need some advice on connections logs

[richard childers / kg6hac]

>Date: Fri, 10 Dec 2004 19:01:59 -0500
>From: Bob Ababurko <ababurko at adelphia.net>
>Subject: need some advice on connections logs
>
>
>Hello-
>
>What is the best way to deal with getting logs for someone attacking my 
>box?  I am not really sure, but I think it may involve tcpdump.  Is 
>there any way to implement this so that it can be running before an 
>attack happens?.....see the problem is, that I do not have physical 
>access to the box and if it is taken down(unaccessible by remote means), 
>I cannot log in to start a dump.  What can I do in this case, or what 
>are my options, if I want to have the network connections dumped somehow 
>with no intervention?....is that a tall order?
>
>Thanks,
>Bob
>

Bob,

I would recommend that, along with the excellent recommendations for 
logging syslogd(8) output to another machine, that you install a 
firewall, if this is an option.

Although a firewall may not deter the attacks, it is an excellent 
mechanism for collecting forensic data, IE, the details you need to 
prosecute the person or persons whom are attacking your system. 
Consider, for instance, the massive amount of evidence created, in 
replicate, if every one of your servers has a firewall installed, and 
someone scans your network; it's difficult for a jury to argue with that 
sort of detail.

You can configure the firewall to log every single connection, 
separately from accepting or rejecting, so that you can in theory log 
successful as well as unsuccessful connections.

And, yes, if you want to log in even greater detail, you could set up a 
tcpdump(8) session that ran and collected all network traffic, too, and 
just leave it running, or turn it into a crontab entry that restarts it 
every hour, and manages each hour of logs, separately.

Naturally, all of this translates into a lot of data, so make sure you 
have a few gigabytes of space somewhere, ahead of time, and do some 
back-of-the-envelope calculations to see exactly how much you can 
accumulate before you need to start deleting logs. For instance, if it 
turns out that you have enough room to hold 30 days worth of data, in 
worst-case scenarios involving 7x24 denial-of-service attacks intended 
to create huge logs, you might want to add another crontab entry 
cleaning out all logs over 15 days.

It's a lot of work but when you are done you will be able to rest much 
more easily.

Good luck!


Regards,

-- richard

-- 

Richard Childers / Senior Engineer
Daemonized Networking Services
945 Taraval Street, #105
San Francisco, CA 94116 USA
[011.]1.415.759.5571
http://www.daemonized.com

'A well-schooled electorate, being necessary to the security of
 a free State, the right of the people to keep and read Books,
 shall not be infringed.' -- (Attributed to J. Neil Shulman)

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.2.4 (FreeBSD)

mQGiBECGpfsRBACoPJJfIIrWAqjlW92TtYCtY//e7OW8alWylr/1ygtSQzjCCdvC
Ysa0fCcx01UenlWV+5YY/zC7KPsX2rQUKAs20fqs9et74dmgMGOj0vMjTzWEs29G
FyAsIRSpFioa8zzrjXEUVnU6OFaD9a9eaC+LSTCiKgXjbQySDKM5T1c+vwCg8W3Y
RZ83LRIUULGMPlY6zS4fQwUEAIIiTHDdWpbE+HeREJwH+4eDpGVf76XtNlOMXrt9
tJ3ExL+9ezLulg1nCrOYodOB7TEZqzV40R7emDZSX0hI9QEBCv6nW5aDVpw/bf+q
UEHwxrUvE2LBi35hoqR2QwqNlagOauSorWj8Qm/31luxJVeLVy1A1czp6B/mvG1T
co03A/9a5kzEAebJ5TzWXQC2/4gu/osXQnrw9B9FFpYOtLc0MNQuAFt8VLn5yO5Q
8T58w+FQvFI5FqzI5URmjQeEyWWuyIechknk4RnwIO1UPVjgRTuNgf9/TvNNfqpa
aVlbNp+AG21D6VqsFN2zJFFJeUqiYdXw6i+ESL3SZRymIhwYWrQ8UmljaGFyZCBB
IENoaWxkZXJzICh3d3cuZGFlbW9uaXplZC5jb20pIDxmc2NrZWRAcGFjYmVsbC5u
ZXQ+iF4EExECAB4FAkCGpfsCGwMGCwkIBwMCAxUCAwMWAgECHgECF4AACgkQjGqW
TlNTP66KzQCgjf0SQbiK1rgu7hRsmLPSSaGF7X8AoL7Qw/E9kTZr0fntP0XXEnk/
q6nRuQINBECGpvkQCADFzFq+kYbk+KTIhcVBTjTWDbBnjGgmuGR3LGp9hOd6W9SJ
i4GD5184ZnMbEgvDZcDEGDNgMcU+f1girwYI2v/o7QA7VQ5bpUbnfOBytzO+bvd7
uCOyJltg8AG5MFLxfhAMHofpNxGlFTEXdVp4M9xyBB+hdLHbJNJqkMGPf+iCUf1W
Q86KncU2AK4Sf9I+WYBZwkjaIhi9dQzeEX1c0Um6LxXSBtkjZprIk1M13gVaIJ6E
dDN6hrSMbXZL+7yURw38vHXCtRJAKEOyW178rI8MzJzvVNhobvC62uEWD9Idz8sH
5A06fqb2fKJYLQ1keGUpb/qpny7oTmAe0Hx9jOM7AAMGCACdTe1M4U++/7/OVGip
1gnWEtMhHeQQbS7KPh1w8/1kvs5Mml6uGYQI44lKTDP7OHJQ9hIT/+5tfKPHIPhU
M/7Mqa8y81c/AK+WUOyY9+uZ0zUxFGMqeU9z5iqJFWSi9QR/f5q/khfmqi5RFVyQ
nnVhxBMB8pY1vZHV1CoL7NLK4c/N8mpwCiZ57LTsP8pLfDMWF/OopmM2ulzlfWTr
anAdxQohenq/zTgSySX/VGZYSYvyAoXTRuU4USAVGWcUQPnVooA1N7lZP3pawjNP
QMSukx9jI1673BPsPXxyQZ1PmmPt9eHKI0G0hNJG+FCmSRLNT/R7hqTzTUmpgMWM
yyWPiEkEGBECAAkFAkCGpvkCGwwACgkQjGqWTlNTP642KACeITHq0b42P3oMX7Nj
F5U3EaqCgYoAn3HxUB7ELB6vMUugW4aSmZpBJOR6
=ZaJO
-----END PGP PUBLIC KEY BLOCK-----