Softpanorama (slightly skeptical) Open Source Software Educational Society

May the source be with you, but remember the KISS principle ;-) Softpanorama Search

Logging access attempts with TCP Wrappers

TCP_wrappers write a message into your system logs every time a connection is requested, whether it is granted access or not. These entries in the logs above are reason enough to have TCP_wrappers installed on your system. The messages are written through the standard syslog facility and by default go to the same place as mail transactions. On my Linux distribution, Caldera Network Desktop based on Red Hat Linux, the default has been changed so that the messages are written to the same log file as other daemons (LOG_DAEMON facility).

Option fields let administrators easily change the log facility and priority level for a rule by using the severity directive.

In the following example, connections to the SSH daemon from any host in the example.com domain are logged to the the default authpriv facility (because no facility value is specified) with a priority of emerg:

sshd : .example.com : severity emerg

It is also possible to specify a facility using the severity option. The following example logs any SSH connection attempts by hosts from the example.com domain to the local0 facility with a priority of alert:

sshd : .example.com : severity local0.alert

In any event, when someone accesses my machine via telnet, a message like this is placed in the /var/log/messages:

Apr 9 17:24:58 ads in.telnetd[15339]: connect from somewhere.else.com

If the connection was refused, the message would read:

Apr 9 17:25:15 ads in.telnetd[15604]: refused connect from someother.place.com

grep telnetd /var/log/messages

in.tftpd : nasty.bad-guy.com : ( /usr/sbin/safe_finger -l @%h |\ /bin/mail -s %d->%h root) &

safe_finger @nasty.badguy.com

in.tftpd->nasty.bad-guy.com

Now, this isn't a perfect solution, since our cracker friend may have disabled his finger service or altered it to give false information; however, this example does show us the power of the TCP_wrappers program.

Old News ;-)

Configuring and using tcpwrappers

Logging Denied Connections The logging of attempted (and failed) logins is done using the syslog facility. By examining /etc/syslog.conf, you'll see # The authpriv log file should be restricted access; these # messages shouldn't go to terminals or publically-readable # files. authpriv.*;remoteauth.* /var/log/secure.log This line will cause tcpwrappers to log any attempted logins to /var/log/secure.log. Another option, is to add a line as follows:   *.info /var/log/allmessages This will log any and all notifications of actions on your system. You can then use one of the common log sifting programs to notify you of any unusual activity. This will be covered in a future article on Stepwise - Editor Note that any time you make changes to syslog.conf, you'll need to notify the syslogd process by sending it a -HUP signal, as shown above with inetd. It is also worth repeating that you should never use tabs in the /etc/syslog.conf file, only spaces.