Hello, I'm using openSUSE Leap and Tumbleweed, which both come with firewalld enabled. I wanted to see who is trying to access my computers and enabled the logs, but it writes to the normal journal and floods the entries there with an awful lot of messages that make the thing unreadable. I didn't find a way to specify a different file to log the dropped packets to, other than enabling rsyslog. Is there a way to keep using journald and still have the firewall log in a separate file?
Thank you.
Andreas
On 05.06.2024 20:22, Andreas Croci wrote:
Hello, I'm using openSUSE Leap and Tumbleweed, which both come with firewalld enabled. I wanted to see who is trying to access my computers and enabled the logs, but it writes to the normal journal and floods the entries there with an awful lot of messages that make the thing unreadable. I didn't find a way to specify a different file to log the dropped packets to, other than enabling rsyslog. Is there a way to keep using journald and still have the firewall log in a separate file?
man firewalld
--log-target=file --log-file=...
Am 05.06.2024 um 20:46:59 Uhr schrieb Andrei Borzenkov:
man firewalld
--log-target=file --log-file=...
How is that affected by the setting LogDenied=all
in firewalld.conf? Is there a way to specify it there instead of changing the way firewalld is invoked by the systemd unit?
Is there a way to let it log to journald directly? Current versions of Debian don't have rsyslog enabled by default and I also prefer to have one place for logs instead of having logs redundant on my disk.
Interesting: my man firewalld mentions no --log-file, but firewalld -h, which I admit not having tried before, does. I must have a different version of the man page.
--log-target=file is not mentioned in any of them.
Like Marco Moock, I would also like to know if there is a way to specify that in the config file instead of in the service.
On 05/06/24 19:46, Andrei Borzenkov wrote:
On 05.06.2024 20:22, Andreas Croci wrote:
Hello, I'm using openSUSE Leap and Tumbleweed, which both come with firewalld enabled. I wanted to see who is trying to access my computers and enabled the logs, but it writes to the normal journal and floods the entries there with an awful lot of messages that make the thing unreadable. I didn't find a way to specify a different file to log the dropped packets to, other than enabling rsyslog. Is there a way to keep using journald and still have the firewall log in a separate file?
man firewalld
--log-target=file
--log-file=...
firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
OpenSUSE Leap 15.5. In TW it does indeed. Mysteries of the versioning. But having read that, your question makes more sense, I mean like wanting the dropped packets information to go to their own file and not together with the debug messages.
On 05/06/2024 20:24, Marco Moock wrote:
Am 05.06.2024 um 20:16:38 Uhr schrieb Andreas Croci:
Interesting: my man firewalld mentions no --log-file, but firewalld -h,
Which OS?
I run Debian 12 and it mentions that option in the manpage.
On Wed, Jun 5, 2024 at 9:36 PM Andreas Croci andrea.croci@gmx.de wrote:
OpenSUSE Leap 15.5. In TW it does indeed. Mysteries of the versioning. But having read that, your question makes more sense, I mean like wanting the dropped packets information to go to their own file and not together with the debug messages.
Dropped packet information comes from the kernel, not from the firewalld. firewalld just configures message prefix, that's all. To split them into separate files you need a tool that reads kernel messages and filters them based on some criteria. systemd-journald does not filter incoming messages by design, so yes, you need something like rsyslog or syslog-ng or similar.
Or you can filter when reading messages with journalctl.
But firewalld has no influence on where these messages go.
On 05/06/2024 20:24, Marco Moock wrote:
Am 05.06.2024 um 20:16:38 Uhr schrieb Andreas Croci:
Interesting: my man firewalld mentions no --log-file, but firewalld -h,
Which OS?
I run Debian 12 and it mentions that option in the manpage.
-- _______________________________________________ firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Am 06.06.2024 um 10:39:25 Uhr schrieb Andrei Borzenkov:
Dropped packet information comes from the kernel, not from the firewalld. [...]
But firewalld has no influence on where these messages go.
What is the proper way to control the logging of the kernel/dmesg? dmesg is bad because that shows up on the virtual consoles by default and messes them up.
On Thu, Jun 06, 2024 at 10:04:49AM +0200, Marco Moock wrote:
Am 06.06.2024 um 10:39:25 Uhr schrieb Andrei Borzenkov:
Dropped packet information comes from the kernel, not from the firewalld. [...]
But firewalld has no influence on where these messages go.
What is the proper way to control the logging of the kernel/dmesg? dmesg is bad because that shows up on the virtual consoles by default and messes them up.
