Security Handbook/Logging

Article description::System administrators should choose between different system loggers in order to gain better viability into attacks.

== Logging == Additional verbosity on logging should be added to catch warnings or errors that might indicate an ongoing attack or a successful compromise. Attackers often scan or probe before directly attacking a targeted system.

It is also vital that log files are easily readable and manageable. System administrators are able choose between system loggers and should choose a logger that best fits their need for system security.

Sysklogd
Sysklogd is the most common logger for Linux and Unix in general. It has some log rotation facilities, but using in a cron job (logrotate is configured in ) might prove to be more powerful as logrotate has many features. How often log rotation should be done depends on the system load.

Below is the standard with some added features. The following cron and tty lines have been uncommented and a remote logging server had been added. To further enhance security could add logging to two places.

Attackers will most likely try to erase their tracks by editing or deleting log files. System administrators can make covering up evidence more difficult by logging to one or more remote logging servers. Get more info about sysklogd by executing.

Metalog
Metalog by Frank Dennis is not able to log to a remote server, but it does have advantages when it comes to performance and logging flexibility. It can log by program name, urgency, facility (like sysklogd), and comes with regular expression matching with which you can launch external scripts when specific patterns are found. It is very good at taking action when needed.

The standard configuration is usually enough. To be notified by email whenever a password failure occurs use one of the following scripts.

For postfix:

For netqmail:

Remember to make the script executable by issuing

Then uncomment the command line under "Password failures" in like:

Syslog-ng
Syslog-ng provides some of the same features as sysklogd and metalog with a small difference. It can filter messages based on level and content (like metalog), provide remote logging like sysklogd, handle logs from syslog (even streams from Solaris), write to a TTY, execute programs, and it can act as a logging server. Basically it is the best of both loggers combined with advanced configuration.

Below is a classic configuration file slightly modified.

Syslog-ng is very easy to configure, but it is also very easy to miss something in the configuration file since it is huge. The author still promises some extra features like encryption, authentication, compression and MAC (Mandatory Access Control) control. With these options it will be a perfect for network logging, since the attacker cannot spy on the log.

And syslog-ng does have one other advantage: it does not have to run as root!

Log analysis with Logcheck
Of course, keeping logs alone is only half the battle. An application such as Logcheck can make regular log analysis much easier. is a script, accompanied by a binary called, that runs from the cron daemon and checks the system logs against a set of rules for suspicious activity. It then mails the output to root's mailbox.

and are part of the  package.

Logcheck uses four files to filter important log entries from the unimportant:


 * - Contains known hacking attack messages.
 * - Contains patterns indicating security violations.
 * - Contains keywords likely to be matched by the violations file, allowing normal entries to be ignored.
 * - matches those entries to be ignored.