- syslog-ng - lists.balabit.hu

REAL ESTATE!!!!!!!!!!!!!!!!!!!!!!!
by DR.JOHNSON IGE. 08 Nov '02

08 Nov '02

ATTN:SIR. ASSISTANCE REQUIRED FOR ACQUISITION OF ESTATE I write to inform you of my desire to acquire estates or landed properties in your country.Considering your very strategic and influential position I know you will be in a better possition to help us, We would want the transaction to be strictly confidential as possible,hence our desire to have an overseas agent. I have therefore been directed to inquire if you would agree to act as our overseas agent in order to actualize this transaction.The deal,in brief,is that the funds with which we intend to carry out our proposed investments in your country is presently in a coded Escrow account of a Bank in Canada. However,I am,DR.JOHNSON IGE. a native of Warri in Niger Delta,Nigeria and I am the Executive Director with the Nigerian Export Processing Zone Authority of Nigeria (NEPZA).Please accept my apology for using this medium to reach you for a transaction/business of this magnitude,but this is due to the confidentiality and prompt access reposed on this medium.Be informed that a member of the Nigerian Export promotion Council(NEPC) who was the Government delegation to your country during a trade exhibition gave your enviable credentials/particulars to me.I have decided to seek your co-operation in the execution of the deal described hereunder for the benefit of all parties and hope you will keep it as a top secret because of the nature of this business. Within my Department NEPZA where I work as a Director and with the cooperation of Two other top Management officials.We have in our possession as overdue payment bills totalling to Thirty One Million,Five hundred Thousand US Dollars(US$3I,500.000.00) which was our commission for awarding a contract to Jullius Bergger of Germany A construction firm based in Germany.This amount(US$31.5M)represent the balance of the total contract value executed on behalf of my Department by this foreign contracting firm which we the officials over-invoiced deliberately.Though the actual cost have been paid to the original contractor leaving the balance in the tune of the said amount which we have in principle gotten approval to remit by Key Tested Telegraphic Transfer(K.T.T)to any foreign bank account you will provide by filing in an application through the Bank in Canada where the fund have been lodge for the transfer of rights and priviledge of the former contractor.Our arrangement with the construction company was to deposit our over-involce sum into a save account with the bank till we retire from active service to my Ministry for investment in your country.As you Know,we are civil servant and does not have the previledge to operate a foriegn account. We have made countless effort with the management of the bank in Canada to see that the fund is transfer to another country for the propose investment,the management of the bank turn the application down that legal documentation must be effected before the fund is been transfer to any bank account.As a civil servant to the Government,we can not obtain this documents without the help or assistance of an international acclaimed personality(Foriegn Body)to fixe in as the true contractor/beneficiary to the fund,these will enable us obtain all relevant documents in your favour with the assistance of the accredited Attorney with my Ministry. We are soliciting for your mutual understanding in lodging in application to the bank in Canada as soon as all the documents is processed in your name to release or transfer the contract fund to your account.We will truely compensate you for your candid effort in this deal and as well,you will be acting as our agent for the landed/housing property in your country.Once you have confirm your willingness to help us,the name and contact address of the bank,our account information with the bank and all the relevant details of the contract fund will be given to you for your perusal and for confirmation with the bank in Canada.The cost of processing the backup documents will be a collective responsibility from both parties so your sincerity and understanding will be highly appreciated to enable us achieve success. All we need from you now is your company name & address(if any),telephone & fax numbers,your banking details and your recent picture for identification when we come over to your country for the project.As soon as i hear from you,I will give you our website to visit. Thank you so much for your understanding and I await your urgent response to this mail. Yours Faithfully, DR.JOHNSON IGE. N.E.P.Z.A.

1 0

Re: [syslog-ng]replacing Linux klogd by a chrooted syslog-ng running as a non root user
by Guillaume LACHENAL 07 Nov '02

