) : Aug 24 12:53:38 loghost-test xfs: Entry deleted from font path. I have also compiled syslog-ng 1.6.5 with libol 0.3.14 and still get the same problem. Any help would be greatly appreciated. Thanks Darren

3 2

offline mode?
by Maarten Thibaut 25 Aug '04

25 Aug '04

Hi, First of all, thanks for the neat software you guys make. Our organization is rolling out a mobile pc platform, we want some types of log events stored on a centralized server which is only reachable from the inside of our corporate network. So when the machine is not inside our network, the log entries need to be stored locally until such time as the centralized server is reachable. Then the logs get sent through. Can we do this with syslog-ng? From the features listed at your home page it would seem this is a standard feature... Is that right? -- maarten

3 3

log viewing utilities?
by Ellis.Chris 23 Aug '04

23 Aug '04

Now that I have half of the equation solved (i.e. a better method of collecting log files using syslog-ng), does anyone have suggestions for the "other half", i.e. viewing tools that let me look at the log files without having to use grep with regular expressions and such? Compound text searches would be a great start... ! Thanks... Chris Ellis/ CIC Secure Perimeter

2 1