Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

How do I enable rhost (ie. the remote IP) to be recorded in the log entry in /var/log/secure?

Posted on 2010-09-21
7
1,078 Views
Last Modified: 2012-05-10
Server: Centos 5.5

Failed login attempts are currently logged in /var/log/secure, but the related ip address is not logged in this log entry.  How do we add the ip address to also be logged (just like it is for ssh log entries).  Here is an example of what is currently being logged:

/var/log/secure
Sep 20 19:27:30 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): check pass; user unknown
Sep 20 19:27:30 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Sep 20 19:27:30 firstkings dsm_om_connsvcd: pam_succeed_if(omauth:auth): error retrieving information about user afdafsdfa
Sep 20 19:29:48 firstkings sshd[24793]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=98.225.96.217  user=root
Sep 20 19:29:50 firstkings sshd[24793]: Failed password for root from 98.225.96.217 port 33789 ssh2
Sep 20 19:20:07 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): check pass; user unknown
Sep 20 19:20:07 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Sep 20 19:20:07 firstkings dsm_om_connsvcd: pam_succeed_if(omauth:auth): error retrieving information about user dffd
Sep 20 19:20:19 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): check pass; user unknown
Sep 20 19:20:19 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Sep 20 19:20:19 firstkings dsm_om_connsvcd: pam_succeed_if(omauth:auth): error retrieving information about user alsdfjldfja
0
Comment
Question by:iRapture
  • 5
  • 2
7 Comments
 
LVL 27

Expert Comment

by:Nopius
ID: 33779016
It seems there is way to enable  it in /var/log/secure, because it doesn't provide remote IP to the pam module. Also it seems it doesn't use tcp wrappers (were you can log every attempt in /etc/hosts.allow and /etc/hosts.deny).
What you can do is enable iptables logging, like:

iptables -I INPUT -p tcp -m tcp -m state --state NEW --dport 443 -j LOG --log-level 3 --log-tcp-options

the result in /var/log/messages will look as:

Sep 28 06:58:20 www kernel: IN=eth0 OUT= MAC=00:02:b3:bf:fd:79:00:d0:02:XX:38:0a:XX:00 SRC=82.X.X.91 DST=216.X.X.226 LEN=52 TOS=0x00 PREC=0x00 TTL=117 ID=9964 DF PROTO=TCP SPT=49540 DPT=443 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (020405B40103030201010402)

0
 

Author Comment

by:iRapture
ID: 33781771
iptables -I VZ_INPUT -p tcp --dport 1311 -j LOG --log-tcp-options --log-prefix "***port1311***"

/var/log/secure:
Sep 28 12:50:18 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): check pass; user unknown
Sep 28 12:50:18 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Sep 28 12:50:18 firstkings dsm_om_connsvcd: pam_succeed_if(omauth:auth): error retrieving information about user test
 
/var/log/messages (partial activity from a single connection):
Sep 28 12:50:21 firstkings kernel: ***port1311***IN=bond0 OUT= MAC=84:2b:2b:19:03:be:00:d0:00:42:d4:0a:08:00 SRC=98.225.96.217 DST=209.104.11.10 LEN=40 TOS=0x00 PREC=0x20 TTL=116 ID=14772 DF PROTO=TCP SPT=33791 DPT=1311 WINDOW=16425 RES=0x00 ACK URGP=0
Sep 28 12:50:21 firstkings kernel: ***port1311***IN=bond0 OUT= MAC=84:2b:2b:19:03:be:00:d0:00:42:d4:0a:08:00 SRC=98.225.96.217 DST=209.104.11.10 LEN=40 TOS=0x00 PREC=0x20 TTL=116 ID=14773 DF PROTO=TCP SPT=33791 DPT=1311 WINDOW=16425 RES=0x00 ACK URGP=0

The remote ip is recorded in /var/log/messages but it is not in a log entry that says 'failure'.  The log entry in /var/log/secure says 'failure' but does not include the ip address
0
 
LVL 27

Expert Comment

by:Nopius
ID: 33784334
to restrict log to only one line per connection use -m state --state NEW
to log iptables info to /var/log/secure change your /etc/syslog.conf

authpriv.* /var/log/secure

to

authpriv.*,kernel.info /var/log/secure

restart syslog and add --log-level 6 to iptables rule

then you may grep few lines before 'failure' log entry:

grep -B 2 /var/log/secure failure
0
Connect further...control easier

With the ATEN CE624, you can now enjoy a high-quality visual experience powered by HDBaseT technology and the convenience of a single Cat6 cable to transmit uncompressed video with zero latency and multi-streaming for dual-view applications where remote access is required.

 

Author Comment

by:iRapture
ID: 33784581
After doing this, new entries are not recorded in /var/log/secure if I enter a bad login/password at 209.104.11.10:1311.

Entries are still recorded in /var/log/messages but they don't say that there was an authentication failure:
Sep 28 17:55:37 firstkings kernel: ***port1311***IN=bond0 OUT= MAC=84:2b:2b:19:03:be:00:d0:00:42:d4:0a:08:00 SRC=98.225.96.217 DST=209.104.11.10 LEN=40 TOS=0x00 PREC=0x20 TTL=116 ID=5379 DF PROTO=TCP SPT=33217 DPT=1311 WINDOW=0 RES=0x00 ACK RST URGP=0

0
 

Accepted Solution

by:
iRapture earned 0 total points
ID: 34003809
Solution:

create new log file with cron job that is executed every minute and then parse this log file.
0
 

Author Comment

by:iRapture
ID: 34003818
solved
0
 

Author Closing Comment

by:iRapture
ID: 34031711
solved
0

Featured Post

Announcing the Most Valuable Experts of 2016

MVEs are more concerned with the satisfaction of those they help than with the considerable points they can earn. They are the types of people you feel privileged to call colleagues. Join us in honoring this amazing group of Experts.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

I have seen several blogs and forum entries elsewhere state that because NTFS volumes do not support linux ownership or permissions, they cannot be used for anonymous ftp upload through the vsftpd program.   IT can be done and here's how to get i…
Note: for this to work properly you need to use a Cross-Over network cable. 1. Connect both servers S1 and S2 on the second network slots respectively. Note that you can use the 1st slots but usually these would be occupied by the Service Provide…
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question