IPFW uid logging...

[Dan Mahoney, System Admin]

Hey all,

I have the following rule set up in ipfw to limit the exposure of bad php 
scripts and trojans that try to send mail directly.

allow tcp from any to any dst-port 25 uid root
deny log tcp from any to any dst-port 25 out

However, the log messages I get look like this:

Sep  8 13:21:11 <security.info> prime kernel: ipfw: 610 Deny TCP 
72.9.101.130:58117 209.85.133.114:25 out via em0
Sep  8 13:21:16 <security.info> prime kernel: ipfw: 610 Deny TCP 
72.9.101.130:56672 202.12.31.144:25 out via em0
Sep  8 13:21:16 <security.info> prime kernel: ipfw: 610 Deny TCP 
72.9.101.130:58131 209.85.133.27:25 out via em0
Sep  8 13:21:28 <security.info> prime kernel: ipfw: 610 Deny TCP 
72.9.101.130:58117 209.85.133.114:25 out via em0
Sep  8 13:21:32 <security.info> prime kernel: ipfw: 610 Deny TCP 
72.9.101.130:58131 209.85.133.27:25 out via em0
Sep  8 13:22:45 <security.info> prime kernel: ipfw: 610 Deny TCP 
72.9.101.130:65313 64.202.166.12:25 out via em0
Sep  8 13:22:45 <security.info> prime kernel: ipfw: 610 Deny TCP 
72.9.101.130:65313 64.202.166.12:25 out via em0
Sep  8 13:22:46 <security.info> prime kernel: ipfw: 610 Deny TCP 
72.9.101.130:65313 64.202.166.12:25 out via em0
Sep  8 13:22:49 <security.info> prime kernel: ipfw: 610 Deny TCP 
72.9.101.130:65313 64.202.166.12:25 out via em0

Which is to say, they don't include the UID -- and I have several hundred 
sites, each with its own UID.

Yes, I could go ahead and set up a thousand "deny" rules, one for each UID 
-- but being able to log this info (since it IS being checked) would be 
great.

Thoughts?

-Dan Mahoney

-- 

--------Dan Mahoney--------
Techie,  Sysadmin,  WebGeek
Gushi on efnet/undernet IRC
ICQ: 13735144   AIM: LarpGM
Site:  http://www.gushi.org
---------------------------