- syslog-ng - lists.balabit.hu

Re: [syslog-ng]Directory permissions/ownership
by John_Delisle＠ceridian.ca 03 May '01

03 May '01

I've been waiting for such a feature for quite a while!! I know it would be very useful here, we want some logs owned by nobody for use with our httpd. Thanks! John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 |--------+--------------------------------> | | Chris Sibbitt | | | <CSibbitt(a)jetnet.ca> | | | Sent by: | | | syslog-ng-admin(a)lists.| | | balabit.hu | | | | | | | | | 2001/05/03 09:40 AM | | | Please respond to | | | syslog-ng | | | | |--------+--------------------------------> >-----------------------------------------------------------------------------------------------------------| | | | To: "'syslog-ng(a)lists.balabit.hu'" <syslog-ng(a)lists.balabit.hu> | | cc: | | Subject: [syslog-ng]Directory permissions/ownership | >-----------------------------------------------------------------------------------------------------------| After much frustration, I decided to simply add a umask(000) to the beginning of main() in order to alleviate troubles I've been having with the perm() and dir_perm() configuration directives. One thing, though, that I think is needed in the config that doesn't currently exist is dir_user() and dir_group() directives to control the ownership of created directories. Would anyone else find this useful? Chris Sibbitt JetNet Internetworking Services Inc. Providing Secure Internet Communications Phone 613-271-6220x228 FAX 613-271-6229 Email csibbitt(a)jetnet.ca Web www.jetnet.ca ********************************************************************** This e-mail and any files transmitted with it are considered confidential and are intended solely for the use of the individual or entity to whom they are addressed (intended). This communication is subject to agent/client privilege. If you are not the intended recipient (received in error) or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this is e-mail is strictly prohibited. If you have received this e-mail in error please notify the sender immediately. **********************************************************************

1 0

Directory permissions/ownership
by Chris Sibbitt 03 May '01

03 May '01

After much frustration, I decided to simply add a umask(000) to the beginning of main() in order to alleviate troubles I've been having with the perm() and dir_perm() configuration directives. One thing, though, that I think is needed in the config that doesn't currently exist is dir_user() and dir_group() directives to control the ownership of created directories. Would anyone else find this useful? Chris Sibbitt JetNet Internetworking Services Inc. Providing Secure Internet Communications Phone 613-271-6220x228 FAX 613-271-6229 Email csibbitt(a)jetnet.ca Web www.jetnet.ca <http://www.jetnet.ca/>

1 0

$PROGRAM
by Saku Ytti 03 May '01

03 May '01

I'd like to use destination all with $PROGRAM, but rather than creating PROGRAM like it's reported, I'd like to use filename as it is after last '/'. ie. /usr/sbin/cron would be just cron. Also some other magic could be done to check it's sanity. I'm just checking if there is already a patch, so that I wouldn't need to revinvent the wheel. -- ytti

