Linux

Ask something
Discussion Locked

TCP/IP Wrapper with syslog.conf Setting.

0 helpful
3 replies

by lintadsl

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi,

First, I will tell you what I have and want.
Second, I will ask you how/what.
Last, I will tell you what the current sitiation.

Thank you for reaing and any idea would be appreciated.

First,
I have installed TCP/IP Wrapper because I would like to mornitoring on all services(FTP, WWW, TELNET, SSH, SMTP, rlogin, etc...). When I looked at the syslog.conf,
*.info;mail.none;news.none;authpriv.none /var/log/messages <--- is this means all info, mail, news, and authpriv events go to to /var/log/messages file?

Second, HOW/WHAT.
1) How can I add rlogin, ssh and SMTP on messages file? So that when I open /var/log/messages, I can see rlogin and SSH events if there was something going on.

2) What is the defferences between /var/log/messages and syslog file from TCP/IP Wrapper? I assume the messages file is made by Linux OS it self.

Last,
When I excuted tcpdchk, I got this;
[root@webserver /home]# tcpdchk
warning: /etc/hosts.allow, line 7: host address 192.168.1.29->name lookup failed
warning: /etc/hosts.allow, line 9: host address 192.168.1.101->name lookup failed
warning: /etc/hosts.allow, line 11: host address 192.168.1.36->name lookup failed
warning: /etc/hosts.allow, line 13: host address 192.168.1.30->name lookup failed
warning: /etc/hosts.allow, line 15: host address 192.168.1.32->name lookup failed

I took the advence way that leave daemon along, and configured inet.conf setting. For example, FTP service, I changed the line;
ftp stream tcp nowait root /usr/etc/tcpd in.ftpd -L -l -i -a
Origianlly tcpd is in /usr/sbin because telnet is still using tcpd where /usr/sbin.

Even I restart inetd, my FTP service is working fine with tcpd daemon from Wrapper(I believe).

3 replies

by net_chip

First, by defaut, all the messages will go to /var/log/messages. You do not need to add anything in /etc/syslog.conf ... The *.info will actually record all the necessary information into /var/log/messages.

Second 2)TCP/IP wrapper is a security package, used to protect unauthorized access through ftp, telnet and some of the services.
syslog is the system logging facility which helps to provide an audit trail for all the system activities (normal and abnormal) into /var/log/messages.

Last, I presume you do not have a DNS to resolve your internal/private IPs. It's time to set one up ..

by lintadsl

Thanks, but what is the difference between massages file from Linux(default) and log file from TCP/IP wrapper?

How can I add more services to watch such as rlogin, ssh and etc. so I can look at the log file from TCP/IP wrapper.

Why do I need to set the DNS to reslove my internal/private IPs? Just the way of avoid error from tcpchk?

This discussion is closed to new replies.