Section 4.10 The syslogd Service
4.10 The syslogd Service
The syslogd facility is used by many of the daemons and the kernel to log error messages and advisory messages. It has a facility to accept messages from remote systems for logging over UDP port 514. This is a convenient way to consolidate messages from multiple systems and then just scan and review one set of log files. Recent versions of syslogd require the -r flag to enable it to listen on UDP port 514 for messages from remote systems to be logged. This is a welcome security enhancement that allows the large majority of systems that do not make use of this feature to be immune from crackers sending messages to this port. The remote logging feature can increase security by logging activity on a system remotely. Thus, if a system is compromised and all log files destroyed, you still have the data on the remote system, assuming that the remote system is not also compromised. By having a special "high-security" system with minimal services supported (to reduce the likelihood of compromise) do the logging, the chance of all logs being destroyed is minimized. This is discussed in "Monitoring Activity" on page 605. However, UDP packet spoofing is trivial. Fortunately, modern versions of syslogd (syslogd 1.3, since at least as far back as Red Hat 6.0) do not monitor UDP port 514 unless the -r flag is given. There have been some exploits that can cause a DoS by repeatedly sending packets to syslogd and deny access to legitimate clients or even to fill up disk space due to the volume of logged messages. Occasionally, a cracker will write fake log messages to various systems that have this port accessible from the Internet. There even may be ways to gain root access, though hopefully these have been fixed by the time you read this, assuming that you have the latest syslogd. Certainly, some crackers will spoof their UDP source IP, which is trivial, and then send messages. These will be logged and certainly could confuse you. They may falsely indicate a break-in because any text may be placed in them. The clear solution is to have your firewall block this port from access by sites outside the trusted network.
|
| Top |
EAN: N/A
Pages: 260