How do I enable rhost (ie. the remote IP) to be recorded in the log entry in /var/log/secure?

Server: Centos 5.5

Failed login attempts are currently logged in /var/log/secure, but the related ip address is not logged in this log entry.  How do we add the ip address to also be logged (just like it is for ssh log entries).  Here is an example of what is currently being logged:

/var/log/secure
Sep 20 19:27:30 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): check pass; user unknown
Sep 20 19:27:30 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Sep 20 19:27:30 firstkings dsm_om_connsvcd: pam_succeed_if(omauth:auth): error retrieving information about user afdafsdfa
Sep 20 19:29:48 firstkings sshd[24793]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=98.225.96.217  user=root
Sep 20 19:29:50 firstkings sshd[24793]: Failed password for root from 98.225.96.217 port 33789 ssh2
Sep 20 19:20:07 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): check pass; user unknown
Sep 20 19:20:07 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Sep 20 19:20:07 firstkings dsm_om_connsvcd: pam_succeed_if(omauth:auth): error retrieving information about user dffd
Sep 20 19:20:19 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): check pass; user unknown
Sep 20 19:20:19 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Sep 20 19:20:19 firstkings dsm_om_connsvcd: pam_succeed_if(omauth:auth): error retrieving information about user alsdfjldfja
iRaptureAsked:
Who is Participating?
 
iRaptureConnect With a Mentor Author Commented:
Solution:

create new log file with cron job that is executed every minute and then parse this log file.
0
 
NopiusCommented:
It seems there is way to enable  it in /var/log/secure, because it doesn't provide remote IP to the pam module. Also it seems it doesn't use tcp wrappers (were you can log every attempt in /etc/hosts.allow and /etc/hosts.deny).
What you can do is enable iptables logging, like:

iptables -I INPUT -p tcp -m tcp -m state --state NEW --dport 443 -j LOG --log-level 3 --log-tcp-options

the result in /var/log/messages will look as:

Sep 28 06:58:20 www kernel: IN=eth0 OUT= MAC=00:02:b3:bf:fd:79:00:d0:02:XX:38:0a:XX:00 SRC=82.X.X.91 DST=216.X.X.226 LEN=52 TOS=0x00 PREC=0x00 TTL=117 ID=9964 DF PROTO=TCP SPT=49540 DPT=443 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (020405B40103030201010402)

0
 
iRaptureAuthor Commented:
iptables -I VZ_INPUT -p tcp --dport 1311 -j LOG --log-tcp-options --log-prefix "***port1311***"

/var/log/secure:
Sep 28 12:50:18 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): check pass; user unknown
Sep 28 12:50:18 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Sep 28 12:50:18 firstkings dsm_om_connsvcd: pam_succeed_if(omauth:auth): error retrieving information about user test
 
/var/log/messages (partial activity from a single connection):
Sep 28 12:50:21 firstkings kernel: ***port1311***IN=bond0 OUT= MAC=84:2b:2b:19:03:be:00:d0:00:42:d4:0a:08:00 SRC=98.225.96.217 DST=209.104.11.10 LEN=40 TOS=0x00 PREC=0x20 TTL=116 ID=14772 DF PROTO=TCP SPT=33791 DPT=1311 WINDOW=16425 RES=0x00 ACK URGP=0
Sep 28 12:50:21 firstkings kernel: ***port1311***IN=bond0 OUT= MAC=84:2b:2b:19:03:be:00:d0:00:42:d4:0a:08:00 SRC=98.225.96.217 DST=209.104.11.10 LEN=40 TOS=0x00 PREC=0x20 TTL=116 ID=14773 DF PROTO=TCP SPT=33791 DPT=1311 WINDOW=16425 RES=0x00 ACK URGP=0

The remote ip is recorded in /var/log/messages but it is not in a log entry that says 'failure'.  The log entry in /var/log/secure says 'failure' but does not include the ip address
0
Managing Security & Risk at the Speed of Business

Gartner Research VP, Neil McDonald & AlgoSec CTO, Prof. Avishai Wool, discuss the business-driven approach to automated security policy management, its benefits and how to align security policy management with business processes to address today's security challenges.

 
NopiusCommented:
to restrict log to only one line per connection use -m state --state NEW
to log iptables info to /var/log/secure change your /etc/syslog.conf

authpriv.* /var/log/secure

to

authpriv.*,kernel.info /var/log/secure

restart syslog and add --log-level 6 to iptables rule

then you may grep few lines before 'failure' log entry:

grep -B 2 /var/log/secure failure
0
 
iRaptureAuthor Commented:
After doing this, new entries are not recorded in /var/log/secure if I enter a bad login/password at 209.104.11.10:1311.

Entries are still recorded in /var/log/messages but they don't say that there was an authentication failure:
Sep 28 17:55:37 firstkings kernel: ***port1311***IN=bond0 OUT= MAC=84:2b:2b:19:03:be:00:d0:00:42:d4:0a:08:00 SRC=98.225.96.217 DST=209.104.11.10 LEN=40 TOS=0x00 PREC=0x20 TTL=116 ID=5379 DF PROTO=TCP SPT=33217 DPT=1311 WINDOW=0 RES=0x00 ACK RST URGP=0

0
 
iRaptureAuthor Commented:
solved
0
 
iRaptureAuthor Commented:
solved
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.