07 Nov '02

Balazs Scheidler wrote : > On Thu, Nov 07, 2002 at 03:10:50PM +0100, Guillaume LACHENAL wrote: > > Is it for the same reasons that I have (almost) every time to send SIGTERM > > *twice* > > for syslog-ng to terminate ? > > it was a bug, and should have been fixed in latest 1.5.x release. OK. I'll upgrade when the best of syslog-ng will be configured quite fine on the box ;-) > > > then instead of using syslog-ng's own chroot feature, use the chroot > > > > Are you sure a chrooted process can follow symlinks outside the jail ? > > it's not the chrooted process which accesses the symlink, the programs > running outside are accessing a file _in_ the chroot. (symlink in /dev/log > pointing to /chroot/dev/log) Could you please explain. It works as you say with ntpd chrooted on my box. But, after 'chroot /chroot /sbin/ntpd' the running ntpd only see what's under '/chroot/'. How it works when ntpd attempt to log something ? (to /chroot/dev/log) > I remember, libc itself shouldn't be needed. ldd shows what syslog-ng is > linked to, but if it started outside, it will link to /lib/libc.so.6, and > _then_ chroot itself -> no need for libc in the jail itself. > > the others libresolv etc. are loaded after the chroot() call, so they must > be present in the jail as well. > > try rm-ing the libc inside the jail (and only libc the others might be > needed), and start syslog-ng, it _should_ work. Yes, it works

2 1

Re: [syslog-ng]logging from a chrooted process
by Guillaume LACHENAL 07 Nov '02

07 Nov '02

Balazs Scheidler wrote: > On Thu, Nov 07, 2002 at 02:30:19PM +0100, Guillaume LACHENAL wrote: > > I'm currently trying to chroot some services on a Linux box (ntpd) > > > > strace'ing it to find the missing libs, I've seen that the process can't > > log as /dev/log is outside the jail > > > > > 9135 connect(4, {sin_family=AF_UNIX, path=" /dev/log"}, 16) = -1 > > ENOENT (No such file or directory) > > > > How to make a /dev/log into the jail ? or send the log via network to a > > log collector ? > > what about a unix-stream("/var/chroot/ntp/dev/log") source to syslog-ng? ... symlinked to /dev/log Yes, you indirectly reply me in https://lists.balabit.hu/pipermail/syslog-ng/2002-November/004096.html B> configuration initialization is performed prior to chroot-ing, so syslog-ng B> first opens the necessary devices, and then chroots itself. Instead of adjusting my conf file each time a chroot a service (OK, it's not every day ;-), it would be perfect if I can write a thing like : source s_chroot { unix-stream("/chroot/*/dev/log"); }; regards, Guillaume

3 2

Re: [syslog-ng]logging from a chrooted process
by Guillaume LACHENAL 07 Nov '02

07 Nov '02

> > it would be perfect if I can write a thing like : > > > > source s_chroot { unix-stream("/chroot/*/dev/log"); }; > > I wouldn't like to implement this feature. You could write a script with the > same functionality instead that would generate you syslog-ng.conf. OK! Regards, Guillaume

1 0

internal()
by Guillaume LACHENAL 07 Nov '02

07 Nov '02

To which facility go internal() messages ? Here is my box config : Debian Linux running provided syslogd/klogd syslog-ng 1.5.21 chrooted running as a log collector for all others box in the lan the debian provided syslogd also redirect all his messages to the log collector (this piggy conf will be cleaned soon. Only syslog-ng will stay) - - syslog-ng.conf - - options { use_dns(yes); chain_hostnames(no); sync(0); }; source s_internal { internal(); }; source s_net { udp( ip(192.168.12.2) port(514) ); }; source s_ntpd { unix-stream("/chroot/ntpd/dev/log"); }; destination d_hosts { file( "/var/log/$HOST/$YEAR/$MONTH/$DAY/$FACILITY"\ create_dirs(yes) owner("root") group("root")\ perm(0600) dir_perm(0700) ); }; log { source(s_internal); source(s_net); source(s_ntpd); destination(d_hosts); }; - - syslog-ng.conf - - when grepping syslog from /var/log/MyBox/*/*/*/* I attempted to find some messages about syslog-ng. But no the only syslog occurences found only refers to debian provided syslog Where can I find internal syslog-ng messages ? Thanks

1 0

source definition with pipe / 1.4x or 1.5x
by D. Pille 07 Nov '02

07 Nov '02

Hello Balázs, I would like to migrate our servers from syslog to syslog-ng (we´re using SuSE 5.4 to 8.1, some clustered, mostly all Internet). Can you say about the next stable release or better: Should I use 1.4x now and then I can switch over to 1.5x - without greater reconfigurations? And another questions: source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); }; Is this source definition enough to leave klogd behind? Is it possible to use "pipe" in this manner for other logs - like them from proftpd? It´s for me not clear how to grep a log message in a logfile to a central log-server when the source isn´t at /proc or /dev. Will "pipe" as source driver look around the file and, if a new line appears, pipe this new lines? Regards, Detlef Pille NWN-Admin -- /"\ ASCII Ribbon Campaign \ / X No HTML in / \ email & news

