Skip to Main Content
Network Security Hacks
book

Network Security Hacks

by Andrew Lockhart
April 2004
Intermediate to advanced content levelIntermediate to advanced
320 pages
9h 10m
English
O'Reilly Media, Inc.
Content preview from Network Security Hacks

Run a Central Syslog Server

Keep your logs safe from attackers by storing them remotely.

Once an intruder has gained entry into one of your systems, how are you to know when or if this has happened? By checking your logs, of course. What if the intruder modified the logs? In this situation, centralized logging definitely saves the day. After all, if a machine is compromised but the log evidence isn’t kept on that machine, it’s going to be much more difficult for the attacker to cover his tracks. In addition to providing an extra level of protection, it’s also much easier to monitor the logs for a whole network of machines when they’re all in one place.

To quickly set up a central syslog server, just start your syslogd with the switch that causes it to listen for messages from remote machines on a UDP port.

This is done under Linux by specifying the -r command-line option:

# /usr/sbin/syslogd -m 0 -r

Under FreeBSD, run syslogd without the -s command-line option:

# /usr/sbin/syslogd

The -s option causes FreeBSD’s syslogd to not listen for remote connections. FreeBSD’s syslogd also allows you to restrict what hosts it will receive messages from. To set these restrictions, use the -a option, which has the following forms:

            ipaddr/mask[:service] 
     domain[:service]
     *domain[:service]

The first form allows you to specify a single IP address or group of IP addresses by using the appropriate netmask. The service option allows you to specify a source UDP port. If nothing is specified, it defaults to ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Start your free trial

You might also like

Linux: Powerful Server Administration

Linux: Powerful Server Administration

Uday Sawant, Oliver Pelz, Jonathan Hobson, William Leemans

Publisher Resources

ISBN: 0596006438Catalog PageErrata