Solved

How do I enable rhost (ie. the remote IP) to be recorded in the log entry in /var/log/secure?

Posted on 2010-09-21
7
1,067 Views
Last Modified: 2012-05-10
Server: Centos 5.5

Failed login attempts are currently logged in /var/log/secure, but the related ip address is not logged in this log entry.  How do we add the ip address to also be logged (just like it is for ssh log entries).  Here is an example of what is currently being logged:

/var/log/secure
Sep 20 19:27:30 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): check pass; user unknown
Sep 20 19:27:30 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Sep 20 19:27:30 firstkings dsm_om_connsvcd: pam_succeed_if(omauth:auth): error retrieving information about user afdafsdfa
Sep 20 19:29:48 firstkings sshd[24793]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=98.225.96.217  user=root
Sep 20 19:29:50 firstkings sshd[24793]: Failed password for root from 98.225.96.217 port 33789 ssh2
Sep 20 19:20:07 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): check pass; user unknown
Sep 20 19:20:07 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Sep 20 19:20:07 firstkings dsm_om_connsvcd: pam_succeed_if(omauth:auth): error retrieving information about user dffd
Sep 20 19:20:19 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): check pass; user unknown
Sep 20 19:20:19 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Sep 20 19:20:19 firstkings dsm_om_connsvcd: pam_succeed_if(omauth:auth): error retrieving information about user alsdfjldfja
0
Comment
Question by:iRapture
  • 5
  • 2
7 Comments
 
LVL 27

Expert Comment

by:Nopius
ID: 33779016
It seems there is way to enable  it in /var/log/secure, because it doesn't provide remote IP to the pam module. Also it seems it doesn't use tcp wrappers (were you can log every attempt in /etc/hosts.allow and /etc/hosts.deny).
What you can do is enable iptables logging, like:

iptables -I INPUT -p tcp -m tcp -m state --state NEW --dport 443 -j LOG --log-level 3 --log-tcp-options

the result in /var/log/messages will look as:

Sep 28 06:58:20 www kernel: IN=eth0 OUT= MAC=00:02:b3:bf:fd:79:00:d0:02:XX:38:0a:XX:00 SRC=82.X.X.91 DST=216.X.X.226 LEN=52 TOS=0x00 PREC=0x00 TTL=117 ID=9964 DF PROTO=TCP SPT=49540 DPT=443 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (020405B40103030201010402)

0
 

Author Comment

by:iRapture
ID: 33781771
iptables -I VZ_INPUT -p tcp --dport 1311 -j LOG --log-tcp-options --log-prefix "***port1311***"

/var/log/secure:
Sep 28 12:50:18 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): check pass; user unknown
Sep 28 12:50:18 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Sep 28 12:50:18 firstkings dsm_om_connsvcd: pam_succeed_if(omauth:auth): error retrieving information about user test
 
/var/log/messages (partial activity from a single connection):
Sep 28 12:50:21 firstkings kernel: ***port1311***IN=bond0 OUT= MAC=84:2b:2b:19:03:be:00:d0:00:42:d4:0a:08:00 SRC=98.225.96.217 DST=209.104.11.10 LEN=40 TOS=0x00 PREC=0x20 TTL=116 ID=14772 DF PROTO=TCP SPT=33791 DPT=1311 WINDOW=16425 RES=0x00 ACK URGP=0
Sep 28 12:50:21 firstkings kernel: ***port1311***IN=bond0 OUT= MAC=84:2b:2b:19:03:be:00:d0:00:42:d4:0a:08:00 SRC=98.225.96.217 DST=209.104.11.10 LEN=40 TOS=0x00 PREC=0x20 TTL=116 ID=14773 DF PROTO=TCP SPT=33791 DPT=1311 WINDOW=16425 RES=0x00 ACK URGP=0

The remote ip is recorded in /var/log/messages but it is not in a log entry that says 'failure'.  The log entry in /var/log/secure says 'failure' but does not include the ip address
0
 
LVL 27

Expert Comment

by:Nopius
ID: 33784334
to restrict log to only one line per connection use -m state --state NEW
to log iptables info to /var/log/secure change your /etc/syslog.conf

authpriv.* /var/log/secure

to

authpriv.*,kernel.info /var/log/secure

restart syslog and add --log-level 6 to iptables rule

then you may grep few lines before 'failure' log entry:

grep -B 2 /var/log/secure failure
0
Master Your Team's Linux and Cloud Stack!

The average business loses $13.5M per year to ineffective training (per 1,000 employees). Keep ahead of the competition and combine in-person quality with online cost and flexibility by training with Linux Academy.

 

Author Comment

by:iRapture
ID: 33784581
After doing this, new entries are not recorded in /var/log/secure if I enter a bad login/password at 209.104.11.10:1311.

Entries are still recorded in /var/log/messages but they don't say that there was an authentication failure:
Sep 28 17:55:37 firstkings kernel: ***port1311***IN=bond0 OUT= MAC=84:2b:2b:19:03:be:00:d0:00:42:d4:0a:08:00 SRC=98.225.96.217 DST=209.104.11.10 LEN=40 TOS=0x00 PREC=0x20 TTL=116 ID=5379 DF PROTO=TCP SPT=33217 DPT=1311 WINDOW=0 RES=0x00 ACK RST URGP=0

0
 

Accepted Solution

by:
iRapture earned 0 total points
ID: 34003809
Solution:

create new log file with cron job that is executed every minute and then parse this log file.
0
 

Author Comment

by:iRapture
ID: 34003818
solved
0
 

Author Closing Comment

by:iRapture
ID: 34031711
solved
0

Featured Post

Three Reasons Why Backup is Strategic

Backup is strategic to your business because your data is strategic to your business. Without backup, your business will fail. This white paper explains why it is vital for you to design and immediately execute a backup strategy to protect 100 percent of your data.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you are like regular user of computer nowadays, a good bet that your home computer is on right now, all exposed to world of Internet to be exploited by somebody you do not know and you never will. Internet security issues has been getting worse d…
BIND is the most widely used Name Server. A Name Server is the one that translates a site name to it's IP address. There is a new bug in BIND (https://kb.isc.org/article/AA-01272), affecting all versions of BIND 9 from BIND 9.1.0 (inclusive) thro…
This Micro Tutorial will give you a basic overview how to record your screen with Microsoft Expression Encoder. This program is still free and open for the public to download. This will be demonstrated using Microsoft Expression Encoder 4.
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

816 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now