How about a "passive" syslog server?
Hi there I'm wanting to put up a syslog server that runs on an IDS. As such the "sniffed" interfaces don't have (or want) IP addresses. So what I need is a syslog server that can sniff syslog packets as they come across the interfaces in promiscous mode. There is a product called passlogd that supposedly does this - but it has always crashed on startup for me. However I was wondering if this could be a feature request for syslog-ng. Linux's netfilter has the REDIRECT rulesets which could be used to do this as well. I mean, right now we use REDIRECT so that our Squid proxy server can act as a transparent proxy server, so what about syslog-ng? As Squid requires you to enable it - I suppose syslog-ng would still need to be altered to support that option too? Anyone else tried to do this? The security advantage is that you could enable syslog in your DMZes, point them at a non-existant IP address, and your IDS could pick up those messages as they flow pass it. Any server compromise leads the hackers to believe there is a syslog server - but it's down... -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
Jason Haar on Thu, Apr 03, 2003 at 02:50:05PM +1200: Hi Jason,
Linux's netfilter has the REDIRECT rulesets which could be used to do this as well. I mean, right now we use REDIRECT so that our Squid proxy server can act as a transparent proxy server, so what about syslog-ng? As Squid requires you to enable it - I suppose syslog-ng would still need to be altered to support that option too?
I don't think you would need any special support in syslog-ng, this is basically the same principle as used in setting up ssltunnel or sshd-for- wardings. Personally, I have had no problems either to forward messages to syslog-ng using OpenBSD pf. Realize however, that if implemented like this, you're basically only ob- scuring the service, it is still as reachable as any more "visible" service would be. The good thing is, you can "sudo -u <unpriv> syslog-ng", which then can be bound to localhost:>1024 and make a mapping for the priviledged port 514.
Anyone else tried to do this? The security advantage is that you could enable syslog in your DMZes, point them at a non-existant IP address, and your IDS could pick up those messages as they flow pass it. Any server compromise leads the hackers to believe there is a syslog server - but it's down...
As the mentionned passlogd and snort have shown recently, it is not required to have a listening port of some kind to be exploitable. Grab- bing data from the wire can be vulnerable to similar problems as inter- active services. If you're using udp-based syslog, you could try to get it to work with a read-only ethernet cable .. if it's your IDS at the same time, this would add some real security IMHO. Regards, -- ____ ____ / _/| - > Gregor Binder <gb@(rootnexus.net|sysfive.com)> | / || _\ \ \__ Id: 0xE2F31C4B Fp: 8B8A 5CE3 B79B FBF1 5518 8871 0EFB AFA3 E2F3 1C4B
participants (2)
-
Gregor Binder
-
Jason Haar