syslogd not reading messages from a remote machine

[Giorgos Keramidas]

On 2008-01-12 15:50, Jeffrey Goldberg <jeffrey at goldmark.org> wrote:
> On Jan 11, 2008, at 9:51 AM, Andy Greenwood wrote:
>> I have recently set up a Fortigate-60 to run as a firewall/vpn on my
>> home network. I have a FreeBSD 7.0-prerelease machine sitting behind
>> it in the DMZ which is running ssh/web/etc. I'm trying to get the FG
>> to log to the BSD box's syslog. I have set up the necessary stuff on
>> the FG, and can send test logs from there to the bsd box. Running
>> tcpdump on the bsd [...]
>>
>> So I know that the packets are getting to the machine. I've set up
>> syslogd to accept packets from 10.10.10.1/32 in rc.conf, and
>> confirmed that the FG's IP should be accepted [...]
>>
>> I've restarted syslogd after every change I've made, but no dice. Can
>> anyone shed some light on why these messages aren't logging and what
>> I need to do to fix it?
>
> I'm sure that there is a simple answer for getting syslogd to work
> properly.  But after similar experiences to yours (on other systems), I now
> use syslog-ng (in ports) for any system that is going to be a remote syslog
> server.

To the original poster, since I missed the message which started the
thread...

Andy, the default mode of syslogd in FreeBSD is `secure mode', because
the -s option is enabled in `/etc/defaults/rc.conf':

% root at kobe:/root# grep '^syslogd_' /etc/defaults/rc.conf
% syslogd_enable="YES"            # Run syslog daemon (or NO).
% syslogd_program="/usr/sbin/syslogd" # path to syslogd, if you want a different one.
% syslogd_flags="-s"              # Flags to syslogd (if enabled).
% root at kobe:/root#

The -s flag in the default options means that syslogd will *not* log
messages from remote hosts.  Quoting the syslogd manpage:

     -s      Operate in secure mode.  Do not log messages from
             remote machines.  If specified twice, no network
             socket will be opened at all, which also disables
             logging to remote machines.

I'm using the following in `/etc/rc.conf':

% root at kobe:/root# grep '^syslogd_' /etc/rc.conf
% syslogd_enable="YES"
% syslogd_flags=""
% root at kobe:/root#

and the syslogd on the system where this message is typed properly logs
messages from my DSL modem:

% root at kobe:/root# fgrep ' fire ' /var/log/messages | head -1
% Jan 12 22:04:26 fire kernel: Intrusion -> IN=ppp_8_35_1 OUT= MAC= \
%     SRC=62.1.173.240 DST=62.1.60.253 LEN=48 TOS=0x00 PREC=0x00 \
%     TTL=126 ID=39175 DF PROTO=TCP SPT=2213 DPT=445 WINDOW=16384 \
%     RES=0x00 SYN URGP=0
% root at kobe:/root#

NOTE: If you are also using a firewall, you will have to make sure that
incoming UDP messages for the `syslog' service are allowed.  This is the
`pf.conf' snippet from my home network setup:

    pass in proto udp from 192.169.1.0/24 to any port = syslog

HTH,
Giorgos