bugtraq - Re: DoS-ing sysklogd?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 03 Apr 2006 13:14:36 +0200
From: Christophe Garault <bugtraq@...ault.org>
To: Milen Rangelov <mrangelov@...bul.bg>
Cc: bugtraq@...urityfocus.com
Subject: Re: DoS-ing sysklogd?


Milen Rangelov wrote:

>I know that good IP filtering on the sysklogd box is the best fix, but
>always resolving hostnames of the log messages' sender is definitely not
>a good idea..
>  
>
That's why you should use syslog-ng instead. With it you can tweak all
the DNS parameters (see below) and create filters to drop unwanted log
messages.

>From syslog-ng.conf man page:

       use_dns(yes|no)
              Enable or disable DNS usage.  syslog-ng blocks on DNS
queries, so enabling DNS may lead  to  a
              Denial  of Service attack.  To prevent DoS, protect your
syslog-ng network endpoint with fire-
              wall rules, and make sure that all hosts, which may get to
syslog-ng is resolvable.

       use_fqdn(yes|no)
              Add Fully Qualified Domain Name instead of short hostname.

       check_hostname(yes|no)
              Enable or disable whether the hostname contains valid
characters.

       bad_hostname(regex)
              A regexp which matches hostnames which should not be taken
as such.

       dns_cache(yes|no)
              Enable or disable DNS cache usage.

       dns_cache_expire(n)
              Number of seconds while a successful lookup is cached.

       dns_cache_expire_failed(n)
              Number of seconds while a failed lookup is cached.

       dns_cache_size(n)
              Number of hostnames in the DNS cache.

Hth.

-- 
Christophe Garault