September 2012 - syslog-ng - lists.balabit.hu

[Bug 144] New: incremental statistics and on reload and stop
by bugzilla＠bugzilla.balabit.com 07 Sep '12

07 Sep '12

https://bugzilla.balabit.com/show_bug.cgi?id=144 Summary: incremental statistics and on reload and stop Product: syslog-ng Version: unspecified Platform: All OS/Version: All Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: mdione.ext(a)orange.com Type of the Report: --- Estimated Hours: 0.0 syslog-ng log statistics in /var/log/messages (or some other defined destination), but it does it accumulatively. this makes it harder to make graphs, because the data collector must detect reloads and stop/starts. this most probably should not be done if the statistics are asked via syslog-ng-ctl. also, it does not print statistics on reload or stop, so the last values before the reload or stop are lost. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[Bug 61] udp6 source declaration causes syslog forwarding to assume IPv6
by bugzilla＠bugzilla.balabit.com 07 Sep '12

07 Sep '12

https://bugzilla.balabit.com/show_bug.cgi?id=61 --- Comment #4 from Gergely Nagy <algernon(a)balabit.hu> 2012-09-07 15:45:20 --- For what its worth, the quick workaround mentioned above is available here: https://github.com/algernon/syslog-ng/commit/edd84a5fcedb998949beccc18794b9… -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 61] udp6 source declaration causes syslog forwarding to assume IPv6
by bugzilla＠bugzilla.balabit.com 07 Sep '12

07 Sep '12

https://bugzilla.balabit.com/show_bug.cgi?id=61 Gergely Nagy <algernon(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED --- Comment #3 from Gergely Nagy <algernon(a)balabit.hu> 2012-09-07 15:39:23 --- The straightforward fix is to add a { last_addr_family = AF_INET; } to dest_afsyslog, similarly how it is done for the source part. But then we need syslog6() to use the protocol over IPv6, and we might need syslog(transport(udp6)) too (although, syslog6(transport(udp)) should be the same). I could send a patch - against 3.4 - that turns syslog() ipv4-only, and introduces syslog6(). On the other hand, the best would be if we didn't need the ipv4/ipv6 distinction at all, and whichever resolves would be used. I'd rather see that done. I'll try to see if the PE core has this, the team did some refactoring in the area. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 61] udp6 source declaration causes syslog forwarding to assume IPv6
by bugzilla＠bugzilla.balabit.com 07 Sep '12

07 Sep '12

https://bugzilla.balabit.com/show_bug.cgi?id=61 Gergely Nagy <algernon(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |algernon(a)balabit.hu AssignedTo|bazsi(a)balabit.hu |algernon(a)balabit.hu --- Comment #2 from Gergely Nagy <algernon(a)balabit.hu> 2012-09-07 15:14:09 --- This is still present in 3.3, and that is unfortunate since it just bit me. I'll see what I can do about it. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

Syslog-NG/MySQL question
by James McDonald 07 Sep '12

07 Sep '12

Here is the output of /opt/syslog-ng/sbin/syslog-ng -V: [root@ustc-syslog2 ~]# /opt/syslog-ng/sbin/syslog-ng -V syslog-ng-premium-edition 4 F2 (4.2.3) Installer-Version: 4.2.3 Revision: ssh+git://folti@git.balabit//var/scm/git/syslog-ng/syslog-ng-core--mainline- -4.2#master#725fff94b398b564b71f9de88808148b0dd2fc8d Compile-Date: Jul 4 2012 14:01:24 Default-Modules: affile,afprog,afsocket,afuser,basicfuncs,csvparser,dbparser,syslogformat,afl ogstore,disk-buffer,confighash,convertfuncs,basic-proto,rltp-proto,afsql,afs qlsource Available-Modules: afsql,license,afsocket-tls,afuser,tfjson,csvparser,affile,dbparser,rltp-prot o,afsocket-notls,dummy,confgen,aflogstore,basicfuncs,basic-proto,afsqlsource ,snmp,afsocket,syslogformat,disk-buffer,afprog,convertfuncs Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-Linux-Caps: on Enable-Pcre: on Does anyone know what needs to be edited/installed to have the line "Enable-SQL: on" be included in that output? I installed the following MySQL rpms on this server but I'm not sure what else needs to be done to have that line appear. MySQL-client-5.5.14-1.rhel5.x86_64.rpm MySQL-server-5.5.14-1.rhel5.x86_64.rpm MySQL-shared-compat-5.5.14-1.rhel5.x86_64.rpm MySQL-devel-5.5.14-1.rhel5.x86_64.rpm MySQL-shared-5.5.14-1.rhel5.x86_64.rpm MySQL-test-5.5.14-1.rhel5.x86_64.rpm Thanks, James McDonald System Administrator RHCSA, Security+ jmcdonald(a)lce.com

