Bugtraq mailing list archives
Re: DoS-ing sysklogd?
From: Christophe Garault <bugtraq () garault org>
Date: Mon, 03 Apr 2006 13:14:36 +0200
Milen Rangelov wrote:
I know that good IP filtering on the sysklogd box is the best fix, but always resolving hostnames of the log messages' sender is definitely not a good idea..
That's why you should use syslog-ng instead. With it you can tweak all the DNS parameters (see below) and create filters to drop unwanted log messages.
From syslog-ng.conf man page:
use_dns(yes|no) Enable or disable DNS usage. syslog-ng blocks on DNS queries, so enabling DNS may lead to a Denial of Service attack. To prevent DoS, protect your syslog-ng network endpoint with fire- wall rules, and make sure that all hosts, which may get to syslog-ng is resolvable. use_fqdn(yes|no) Add Fully Qualified Domain Name instead of short hostname. check_hostname(yes|no) Enable or disable whether the hostname contains valid characters. bad_hostname(regex) A regexp which matches hostnames which should not be taken as such. dns_cache(yes|no) Enable or disable DNS cache usage. dns_cache_expire(n) Number of seconds while a successful lookup is cached. dns_cache_expire_failed(n) Number of seconds while a failed lookup is cached. dns_cache_size(n) Number of hostnames in the DNS cache. Hth. -- Christophe Garault
Current thread:
- DoS-ing sysklogd? Milen Rangelov (Apr 01)
- Re: DoS-ing sysklogd? Bernhard Fischer (Apr 04)
- Re: DoS-ing sysklogd? Christophe Garault (Apr 04)
- <Possible follow-ups>
- RE: DoS-ing sysklogd? Justin Shore (Apr 03)