2 1

Re: [syslog-ng]replacing Linux klogd by a chrooted syslog-ng running as a non root user
by Guillaume LACHENAL 07 Nov '02

07 Nov '02

Balazs Scheidler wrote : > On Thu, Nov 07, 2002 at 02:25:44PM +0100, Guillaume LACHENAL wrote: > > from http://www.campin.net/syslog-ng/faq.html > > > > As /proc/kmsg and /dev/log are outside the jail, is there a way to do the > > same thing with a chrooted syslog-ng ? > > configuration initialization is performed prior to chroot-ing, so syslog-ng > first opens the necessary devices, and then chroots itself. OK. So if I understand when using syslog-ng '-C' options there is no need that $JAIL/etc contains syslog-ng.conf. It can stay in /etc > you cannot restart the daemon though, unless you do the following: OK I've seen it. You make me not to create a new thread on the list ;-) Is it for the same reasons that I have (almost) every time to send SIGTERM *twice* for syslog-ng to terminate ? > - mount /proc under the chroot jail as well (can be mounted multiple times) > - create a symlink in /dev/log to /chroot/dev/log > > then instead of using syslog-ng's own chroot feature, use the chroot Are you sure a chrooted process can follow symlinks outside the jail ? > command, so the config initialization is performed _inside_ the jail. These > have drawbacks as well: > > - you need libc and other libs in the jail (while when starting from > outside, these are mapped from the system at startup) libc is also needed when using the '-C' switch ! ldd syslog-ng libnsl.so.1 => /lib/libnsl.so.1 (0x00126000) libc.so.6 => /lib/libc.so.6 (0x0013d000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x00110000) and I've 'discover' during my jail creation that libresolv and libnss_* are also needed (remember the thread "chroot and hostname resolution problem [was : Re: [syslog-ng]centralized loghost]") I don't think we can say it's a drawback > - /proc might provide too much information inside the jail so you might as > well run syslog-ng outside the jail ;) Exactly opposite to the secure way we try to follow ;-) > The latter problem can be solved by restricting /proc access with a patch > like openwall, and I might provide a patch for the first, to chroot first, > and then initialize. I'll check it latter, when my platform will be 100% OK and have more spare time ;-) Thanks Regards Guillaume

2 1

logging from a chrooted process
by Guillaume LACHENAL 07 Nov '02

07 Nov '02

I'm currently trying to chroot some services on a Linux box (ntpd) strace'ing it to find the missing libs, I've seen that the process can't log as /dev/log is outside the jail > 9135 connect(4, {sin_family=AF_UNIX, path=" /dev/log"}, 16) = -1 ENOENT (No such file or directory) How to make a /dev/log into the jail ? or send the log via network to a log collector ? Thanks Regards Guillaume

2 1

replacing Linux klogd by a chrooted syslog-ng running as a non root user
by Guillaume LACHENAL 07 Nov '02

07 Nov '02

from http://www.campin.net/syslog-ng/faq.html > Q: I want to replace syslogd *and* klogd on my Linux box with syslog-ng. > > A: Use a source line like this in your conf file to read kernel messages, too. > source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); }; > > Note: do not run klogd and syslog-ng fetching local kernel messages at the > same time. It may cause syslog-ng to block which makes all logging local > daemons unusable. As /proc/kmsg and /dev/log are outside the jail, is there a way to do the same thing with a chrooted syslog-ng ? Thanks Regards, Guillaume

2 1

Compile problem on Solaris (8)
by Gehring, Andrew x66132 06 Nov '02

06 Nov '02

Just downloaded 1.5.21 and libol 0.3.3. Libol compiles fine - installed into /usr/local/... I'm getting the following error with the syslog-ng compile... gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o getopt.o getopt1.o -lpthread -ldoor -lfl /usr/local/lib/libol.a -lsocket -lnsl -lxnet main.o: In function `main_loop': /opt/source/syslog-ng/syslog-ng-1.5.21/src/main.c:225: undefined reference to `res_init' Anyone else seen this? Direction? TIA Andrew

2 1