On May 18, 2011, at 2:51 PM, Mr Dash Four wrote: > Having been waiting for this for ages, the ability to use the (pretty > robust and secure) audit structure in Linux to log traffic has been > finally integrated into the kernel, together with its supporting files > and extensions in iptables. Unfortunately, this would be available in > .39 version and above of the kernel, which is quite a long way away. > > The new AUDIT target logs the following elements of any traffic and is > protocol independent (so it could be used equally well in iptables and > ebtables): > > - netfilter hook > - packet length > - incomming/outgoing interface > - MAC src/dst/proto for ethernet packets > - src/dst/protocol address for IPv4/IPv6 > - src/dst port for TCP/UDP/UDPLITE > - icmp type/code > > This data is available through the audit daemon (auditd) and is also > retrievable using standard audit tools (ausearch/aureport). > > I was able to bring all relevant code and integrate it into the .35 > version of the kernel, together with the latest version of iptables > (1.4.10) and conducted various tests over the past 2 days. It works a > treat! > > The problem I am now having is that I had to be very "creative" and do > some rather ugly hacks to integrate it into the test harness and thought > that it would be better to ask here if I could replace the standard log > mechanism on shorewall with the new AUDIT target? This is how it works > (some very rudimentary example from the man page of the AUDIT target): > > iptables -N AUDIT_DROP > iptables -A AUDIT_DROP -j AUDIT --type DROP > iptables -A AUDIT_DROP -j DROP > > A rule which would typically drop a packet would then invoke the new > chain to record packets before dropping them. The "--type" above has one > function only - to indicate to the audit daemon the type of operation > logged - one of: drop, reject or accept. > > Full logs are stored, securely, and these are retrievable, together with > all security-related events on the system, using ausearch and aureport - > no need to use anything else and since I use both tools extensively on > all my systems here I could apply filters to the type of events I am > interested in without having the need to look at all syslogs and such. > > So, is this doable in shorewall? >
Sounds easy -- I assume that the --type values are all upper case? I'll work up a patch against 4.4.20-Beta2 if you would be willing to test it. -Tom Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
PGP.sig
Description: This is a digitally signed message part
------------------------------------------------------------------------------ What Every C/C++ and Fortran developer Should Know! Read this article and learn how Intel has extended the reach of its next-generation tools to help Windows* and Linux* C/C++ and Fortran developers boost performance applications - including clusters. http://p.sf.net/sfu/intel-dev2devmay
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
