Keep your logs safe from attackers by storing them remotely.
Once an intruder has gained entry into one of your systems, how are you to know when or if this has happened? By checking your logs, of course. What if the intruder modified the logs? In this situation, centralized logging definitely saves the day. After all, if a machine is compromised but the log evidence isn’t kept on that machine, it’s going to be much more difficult for the attacker to cover his tracks. In addition to providing an extra level of protection, it’s also much easier to monitor the logs for a whole network of machines when they’re all in one place.
To quickly set up a central syslog server, just start your syslogd with the switch that causes it to listen for messages from remote machines on a UDP port.
This is done under Linux by specifying the -r command-line option:
# /usr/sbin/syslogd -m 0 -r
Under FreeBSD, run syslogd without the -s command-line option:
# /usr/sbin/syslogd
The -s option causes FreeBSD’s syslogd to not listen for remote connections. FreeBSD’s syslogd also allows you to restrict what hosts it will receive messages from. To set these restrictions, use the -a option, which has the following forms:
ipaddr/mask[:service]
domain[:service]
*domain[:service]
The first form allows you to specify a single IP address or group of IP addresses by using the appropriate netmask. The service option allows you to specify a source UDP port. If nothing is specified, it defaults to port 514, which is the default for the syslog service. The next two forms allow you to restrict access to a specific domain name, as determined by a reverse lookup of the IP address of the connecting host. The difference between the second and third is the use of the * wildcard character, which specifies that all machines ending in domain may connect.
Moving on, OpenBSD uses the -u option to listen for remote connections:
# /usr/sbin/syslogd -a /var/empty/dev/log -u
whereas Solaris’s syslogd uses -T:
# /usr/sbin/syslogd -T
Now let’s set up the clients. If you want to forward all logging traffic from a machine to your central log host, simply put the following in your /etc/syslog.conf:
*.* @loghost
You can either make this the only line in the configuration file, in which case messages will be logged only to the remote host, or add it to what is already there, in which case logs will be stored both locally and remotely for safekeeping.
One drawback to remote logging is that the stock syslogd for most operating systems fails to provide any measure of authentication or access control with regard to who may write to a central log host. Firewalls can provide some protection, keeping out everyone but those who are determined to undermine your logging infrastructure; however, someone who has already gained access to your local network can easily spoof his network connection and bypass any firewall rules that you set up. If you’ve determined that this is a concern for your network, take a look at [Hack #59], which discusses one method for setting up remote logging using public-key authentication and SSL-encrypted connections.