similar to: ipfw2 logging

Hi, in the kernel I have these lines: [...] device miibus # MII bus support device rl device ed options IPFIREWALL #firewall options IPFIREWALL_VERBOSE #enable logging to syslogd(8) options IPFIREWALL_VERBOSE_LIMIT=0 #limit verbosity options IPDIVERT #divert sockets options DUMMYNET

Heya.. Yesterday someone "attacked" by box by connection to several ports.. In other words, a simple portscan.. yet, since my box has "log_in_vain" enabled, so it tries to log everything to /var/log/messages, since the logfile got full and the size went over 100K, it tried to rotate the log to save diskspace. (Apr 16 21:00:00 omikron newsyslog[32137]: logfile turned over due

I made a quick change to syslogd(8) so that it can drop root privileges immediately after starting up. It opens up the log sockets (UNIX and network domains) and writes the PID files before dropping privs. It drops privs before openning log files and writing to users. Therefore, you would need to modify your log file permissions appropriately. As for writing to users, ttys generally are writeable

Hello, My entry for newsyslog in /etc/crontab is: 0 * * * * root newsyslog -t \%Y-\%m-\%d_\%H:\%M And I get: newsyslog: Could not convert time string to time value: No such file or directory I try to use the newsyslog from head to to avail. This solution was working a month ago (see Revision 248776) My file system is zfs version 28. Henri

hi all i'm trying to get ipfilter set up on my new 5.1-RELEASE box. ipfilter seems to be working fine. i just have a couple of issues that are probably not very serious... one thing is that during network startup at boot, i get the message IPFilter: already initialized repeated 4 times. i think i have everything configured properly my kernel config looks like options IPFILTER options

Dear FreeBSD! I would like to use custom rules file with ipfw2. My computer goes to the net via dial-up modem and kernel ppp type. Since I don't have experience with dinamic rules, but want to, reading tutorials stranded me somewhere in the middle. In this moment I need recall of known links to docs about topic. Provider gives new address every time when connected. One machine. Via ppp...

I'm noticing something strange on two of my machines.. They're both 4.7-RELEASE-p3 i386 and they've both been up 150 days without any problems... /var/log/messages on each system contains only: Jun 9 12:00:01 in newsyslog[60291]: logfile turned over dmesg's output is truncated.. it periodically changes, but currently it reads: ite.net host=6532251hfc207.tampabay.rr.com

Hi folks, I've been working on getting my WiFi network running with IPsec. I'm at the point where all traffic on the wifi subnet is encrypted (i.e. ESP). Then I tried to add AH to the equation. I failed. This picture describes the network setup: http://beta.freebsddiary.org/images/ipsec-wireless.gif Here's what I'm trying and failing with. With these rules, I get no

Security pundits have been warning about the dangers implicit with Web services for years. A good starting point for understanding the security issues related to Web services can be found at: http://searchwebservices.techtarget.com/originalContent/0,289142,sid26_gci872720,00.html Of course to really understand the security risks posed by Web services, you need to understand the basics of Web

Can anyone help with this. Bridge is enabled, even in sysctl. Firewall is enabled and configured. But my reality is done this way.. Cisco (NATing 192.168.1.0/24) ---- Freebsd Bridge (Public IP) ------ stations (Public IP) (NATing 172.16.0.0/24 192.168.1.xx or something similar) 172.16.0.xx and on one public IP one

I installed FreeBSD 10 from a BETA cd-rom. I chose 'experimental ZFS on root - mirror'. The FreeBSD firewall will not load. Any suggestions? This is from 'dmesg': KLD ipfw.ko: depends on kernel - not available or version mismatch linker_load_file: Unsupported file type This is from 'ls -l' of /boot drwxr-xr-x 2 root wheel 1.5K Nov 28 21:55 kernel/ This is from

I'm running a few servers sitting on top of a NetAPP file server ? everything runs great, but periodically I'm getting: nfs_getpages: error 13 vm_fault: pager read error, pid 11355 (https) errors on my screen ? not always same pid ? the annoying part is that it seems to always affect the same jail that is running .. if I shutdown all jails on that physical server, everything shuts down

Using FreeBSD-7.2, I am attempting to configure the system newsyslog utility to rotate the dovecot.log file. I would prefer to use the system utility rather than the one described on the dovecot wiki for rotating the file. Unfortunately, it is not working. This is the error message that is spawned: newsyslog: illegal signal number in config file: /var/log/dovecot.log root:wheel 0666 1 *

All: I'm posting this to FreeBSD-security (rather than FreeBSD-net) because the problems I'm seeing appear to have been caused by spyware, and because they constitute a possible avenue for denial of service on FreeBSD machines with default installs of the operating system. Several of the FreeBSD machines on our network began to act strangely during the past week. Some have started to

[ -netters, please Cc me or security@ with replies. ] I'm running into trouble integrating dynamic racoon-based IPSec into a network with ipfw and natd. I need to be able to allow VPN access from any address from authenticated clients. I've got the dynamic VPN working, with racoon negotiating SAs and installing SPs, but the problem is that I can't tell whether an incoming packet on

Just rebuilt and installed/world kernel: FreeBSD 4.8-STABLE #0: Fri Apr 11 14:34:37 EDT 2003 Using the latest Makefile for squid25: # fgrep \$FreeBSD /usr/ports/www/squid/Makefile # $FreeBSD: ports/www/squid/Makefile,v 1.100 2003/04/09 08:31:30 adrian Exp $ Modified with: # fgrep CONFIGURE_ARGS Makefile |fgrep -v \# CONFIGURE_ARGS= --bindir=${PREFIX}/sbin --sysconfdir=${PREFIX}/etc/squid \

Hello list. I would like to get your opinion on what is a safe multi-user environment. The scenario: We would like to offer to some customers of ours some sort of network backup/archive. They would put daily or weekly backups from their local machine on our server using rsync and SSH. Therefore, they all have a user account on our server. However, we must ensure that they would absolutely not be

On Sat, 29 May 2004 12:00:52 -0700 (PDT), <freebsd-security-request@freebsd.org> wrote: Hello ! Today i see in snort logs : [**] [1:528:4] BAD-TRAFFIC loopback traffic [**] [Classification: Potentially Bad Traffic] [Priority: 2] 06/07-09:44:39.044590 127.0.0.1:80 -> 10.6.148.173:1566 TCP TTL:128 TOS:0x0 ID:577 IpLen:20 DgmLen:40 ***A*R** Seq: 0x0 Ack: 0x75830001 Win: 0x0 TcpLen:

Hello, I am looking for some advice. I am trying to force dovecot to run to the same log as exim does. In dovecot.conf I put the exim log path /var/log/exim/mainlog. I restarted dovecot and the process worked fine. However at midnight exim log file is rotated and since then dovecot stops logging to this log. In syslog.conf I put: mail.*

hi - this is my first post to this list so go easy on me ! I am trying to find info on using ipfw2 with freebsd 5.2.1 as I have read that it supports MAC address based firewalling. Situation is, I have a small externally managed VPN network, about 12 different subnets all terminating in my office location, and all managed by a tier 1 telco. Problem is, their CPE routers do not have any firewalling