Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

420

|

Chapter 12: System Log Management and Monitoring

Setting Syslog-ng’s Startup Parameters

Syslog-ng reads most of its configuration information from its syslog-ng.conf file,

which normally resides in /etc/syslog-ng. However, a number of crucial behaviors

must be passed to the syslog-ng command as arguments (flags). Flags supported by

the syslog-ng daemon, Versions 1.6 and higher, are listed in Table 12-6.

Most of these are self-explanatory, but the last three are of special note.

-C allows

you to specify a chroot jail for Syslog-ng to run in.

-u and -g allow you to specify a

nonprivileged user account and group, respectively, for Syslog-ng to run as.

These three flags go together: if you chroot Syslog-ng but allow it to run as root

(which it does by default), an attacker will have a much easier time breaking out of

the chroot jail.

Building a chroot jail for Syslog-ng

To set up a nonprivileged account, a nonprivileged group, and a chroot jail for

Syslog-ng, follow this procedure:

1. su to root if you’re not root already.

2. Create an unprivileged group account for Syslog-ng, e.g., by adding the follow-

ing line to /etc/group:

syslogng:x:77:

3. Create an unprivileged system account for Syslog-ng, e.g., via the following com-

mand:

bash-# useradd -d /var/logjail -g syslogng -r syslogng

(Note ...