Network Security Hacks

Run a Central Syslog Server

Keep your logs safe from attackers by storing them remotely.

Once an intruder has gained entry into one of your systems, how are you to know when or if this has happened? By checking your logs, of course. What if the intruder modified the logs? In this situation, centralized logging definitely saves the day. After all, if a machine is compromised but the log evidence isn’t kept on that machine, it’s going to be much more difficult for the attacker to cover his tracks. In addition to providing an extra level of protection, it’s also much easier to monitor the logs for a whole network of machines when they’re all in one place.

To quickly set up a central syslog server, just start your syslogd with the switch that causes it to listen for messages from remote machines on a UDP port.

This is done under Linux by specifying the -r command-line option:

# /usr/sbin/syslogd -m 0 -r

Under FreeBSD, run syslogd without the -s command-line option:

# /usr/sbin/syslogd

The -s option causes FreeBSD’s syslogd to not listen for remote connections. FreeBSD’s syslogd also allows you to restrict what hosts it will receive messages from. To set these restrictions, use the -a option, which has the following forms:

            ipaddr/mask[:service] 
     domain[:service]
     *domain[:service]

The first form allows you to specify a single IP address or group of IP addresses by using the appropriate netmask. The service option allows you to specify a source UDP port. If nothing is specified, it defaults to ...