1 0

[PATCH] chroot and drop root priviledges
by Tommi Virtanen 02 May '01

02 May '01

# This is for the Debian bug tracking system, see http://bugs.debian.org/94898 forwarded 94898 syslog-ng(a)lists.balabit.hu thanks Here's a patch to implement -C, -u and -g command line options, for chrooting, changing uid and gid, respectively. My syslog-ng is happily chrooted into /var/log/syslog-ng, and runs as syslogng:syslogng. Notes: - it still needs write access to the logs; I just chowned the tree to syslogng - it binds to /dev/log etc before chroot/userid switch, so it still works; however, if you change sources and try to reload config, it probably won't have access to open the new sources. - if you store the config outside the chroot, reload won't work. - I had to change the child->parent notify mechanism, as the old kill(getppid(), SIGTERM) trick didn't work after the uid switch. Now it has a pipe open to parent, parent waits on read(). I took the opportunity to make it signal success to the parent by writing a nil byte; parent changes exit value based on whether it saw the nil or not. diff -Naur syslog-ng-1.5.4.original/src/main.c syslog-ng-1.5.4/src/main.c --- syslog-ng-1.5.4.original/src/main.c Wed Nov 29 13:21:31 2000 +++ syslog-ng-1.5.4/src/main.c Sun Apr 22 21:36:14 2001 @@ -38,6 +38,8 @@ #include <errno.h> #include <string.h> #include <getopt.h> +#include <pwd.h> +#include <grp.h> #include "main.c.x" @@ -186,13 +188,29 @@ return 0; } +#define READ 0 +#define WRITE 1 void go_background() { pid_t pid; - + int pipefd[2]; + char buf; + + if (pipe(pipefd) < 0) { + werror("Cannot pipe(), (%z)\n", strerror(errno)); + exit(1); + } pid = fork(); if (pid == 0) { - int fd = open(pidfilename, O_CREAT | O_WRONLY | O_NOCTTY | O_TRUNC, 0600); + int fd; + if (pipefd[WRITE]!=1) { + if (dup2(pipefd[WRITE], 1) < 0) { + werror("Cannot set pipe as stdout, (%z)\n", strerror(errno)); + exit(1); + } + (void) close(pipefd[WRITE]); + } + fd = open(pidfilename, O_CREAT | O_WRONLY | O_NOCTTY | O_TRUNC, 0600); if (fd != -1) { struct ol_string *pid_s = c_format("%i\n", getpid()); write(fd, pid_s->data, pid_s->length); @@ -205,10 +223,13 @@ werror("Cannot fork(), (%z)\n", strerror(errno)); exit(1); } - signal(SIGTERM, sig_term); - while (sigtermrecvd == 0) - pause(); - exit(0); + + if (read(pipefd[READ], &buf, 1) == 1 + && buf=='\0') { + exit(0); + } else { + exit(1); + } } void usage(void) @@ -221,6 +242,9 @@ " -f <fname>, --cfgfile=<fname> Set config file name, default=" PATH_SYSLOG_NG_CONF "\n" " -V, --version Display version number (" PACKAGE " " VERSION ")\n" " -p <fname>, --pidfile=<fname> Set pid file name, default=" PATH_PIDFILE "\n" + " -C <dir>, --chroot=<dir> Chroot to directory\n" + " -u <user>, --user=<user> Switch to user\n" + " -g <group>, --group=<group> Switch to group\n" #ifdef YYDEBUG " -y, --yydebug Turn on yacc debug messages\n" #endif @@ -233,10 +257,45 @@ extern int yydebug; #endif +void nametouidgid(const char* user, uid_t *uid, gid_t *gid) +{ + struct passwd* pw; + pw = getpwnam(user); + + if (pw) { + *uid=pw->pw_uid; + if (gid) + *gid=pw->pw_gid; + } +} + +void nametogid(const char* group, gid_t *gid) +{ + struct group* gr; + gr = getgrnam(group); + + if (gr) { + *gid=gr->gr_gid; + } +} + +int dropprivileges(uid_t uid, gid_t gid) +{ + if ( setgid(gid) != 0 || setuid(uid) != 0 ) { + return -1; + } else { + return 0; + } +} + + int main(int argc, char **argv) { int do_fork = 1; int opt; + char *chrootdir = NULL; + uid_t uid = 0; + gid_t gid = 0; NEW(syslog_backend, backend); struct option syslog_ng_options[] = { @@ -246,6 +305,9 @@ { "verbose", no_argument, NULL, 'v' }, { "help", no_argument, NULL, 'h' }, { "version", no_argument, NULL, 'V' }, + { "chroot", required_argument, NULL, 'C' }, + { "user", required_argument, NULL, 'u' }, + { "group", required_argument, NULL, 'g' }, #ifdef YYDEBUG { "yydebug", no_argument, NULL, 'y' }, #endif @@ -257,7 +319,7 @@ gc_idle_threshold = 100; gc_busy_threshold = 3000; - while ((opt = getopt_long(argc, argv, "f:p:dvhyV", syslog_ng_options, NULL)) != -1) { + while ((opt = getopt_long(argc, argv, "f:p:dvhC:u:yV", syslog_ng_options, NULL)) != -1) { switch (opt) { case 'f': strncpy(cfgfilename, optarg, sizeof(cfgfilename)); @@ -265,6 +327,21 @@ case 'p': strncpy(pidfilename, optarg, sizeof(pidfilename)); break; + case 'C': + if (!optarg[0]) + usage(); + chrootdir = optarg; + break; + case 'u': + nametouidgid(optarg, &uid, gid ? NULL : &gid); + if (uid == 0 || gid == 0) + usage(); + break; + case 'g': + nametogid(optarg, &gid); + if (gid == 0) + usage(); + break; case 'd': debug_flag++; break; @@ -286,6 +363,8 @@ } } + if (uid == 0 && gid != 0) + werror("Cannot use -g without -u"); init_backend(&backend->super); backend->configuration = make_syslog_config(cfgfilename, &backend->super); @@ -301,17 +380,28 @@ } if (!CONFIG_INIT(backend->configuration, NULL)) { werror("Error initializing configuration, exiting.\n"); - if (do_fork) kill(getppid(), SIGTERM); return 2; } + if (chrootdir) { + if (chroot(chrootdir) < 0) { + werror("Error chrooting, exiting.\n"); + return 3; + } + } + if (uid) { + if (dropprivileges(uid, gid) < 0) { + werror("Error in setuid/setgid, exiting.\n"); + return 4; + } + } if (do_fork) { set_error_internal(); close(0); - close(1); close(2); setsid(); - kill(getppid(), SIGTERM); + write(1, "", 1); + close(1); } notice("syslog-ng version %z starting\n", VERSION); return main_loop(backend); -- tv@{{hq.yok.utu,havoc,gaeshido}.fi,{debian,wanderer}.org,stonesoft.com} unix, linux, debian, networks, security, | First snow, then silence. kernel, TCP/IP, C, perl, free software, | This thousand dollar screen dies mail, www, sw devel, unix admin, hacks. | so beautifully.

