Solved

How do I enable rhost (ie. the remote IP) to be recorded in the log entry in /var/log/secure?

Posted on 2010-09-21
7
1,053 Views
Last Modified: 2012-05-10
Server: Centos 5.5

Failed login attempts are currently logged in /var/log/secure, but the related ip address is not logged in this log entry.  How do we add the ip address to also be logged (just like it is for ssh log entries).  Here is an example of what is currently being logged:

/var/log/secure
Sep 20 19:27:30 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): check pass; user unknown
Sep 20 19:27:30 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Sep 20 19:27:30 firstkings dsm_om_connsvcd: pam_succeed_if(omauth:auth): error retrieving information about user afdafsdfa
Sep 20 19:29:48 firstkings sshd[24793]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=98.225.96.217  user=root
Sep 20 19:29:50 firstkings sshd[24793]: Failed password for root from 98.225.96.217 port 33789 ssh2
Sep 20 19:20:07 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): check pass; user unknown
Sep 20 19:20:07 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Sep 20 19:20:07 firstkings dsm_om_connsvcd: pam_succeed_if(omauth:auth): error retrieving information about user dffd
Sep 20 19:20:19 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): check pass; user unknown
Sep 20 19:20:19 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Sep 20 19:20:19 firstkings dsm_om_connsvcd: pam_succeed_if(omauth:auth): error retrieving information about user alsdfjldfja
0
Comment
Question by:iRapture
  • 5
  • 2
7 Comments
 
LVL 27

Expert Comment

by:Nopius
ID: 33779016
It seems there is way to enable  it in /var/log/secure, because it doesn't provide remote IP to the pam module. Also it seems it doesn't use tcp wrappers (were you can log every attempt in /etc/hosts.allow and /etc/hosts.deny).
What you can do is enable iptables logging, like:

iptables -I INPUT -p tcp -m tcp -m state --state NEW --dport 443 -j LOG --log-level 3 --log-tcp-options

the result in /var/log/messages will look as:

Sep 28 06:58:20 www kernel: IN=eth0 OUT= MAC=00:02:b3:bf:fd:79:00:d0:02:XX:38:0a:XX:00 SRC=82.X.X.91 DST=216.X.X.226 LEN=52 TOS=0x00 PREC=0x00 TTL=117 ID=9964 DF PROTO=TCP SPT=49540 DPT=443 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (020405B40103030201010402)

0
 

Author Comment

by:iRapture
ID: 33781771
iptables -I VZ_INPUT -p tcp --dport 1311 -j LOG --log-tcp-options --log-prefix "***port1311***"

/var/log/secure:
Sep 28 12:50:18 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): check pass; user unknown
Sep 28 12:50:18 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Sep 28 12:50:18 firstkings dsm_om_connsvcd: pam_succeed_if(omauth:auth): error retrieving information about user test
 
/var/log/messages (partial activity from a single connection):
Sep 28 12:50:21 firstkings kernel: ***port1311***IN=bond0 OUT= MAC=84:2b:2b:19:03:be:00:d0:00:42:d4:0a:08:00 SRC=98.225.96.217 DST=209.104.11.10 LEN=40 TOS=0x00 PREC=0x20 TTL=116 ID=14772 DF PROTO=TCP SPT=33791 DPT=1311 WINDOW=16425 RES=0x00 ACK URGP=0
Sep 28 12:50:21 firstkings kernel: ***port1311***IN=bond0 OUT= MAC=84:2b:2b:19:03:be:00:d0:00:42:d4:0a:08:00 SRC=98.225.96.217 DST=209.104.11.10 LEN=40 TOS=0x00 PREC=0x20 TTL=116 ID=14773 DF PROTO=TCP SPT=33791 DPT=1311 WINDOW=16425 RES=0x00 ACK URGP=0

The remote ip is recorded in /var/log/messages but it is not in a log entry that says 'failure'.  The log entry in /var/log/secure says 'failure' but does not include the ip address
0
 
LVL 27

Expert Comment

by:Nopius
ID: 33784334
to restrict log to only one line per connection use -m state --state NEW
to log iptables info to /var/log/secure change your /etc/syslog.conf

authpriv.* /var/log/secure

to

authpriv.*,kernel.info /var/log/secure

restart syslog and add --log-level 6 to iptables rule

then you may grep few lines before 'failure' log entry:

grep -B 2 /var/log/secure failure
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 

Author Comment

by:iRapture
ID: 33784581
After doing this, new entries are not recorded in /var/log/secure if I enter a bad login/password at 209.104.11.10:1311.

Entries are still recorded in /var/log/messages but they don't say that there was an authentication failure:
Sep 28 17:55:37 firstkings kernel: ***port1311***IN=bond0 OUT= MAC=84:2b:2b:19:03:be:00:d0:00:42:d4:0a:08:00 SRC=98.225.96.217 DST=209.104.11.10 LEN=40 TOS=0x00 PREC=0x20 TTL=116 ID=5379 DF PROTO=TCP SPT=33217 DPT=1311 WINDOW=0 RES=0x00 ACK RST URGP=0

0
 

Accepted Solution

by:
iRapture earned 0 total points
ID: 34003809
Solution:

create new log file with cron job that is executed every minute and then parse this log file.
0
 

Author Comment

by:iRapture
ID: 34003818
solved
0
 

Author Closing Comment

by:iRapture
ID: 34031711
solved
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Suggested Solutions

​Being a Managed Services Provider (MSP) has presented you  with challenges in the past— and by meeting those challenges you’ve reaped the rewards of success.  In 2014, challenges and rewards remain; but as the Internet and business environment evol…
BIND is the most widely used Name Server. A Name Server is the one that translates a site name to it's IP address. There is a new bug in BIND (https://kb.isc.org/article/AA-01272), affecting all versions of BIND 9 from BIND 9.1.0 (inclusive) thro…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now