There is currently no way to log dropped packets to anything other than dmesg. This has been discussed many times. In the semi recent past we decided this should be done by depending on ulogd2. Firewalld will use a well known NFLOG group then ulogd2 can then send the log to syslog.
Issue: https://github.com/firewalld/firewalld/issues/1094#issuecomment-1468065266 stale draft PR: https://github.com/firewalld/firewalld/pull/1316
Op donderdag 6 juni 2024 17:16:02 CEST schreef Eric Garver:
There is currently no way to log dropped packets to anything other than dmesg. This has been discussed many times. In the semi recent past we decided this should be done by depending on ulogd2. Firewalld will use a well known NFLOG group then ulogd2 can then send the log to syslog.
There is rsyslog in which you can separate all kinds of messages. So you can put all messages that you indicated using firewalld into, i.e., the file /var/ log/firewall .
Am 06.06.2024 um 18:15:28 Uhr schrieb Freek de Kruijf:
There is rsyslog in which you can separate all kinds of messages. So you can put all messages that you indicated using firewalld into, i.e., the file /var/ log/firewall .
Does logging to rsyslog work when LogDenied=off is set? It annoys me that the logs flood the ttys, the location is irrelevant as long as I can access it in any way.
On Thu, Jun 06, 2024 at 07:42:42PM +0200, Marco Moock wrote:
Am 06.06.2024 um 18:15:28 Uhr schrieb Freek de Kruijf:
There is rsyslog in which you can separate all kinds of messages. So you can put all messages that you indicated using firewalld into, i.e., the file /var/ log/firewall .
Does logging to rsyslog work when LogDenied=off is set?
No. It has not been implemented.
It annoys me that the logs flood the ttys, the location is irrelevant as long as I can access it in any way.
-- Gruß Marco
Send unsolicited bulk mail to 1717690528muell@cartoonies.org
firewalld-users mailing list -- firewalld-users@lists.fedorahosted.org To unsubscribe send an email to firewalld-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/firewalld-users@lists.fedorahos... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Op donderdag 6 juni 2024 20:46:15 CEST schreef Eric Garver:
On Thu, Jun 06, 2024 at 07:42:42PM +0200, Marco Moock wrote:
Am 06.06.2024 um 18:15:28 Uhr schrieb Freek de Kruijf:
There is rsyslog in which you can separate all kinds of messages. So you can put all messages that you indicated using firewalld into, i.e., the file /var/ log/firewall .
Does logging to rsyslog work when LogDenied=off is set?
No. It has not been implemented.
I have logging on a server for the regular services on that server, so not logging of denied packages. This amounts up to around 11,000 lines per 24 hours in the log.
Apart from that server, I have a honeypot which gets all traffic to non- regular ports; only TCP. This amounts to around 15,000 lines per 24 hours in the log.
These logs are reported to the SANS institute (dshield.org).
It annoys me that the logs flood the ttys, the location is irrelevant as long as I can access it in any way.
In rsyslog you can prevent any logging to a tty.
On Thu, Jun 6, 2024 at 8:42 PM Marco Moock mm@dorfdsl.de wrote:
Am 06.06.2024 um 18:15:28 Uhr schrieb Freek de Kruijf:
There is rsyslog in which you can separate all kinds of messages. So you can put all messages that you indicated using firewalld into, i.e., the file /var/ log/firewall .
Does logging to rsyslog work when LogDenied=off is set? It annoys me that the logs flood the ttys, the location is irrelevant as long as I can access it in any way.
There seems to be some confusion.
Kernel places messages in the internal ring buffer. User space can fetch messages from this buffer (that is what dmesg or logging daemons like rsyslog do) and dispatch them as needed.
Kernel can also print messages above the defined level directly to console. it can be disabled (or at least, you can set the level to be higher than "warning" that is the default for netfilter logs). It does not impact the access to the kernel buffer in any way.
As mentioned earlier in this thread, there is PR to support NFLOG for denied logs. You will need a user space daemon to receive and dispatch these messages. To my best knowledge, systemd-journald does not support NFLOG; I do not know if rsyslog/syslog-ng do. So it will need yet another one logging daemon.
firewalld already supports NFLOG in custom rules (zone definition or rich rules). Maybe it is possible to add explicit rules that log would-be-denied packages. I have not looked into it.
firewalld-users@lists.fedorahosted.org
-
Andreas Croci -
Andrei Borzenkov -
Eric Garver -
Freek de Kruijf -
Marco Moock