2 1

RE: [syslog-ng]Syslog messages are getting combined...
by Scott, Joshua 02 May '01

02 May '01

Here are a few lines from syslog that are combined... Apr 26 13:46:20 dnsserver OK" proto=ht<27>named[10268]: check_hints: no A records for nccnt01.jacobs.com class 1 in hints Apr 26 13:46:20 dnsserver 0 OK" proto<29>named[10268]: check_root: 1 root servers after query to root server < min Apr 26 13:57:40 dnsserver - Bryan, TX\\\"<p<29>named[9492]: starting (/etc/named.conf). named 8.2.3-REL After the time and the hostname there is some extra data that comes from my firewalls syslog messages. Then comes named and it's data. -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Friday, April 27, 2001 1:59 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Syslog messages are getting combined... On Thu, Apr 26, 2001 at 01:47:17PM -0400, Scott, Joshua wrote: > Has anyone ever had an issue where sometimes you get the information from > one syslog message combined with another syslog message? Every one in a > while I get some of my firewall syslog messages combined with messages from > my DNS servers. This causes my scripts to fail since there is invalid data > in the log message. Can anyone shed some light for me? Thank you very > much! Could you send me some examples. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Does syslog-ng have a message character limit?
by Brian Leveille 02 May '01

02 May '01

I have a device sending syslog messages that are getting truncated to 250 characters. Anyone else seen this with syslog-ng? Brian Leveille ------------------- Senior Internetworking Engineer DefendNet Solutions, Inc. http://www.defendnet.com

3 2

-HUP to 1.4.11 doesn't close file descriptors?
by Adrian Chung 01 May '01

01 May '01

Hi all, I'm noticing some strange behaviour with syslog-ng 1.4.11 and libol 0.2.21. I've got named running in a chroot'd environment, with it's own /var/named/dev/log. Syslog-ng is configured to use both /dev/log and /var/named/dev/log as unix-stream sources, with output going to /var/daemon.log. When I logrotate the /var/log/daemon.log file, logging from named completely stops. It doesn't appear anywhere. Even after sending HUP signals to both named and syslog-ng. The only way that logging resumes is if I completely kill and restart syslog-ng. Seems like syslog-ng isn't flushing it's file handles? -- Adrian Chung - adrian(a)enfusion-group.com http://www.enfusion-group.com/~adrian 1:23pm up 75 days, 19:21 - [rogue.enfusion-group.com]

2 1

Future plans and ideas for syslog-ng...
by Nick DeClario 30 Apr '01

30 Apr '01

Hey guys, I was wondering what ideas and improvements are in the works for syslog-ng? Any thoughts or plans for including encryption in a future release? Regards, -Nick

1 0

syslog for proxy
by Cafferata Cristiano 27 Apr '01

27 Apr '01

hi, i'm looking for a program for nt platform able to receive syslogs from a proxy server .... it's the first time that i talk about syslog and it's the first time that i have to use it ..... please help me... thanks a lot and sorry for my english . bye * * * * * * * * * * * * * * * Cristiano Cafferata CC4191-RIPE ESPLIT Spa Servizio Tecnico Cristiano.Cafferata(a)esplit.it Via SS Giacomo e Filippo 19/6 16122 - Genova - Italy Phone +39 010881825 Fax +39 010 882743 * * * * * * * * * * * * * * *

1 0

Syslog messages are getting combined...
by Scott, Joshua 27 Apr '01

27 Apr '01

Has anyone ever had an issue where sometimes you get the information from one syslog message combined with another syslog message? Every one in a while I get some of my firewall syslog messages combined with messages from my DNS servers. This causes my scripts to fail since there is invalid data in the log message. Can anyone shed some light for me? Thank you very much! Joshua Scott Jacobs Engineering

3 2