Solved

How do I enable rhost (ie. the remote IP) to be recorded in the log entry in /var/log/secure?

Posted on 2010-09-21
7
1,097 Views
Last Modified: 2012-05-10
Server: Centos 5.5

Failed login attempts are currently logged in /var/log/secure, but the related ip address is not logged in this log entry.  How do we add the ip address to also be logged (just like it is for ssh log entries).  Here is an example of what is currently being logged:

/var/log/secure
Sep 20 19:27:30 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): check pass; user unknown
Sep 20 19:27:30 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Sep 20 19:27:30 firstkings dsm_om_connsvcd: pam_succeed_if(omauth:auth): error retrieving information about user afdafsdfa
Sep 20 19:29:48 firstkings sshd[24793]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=98.225.96.217  user=root
Sep 20 19:29:50 firstkings sshd[24793]: Failed password for root from 98.225.96.217 port 33789 ssh2
Sep 20 19:20:07 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): check pass; user unknown
Sep 20 19:20:07 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Sep 20 19:20:07 firstkings dsm_om_connsvcd: pam_succeed_if(omauth:auth): error retrieving information about user dffd
Sep 20 19:20:19 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): check pass; user unknown
Sep 20 19:20:19 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Sep 20 19:20:19 firstkings dsm_om_connsvcd: pam_succeed_if(omauth:auth): error retrieving information about user alsdfjldfja
0
Comment
Question by:iRapture
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 2
7 Comments
 
LVL 27

Expert Comment

by:Nopius
ID: 33779016
It seems there is way to enable  it in /var/log/secure, because it doesn't provide remote IP to the pam module. Also it seems it doesn't use tcp wrappers (were you can log every attempt in /etc/hosts.allow and /etc/hosts.deny).
What you can do is enable iptables logging, like:

iptables -I INPUT -p tcp -m tcp -m state --state NEW --dport 443 -j LOG --log-level 3 --log-tcp-options

the result in /var/log/messages will look as:

Sep 28 06:58:20 www kernel: IN=eth0 OUT= MAC=00:02:b3:bf:fd:79:00:d0:02:XX:38:0a:XX:00 SRC=82.X.X.91 DST=216.X.X.226 LEN=52 TOS=0x00 PREC=0x00 TTL=117 ID=9964 DF PROTO=TCP SPT=49540 DPT=443 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (020405B40103030201010402)

0
 

Author Comment

by:iRapture
ID: 33781771
iptables -I VZ_INPUT -p tcp --dport 1311 -j LOG --log-tcp-options --log-prefix "***port1311***"

/var/log/secure:
Sep 28 12:50:18 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): check pass; user unknown
Sep 28 12:50:18 firstkings dsm_om_connsvcd: pam_unix(omauth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Sep 28 12:50:18 firstkings dsm_om_connsvcd: pam_succeed_if(omauth:auth): error retrieving information about user test
 
/var/log/messages (partial activity from a single connection):
Sep 28 12:50:21 firstkings kernel: ***port1311***IN=bond0 OUT= MAC=84:2b:2b:19:03:be:00:d0:00:42:d4:0a:08:00 SRC=98.225.96.217 DST=209.104.11.10 LEN=40 TOS=0x00 PREC=0x20 TTL=116 ID=14772 DF PROTO=TCP SPT=33791 DPT=1311 WINDOW=16425 RES=0x00 ACK URGP=0
Sep 28 12:50:21 firstkings kernel: ***port1311***IN=bond0 OUT= MAC=84:2b:2b:19:03:be:00:d0:00:42:d4:0a:08:00 SRC=98.225.96.217 DST=209.104.11.10 LEN=40 TOS=0x00 PREC=0x20 TTL=116 ID=14773 DF PROTO=TCP SPT=33791 DPT=1311 WINDOW=16425 RES=0x00 ACK URGP=0

The remote ip is recorded in /var/log/messages but it is not in a log entry that says 'failure'.  The log entry in /var/log/secure says 'failure' but does not include the ip address
0
 
LVL 27

Expert Comment

by:Nopius
ID: 33784334
to restrict log to only one line per connection use -m state --state NEW
to log iptables info to /var/log/secure change your /etc/syslog.conf

authpriv.* /var/log/secure

to

authpriv.*,kernel.info /var/log/secure

restart syslog and add --log-level 6 to iptables rule

then you may grep few lines before 'failure' log entry:

grep -B 2 /var/log/secure failure
0
Manage your data center from practically anywhere

The KN8164V features HD resolution of 1920 x 1200, FIPS 140-2 with level 1 security standards and virtual media transmissions at twice the speed. Built for reliability, the KN series provides local console and remote over IP access, ensuring 24/7 availability to all servers.

 

Author Comment

by:iRapture
ID: 33784581
After doing this, new entries are not recorded in /var/log/secure if I enter a bad login/password at 209.104.11.10:1311.

Entries are still recorded in /var/log/messages but they don't say that there was an authentication failure:
Sep 28 17:55:37 firstkings kernel: ***port1311***IN=bond0 OUT= MAC=84:2b:2b:19:03:be:00:d0:00:42:d4:0a:08:00 SRC=98.225.96.217 DST=209.104.11.10 LEN=40 TOS=0x00 PREC=0x20 TTL=116 ID=5379 DF PROTO=TCP SPT=33217 DPT=1311 WINDOW=0 RES=0x00 ACK RST URGP=0

0
 

Accepted Solution

by:
iRapture earned 0 total points
ID: 34003809
Solution:

create new log file with cron job that is executed every minute and then parse this log file.
0
 

Author Comment

by:iRapture
ID: 34003818
solved
0
 

Author Closing Comment

by:iRapture
ID: 34031711
solved
0

Featured Post

When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot has fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

To setup a SonicWALL for policy based routing to be used with the Websense Content Gateway there are several steps that need to be completed. Below is a rough guide for accomplishing this. One thing of note is this guide is intended to assist in the…
Note: for this to work properly you need to use a Cross-Over network cable. 1. Connect both servers S1 and S2 on the second network slots respectively. Note that you can use the 1st slots but usually these would be occupied by the Service Provide…
Finding and deleting duplicate (picture) files can be a time consuming task. My wife and I, our three kids and their families all share one dilemma: Managing our pictures. Between desktops, laptops, phones, tablets, and cameras; over the last decade…

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question