September 2010 - syslog-ng - lists.balabit.hu

QSTRING with @
by Peter Czanik 30 Sep '10

30 Sep '10

Hello, I'm trying to create a pattern, and ran into an interesting problem: I can't use @ with QSTRING as beginning character. Example: <patterns> <pattern>(?@QSTRING:usracct.device:@@)@ [INFO] Anonymous user logged in</pattern> </patterns> <examples> <example> <test_message program="pure-ftpd">(?(a)192.168.2.52) [INFO] Anonymous user logged in</test_message> <test_values> <test_value name="usracct.device">192.168.2.52</test_value> </test_values> </example> </examples> But when I test it, pdbtool says: Unknown parser type specified; type=')' Testing message program='pure-ftpd' message='(?(a)192.168.2.52) [INFO] Anonymous user logged in' Wrong match name='.classifier.rule_id', value='', expected='ef75e712-5e9e-4ca0-a614-5e1bf512286b' Wrong match name='usracct.device', value='', expected='192.168.2.52' I changed it to: <pattern>(?@@@ESTRING:usracct.device:)@ [INFO] Anonymous user logged in</pattern> Which works, but I'm still curious, if @ should work as a quotation character. Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

2 3

pure-ftpd patterns
by Peter Czanik 30 Sep '10

30 Sep '10

Hello, Attached are the pure-ftpd login/logout/failure patterns and the sample file I used. Some notes: - logouts, where username is "?" are not tagged, as these just mark that a TCP/IP connection is teared down - PAM messages are not tagged, as that would create duplicate messages about the same event. The variable part of them is simply discarded with an @ANYSTRING@ - anonymous login/logout events are tagged, username is set to "anonymous" from "ftp" You can check the attached pure-ftpd.pdb with the following command: cat pure-ftpd.samples | grep -v CzP | pdbtool match -p pure-ftpd.pdb -f - CzP lines are comments... Please check it on your own pure-ftpd logs to see, if I missed anything! Thanks! Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

2 1

anushri kannu wants to chat
by anushri kannu 30 Sep '10

30 Sep '10

----------------------------------------------------------------------- anushri kannu wants to stay in better touch using some of Google's coolest new products. If you already have Gmail or Google Talk, visit: http://mail.google.com/mail/b-959daaa790-1679f27bf6-M3ME9jASBxIBFvbiNyV6reO… You'll need to click this link to be able to chat with anushri kannu. To get Gmail - a free email account from Google with over 2,800 megabytes of storage - and chat with anushri kannu, visit: http://mail.google.com/mail/a-959daaa790-1679f27bf6-M3ME9jASBxIBFvbiNyV6reO… Gmail offers: - Instant messaging right inside Gmail - Powerful spam protection - Built-in search for finding your messages and a helpful way of organizing emails into "conversations" - No pop-up ads or untargeted banners - just text ads and related information that are relevant to the content of your messages All this, and its yours for free. But wait, there's more! By opening a Gmail account, you also get access to Google Talk, Google's instant messaging service: http://www.google.com/talk/ Google Talk offers: - Web-based chat that you can use anywhere, without a download - A contact list that's synchronized with your Gmail account - Free, high quality PC-to-PC voice calls when you download the Google Talk client We're working hard to add new features and make improvements, so we might also ask for your comments and suggestions periodically. We appreciate your help in making our products even better! Thanks, The Google Team To learn more about Gmail and Google Talk, visit: http://mail.google.com/mail/help/about.html http://www.google.com/talk/about.html (If clicking the URLs in this message does not work, copy and paste them into the address bar of your browser).