2 3

[Bug 188] New: Syslog-ng 3.3.5.90-20120810 problems: undefined symbol and ld.so library path
by bugzilla＠bugzilla.balabit.com 06 Sep '12

06 Sep '12

https://bugzilla.balabit.com/show_bug.cgi?id=188 Summary: Syslog-ng 3.3.5.90-20120810 problems: undefined symbol and ld.so library path Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Mac OS Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jpo(a)di.uminho.pt Type of the Report: --- Estimated Hours: 0.0 Linux distro: Fedora 17 x86_64 Syslog-ng source tarball: syslog-ng-3.3.5.90-20120810-v3.3.5-43-g19f6c.tar.gz we have encountered a couple of problems when running syslog-ng-3.3.5.90-20120810 under Fedora 17 x86_64: 1) ld.so library path 2) undefined symbol: tls_context_setup_session Steps to reproduce the problem: 1) just run "/usr/sbin/syslog-ng --version" ---------- # /usr/sbin/syslog-ng --version syslog-ng 3.3.5.90 Installer-Version: 3.3.5.90 Revision: Compile-Date: Aug 17 2012 22:09:52 Default-Modules: affile,afprog,afsocket,afuser,basicfuncs,csvparser,dbparser,syslogformat,afsql Error opening plugin module; module='afsocket', error='libsyslog-ng-crypto.so: cannot open shared object file: No such file or directory' Error opening plugin module; module='afsocket-notls', error='//usr/lib64/syslog-ng/libafsocket-notls.so: undefined symbol: tls_context_setup_session' Error opening plugin module; module='afsocket-tls', error='libsyslog-ng-crypto.so: cannot open shared object file: No such file or directory' Available-Modules: dummy,afsql,tfjson,dbparser,csvparser,convertfuncs,afuser,basicfuncs,afmongodb,confgen,syslogformat,affile,afprog Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: on Enable-Pcre: on ---------- The library path problem can be solved by creating the file "/etc/ld.so.conf.d/syslog-ng.conf" containing the syslog-ng module directory ( /usr/lib64/syslog-ng in this particular case ). Running syslog-ng under strace without touching the ld.so library paths produces: ---------- # # strace -e trace=file /usr/sbin/syslog-ng --version ... access("//usr/lib64/syslog-ng/libafsocket.so", F_OK) = 0 stat("//usr/lib64/syslog-ng/libafsocket.so", {st_mode=S_IFREG|0755, st_size=103560, ...}) = 0 open("//usr/lib64/syslog-ng/libafsocket.so", O_RDONLY|O_CLOEXEC) = 4 open("/lib64/tls/libsyslog-ng-crypto.so", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) open("/lib64/libsyslog-ng-crypto.so", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) open("/usr/lib64/tls/x86_64/libsyslog-ng-crypto.so", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) stat("/usr/lib64/tls/x86_64", 0x7fff0f81fcb0) = -1 ENOENT (No such file or directory) open("/usr/lib64/tls/libsyslog-ng-crypto.so", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) stat("/usr/lib64/tls", {st_mode=S_IFDIR|0555, st_size=4096, ...}) = 0 open("/usr/lib64/x86_64/libsyslog-ng-crypto.so", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) stat("/usr/lib64/x86_64", 0x7fff0f81fcb0) = -1 ENOENT (No such file or directory) open("/usr/lib64/libsyslog-ng-crypto.so", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) stat("/usr/lib64", {st_mode=S_IFDIR|0555, st_size=49152, ...}) = 0 Error opening plugin module; module='afsocket', error='libsyslog-ng-crypto.so: cannot open shared object file: No such file or directory' ... ----------- Note that all syslog-ng modules with the exception of libsyslog-ng-crypto.so are loaded from the syslog-ng modules directory. Output of "syslog-ng --version" after creating the file "/etc/ld.so.conf.d/syslog-ng.conf" ---------- # /usr/sbin/syslog-ng --version syslog-ng 3.3.5.90 Installer-Version: 3.3.5.90 Revision: Compile-Date: Aug 17 2012 22:09:52 Default-Modules: affile,afprog,afsocket,afuser,basicfuncs,csvparser,dbparser,syslogformat,afsql Error opening plugin module; module='afsocket-notls', error='//usr/lib64/syslog-ng/libafsocket-notls.so: undefined symbol: tls_context_setup_session' Available-Modules: dummy,afsocket,afsql,tfjson,dbparser,csvparser,convertfuncs,afuser,basicfuncs,afmongodb,afsocket-tls,confgen,syslogformat,affile,afprog Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: on Enable-Pcre: on ---------- /jpo -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 13

