protecting syslog

[Hrvoje Dubravica]

Hi,

how to prevent someone else to send their syslogs entries to my server?

Thank you in advance

Hrvoje

[Steven Gillard_2 · Accepted solution]

If you run syslogd with the -N argument it won't listen on the UDP socket, hence preventing all remote messages. To make this change permanent add -N to the SYSLOGD_OPTS variable in /etc/rc.config.d/syslogd.

If its specific sources you want to allow/prevent, you'll need to block them at a firewall or install IPFilter.

Regards,
Steve

[harry d brown jr]

Change the starting of syslogd with the "-N" option. Of course the best thing to do is to stop the offending machine from sending it in the first place!

live free or die
harry

[Chris Wilshaw]

In /etc/services, there is the following entry;

syslog 514/udp # remote system logging

If you comment out this line, then run

inetd -c

this should re-read the config, and disable communication on that port, blocking out other systems, but leaving the local one still able to report to the log.

[Massimo Bianchi]

HI,
others suggested you great idea to solve the problem, but i ask you a question: what are you loggin in your syslog ? Will you lose something that may be important if you prevent external source to write in the syslog? maybe router logs or similar...

Massimo

[Hrvoje Dubravica]

Hi Massimo,

my customer want protect
his server from unauthorized
writing on it, contents of log is
not importen now, but at the same time
customer want to allow authorized writing.

Kind regards,

Hrvoje