1 0

pure-ftpd
by Peter Czanik 30 Sep '10

30 Sep '10

Hello, I installed pure-ftpd and generated some logs. Here they are. They bring up many questions what are the best practices in some situations... Anonymous login: Sep 24 13:53:05 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [INFO] New connection from 192.168.2.142 Sep 24 13:53:08 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [INFO] Anonymous user logged in Sep 24 13:53:11 linux-6y8u pure-ftpd: (ftp(a)192.168.2.142) [INFO] Logout. Successful user login: Sep 24 13:54:15 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [INFO] New connection from 192.168.2.142 Sep 24 13:54:19 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [INFO] czanik is now logged in Sep 24 13:54:21 linux-6y8u pure-ftpd: (czanik(a)192.168.2.142) [INFO] Logout. Denied root login: Sep 24 13:54:22 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [INFO] New connection from 192.168.2.142 Sep 24 13:54:24 linux-6y8u pure-ftpd: pam_listfile(pure-ftpd:auth): Refused user root for service pure-ftpd Sep 24 13:54:27 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [WARNING] Authentication failed for user [root] Sep 24 13:54:30 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [INFO] Logout. Wrong user password: Sep 24 13:57:43 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [INFO] New connection from 192.168.2.142 Sep 24 13:57:51 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [WARNING] Authentication failed for user [czanik] Sep 24 13:57:52 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [INFO] Logout. Invalid user name: Sep 24 13:57:53 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [INFO] New connection from 192.168.2.142 Sep 24 13:57:55 linux-6y8u pure-ftpd: gkr-pam: error looking up user information for: asdf Sep 24 13:58:00 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [WARNING] Authentication failed for user [asdf] Sep 24 13:58:03 linux-6y8u pure-ftpd: (?(a)192.168.2.142) [INFO] Logout. Questions: - many times there is just a question mark instead of the username. Should it still be stored in a variable (useracct.username) or only for the Logout lines, where it actually might get a useful value? - the "New connection" line has the same info (the IP address) twice. How should it be handled? - how should Anonymous login be handled? @QSTRING:useracct.username: @ vs. <value name="usracct.username">Anonymous</value> -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

3 5

Syslog-ng writes log entries to 2 different logs
by Burton Simonds 29 Sep '10

29 Sep '10

I am using syslog-ng 3.1.2 and I am having a problem that I can not figure out. Our network gear sends messages to syslog-ng, and then it filters them based on device type, and name. There is one firewall, that is matching both the firewalls filter and the switches filter, and is subsequently writing to both locations. in the example below, host 1.2.3.5 is logging to both the switches log dir and the firewalls log dir even though it is only referenced in the firewalls filter. Other then the obvious possibilities, (Yes, I have confirmed that the ip address is only referenced in one filter) does anyone have any ideas on what I should look at? Thanks, Burton our filters look like this (each host filter has several addresses in it): filter f_firewalls { host(1.2.3.4) or host(1.2.3.5); }; filter f_switches {host(9.8.7.6) or host(9.8.7.5); }; destination d_firewalls {file( "/path/to/logs/fw/$YEAR/MONTH/$HOST-$YEAR$MONTH$DAY" create_dirs(yes) owner(log_owner) group(log_group) dir_perm(0775) perm(0664) ); }; destination d_switches {file( "/path/to/logs/sw/$YEAR/MONTH/$HOST-$YEAR$MONTH$DAY" create_dirs(yes) owner(log_owner) group(log_group) dir_perm(0775) perm(0664) ); }; log { source(s_network); filter(f_firewalls); destination(d_firewalls); }; log { source(s_network); filter(f_switches); destination(d_switches); }; Version info: syslog-ng 3.1.2 Installer-Version: 3.1.2 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.1#master#8bf13c304b6ab5fc1a372b49d55c78370efe14ca Compile-Date: Aug 3 2010 11:16:08 Enable-Threads: on Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: on Enable-Linux-Caps: on Enable-Pcre: on

4 4

vsftpd login/login failure events
by Peter Czanik 29 Sep '10

29 Sep '10

Hello, Attached are the vsftpd login/login failure events I found. There was no trace of logout in the logs. Question: what is the correct way dealing with the last rule? It has "vsftpd" twice in it. I checked, and obviously only the last appearance counts. Is it worth to define it twice? linux-6y8u:/local/czanik/tmp/syslog-ng-patterndb/file-service # pdbtool match -D -p vsftpd.pdb -P vsftpd -M "pam_listfile(bla1:auth): Refused user root for service bla2" Pattern matching part: pam_listfile(@STRING:usracct.service=bla1@:auth): Refused user @ESTRING:usracct.username=root@for service @ANYSTRING:usracct.service=bla2@ Matching part: pam_listfile(bla1:auth): Refused user root for service bla2 Values: MESSAGE=pam_listfile(bla1:auth): Refused user root for service bla2 PROGRAM=vsftpd .classifier.class=system .classifier.rule_id=7256a6d6-c720-11df-8a1d-000c298c9ba2 usracct.username=root usracct.service=bla2 usracct.type=login usracct.sessionid= usracct.application=vsftpd secevt.verdict=REJECT Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

2 2

[Bug 94] New: too many "Configuration file format is too old..." messages
by bugzilla＠bugzilla.balabit.com 29 Sep '10