DNS-based port knocking demo
by Endre Szabo 06 Sep '12

06 Sep '12

Hi list, Here's a proof of concept of DNS based port knocking. Firewall opens up port of SSHd for 10 seconds after nameserver answering to a predefined DNS query. It uses pattern db and netfilter only. http://vimeo.com/endreszabo/dns-portknocking Endre

5 5

The "3.3.7 RC"
by Marvin Nipper 05 Sep '12

05 Sep '12

Sorry for what will be "stupid questions". I know that you were wanting us to "try out" the 3.3.7 RC, and that (last week) you were expecting to produce that as earlier as last Friday. However... there was all of that weekend traffic, with a whole new set of ivykis-related problems, so I'm not sure what the state of the "current" packaging is at this point, and also not 100% sure what packaging I should be pulling down. My _guess_ is maybe the HEAD file from here: http://packages.madhouse-project.org/syslog-ng/3.3/3.3.6/, and I see that a new package was built last night. Bottom line... can you just let us know when you have all of the latest fixes rolled up into a potential RC package, and just verify where we should pull that from. I'm more than happy to run/test the RC package, but I just need to know when/where I should grab it. Thanks. Marvin Nipper Director of Security Stream Global Services This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden.

2 1

[Bug 193] New: syslog-ng 3.3. 6 spins at 100% on FreeBSD with spoof-source compiled in
by bugzilla＠bugzilla.balabit.com 04 Sep '12

04 Sep '12

https://bugzilla.balabit.com/show_bug.cgi?id=193 Summary: syslog-ng 3.3.6 spins at 100% on FreeBSD with spoof- source compiled in Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: FreeBSD Status: ASSIGNED Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: algernon(a)balabit.hu ReportedBy: algernon(a)balabit.hu Type of the Report: regression Estimated Hours: 0.0 With the default syslog-ng.conf on FreeBSD, syslog-ng 3.3.6 will spin at 100% CPU when spoof source is enabled. 3.3.5 did not have this problem, neither does it happen with --disable-spoof-source, and by all accounts, this is a problem in syslog-ng, so a lib/ivykis upgrade will not help. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 12

[Bug 192] New: 3.3.6 fails to compile with --disable-spoof-source
by bugzilla＠bugzilla.balabit.com 03 Sep '12

03 Sep '12

https://bugzilla.balabit.com/show_bug.cgi?id=192 Summary: 3.3.6 fails to compile with --disable-spoof-source Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: dreisner(a)archlinux.org Type of the Report: --- Estimated Hours: 0.0 Created an attachment (id=65) --> (https://bugzilla.balabit.com/attachment.cgi?id=65) fix build with --disable-spoof-source modules/afsocket/afinet.c misses some #ifdef protection of AFInetDestDriver.spoof_source, which leads to compilation failures with --disable-spoof-source. afinet.c: In function 'afinet_dd_init': afinet.c:545:11: error: 'AFInetDestDriver' has no member named 'spoof_source' mv -f .deps/libafsocket_notls_la-afsocket-plugin.Tpo .deps/libafsocket_notls_la-afsocket-plugin.Plo mv -f .deps/libafsocket_notls_la-afsocket-parser.Tpo .deps/libafsocket_notls_la-afsocket-parser.Plo make[4]: *** [libafsocket_notls_la-afinet.lo] Error 1 make[4]: *** Waiting for unfinished jobs.... mv -f .deps/libafsocket_tls_la-afsocket-parser.Tpo .deps/libafsocket_tls_la-afsocket-parser.Plo afinet.c: In function 'afinet_dd_init': afinet.c:545:11: error: 'AFInetDestDriver' has no member named 'spoof_source' It looks like your public facing git repo isn't updated yet for the 3.3.x branch, so the attached patch is against the 3.3.6 tarball. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6