29 Sep '10

https://bugzilla.balabit.com/show_bug.cgi?id=94 Summary: too many "Configuration file format is too old..." messages Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: czanik(a)balabit.hu Type of the Report: --- Estimated Hours: 0.0 When using my regular 3.1 configuration, I get the following message 1000+ times on screen: " WARNING: Configuration file format is too old, please update it to use the 3.2 format as some constructs might operate inefficiently; " It should only be printed once. Changing the first line of configuration to: "@version:3.2" silents the warning messages, and everything works as expected. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

AUTO: James B Horwath/TheGuardian is out of the office. (returning 10/04/2010)
by James B Horwath 29 Sep '10

29 Sep '10

I am out of the office until 10/04/2010. I will be out of the office until October 4th and will not have access to e-mail. If there are urgent logging issues please contact Sunil Gupta at 610-807-6717. Any other issues please contact Christopher Clarke. Thanks, Jim Note: This is an automated response to your message "syslog-ng Digest, Vol 65, Issue 48" sent on 9/29/10 5:34:59. This is the only notification you will receive while this person is away. ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.

1 0

one more sshd rule
by Peter Czanik 29 Sep '10

29 Sep '10

Hello, While checking my logs with pdbtool, I ran into this log message: Sep 23 13:10:03 linux-6y8u sshd[21420]: error: PAM: Authentication failure for root from 192.168.2.52 The attached rule seems to find it correctly: HOST=linux-6y8u MESSAGE=error: PAM: Authentication failure for root from 192.168.2.52 PROGRAM=sshd PID=21420 LEGACY_MSGHDR=sshd[21420]: .classifier.class=system .classifier.rule_id=55ec76e0-c709-11df-b62d-000c298c9ba2 usracct.username=root usracct.device=192.168.2.52 usracct.type=login usracct.sessionid=21420 usracct.application=sshd secevt.verdict=REJECT Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

2 2

Re: [syslog-ng] Converting filtering from 2.1 to 3.0?
by Worsham, Michael 29 Sep '10

29 Sep '10

I must be doing something wrong or the syntax is really dependant on the program name now. Orginally under the v2.1 build, the intent of the filter was to strip any incoming message going to the syslog-ng server from the data being sent from the syslog-ng client. There was no one specific program attached to the incoming data. It could come from the client's syslog-ng side via logger command, apache data, kernel, etc. Server-side syslog-ng.conf filter section: filter M_audit { not match("Auditing" value("Audit daemon rotating log files") flags(ignore-case)); }; filter M_repeat { not match("Repeating" value("last message repeated") flags(ignore-case)); }; filter M_stats { not match("Stats" value("Log statistics") flags(ignore-case)); }; On the client side, I would just do 'logger daemon' to send over the message to the syslog-ng server. On the server side, running syslog-ng -d reveals this output: Incoming log entry; line='<13>Sep 20 17:16:31 drupal root: daemon' Filter rule evaluation begins; filter_rule='M_audit' No such value known; value='Audit daemon rotating log files' Filter node evaluation result; filter_result='match' Filter rule evaluation result; filter_result='match', filter_rule='M_audit' Filter rule evaluation begins; filter_rule='M_repeat' No such value known; value='last message repeated' Filter node evaluation result; filter_result='match' Filter rule evaluation result; filter_result='match', filter_rule='M_repeat' Filter rule evaluation begins; filter_rule='M_stats' No such value known; value='Log statistics' Filter node evaluation result; filter_result='match' Filter rule evaluation result; filter_result='match', filter_rule='M_stats' Server-side syslog output being seen in the data file: Sep 20 17:16:31 drupal root: daemon ________________________________ CONFIDENTIALITY NOTICE: This email and any attachments are intended solely for the use of the named recipient(s). This email may contain confidential and/or proprietary information of Scientific Research Corporation. If you are not a named recipient, you are prohibited from reviewing, copying, using, disclosing or distributing to others the information in this email and attachments. If you believe you have received this email in error, please notify the sender immediately and permanently delete the email, any attachments, and all copies thereof from any drives or storage media and destroy any printouts of the email or attachments. EXPORT COMPLIANCE NOTICE: This email and any attachments may contain technical data subject to U.S export restrictions under the International Traffic in Arms Regulations (ITAR) or the Export Administration Regulations (EAR). Export or transfer of this technical data and/or related information to any foreign person(s) or entity(ies), either within the U.S. or outside of the U.S., may require advance export authorization by the appropriate U.S. Government agency prior to export or transfer. In addition, technical data may not be exported or transferred to certain countries or specified designated nationals identified by U.S. embargo controls without prior export authorization. By accepting this email and any attachments, all recipients confirm that they understand and will comply with all applicable ITAR, EAR and embargo compliance requirements.

5 18