On 2008-01-12 15:50, Jeffrey Goldberg <[EMAIL PROTECTED]> wrote:
> On Jan 11, 2008, at 9:51 AM, Andy Greenwood wrote:
>> I have recently set up a Fortigate-60 to run as a firewall/vpn on my
>> home network. I have a FreeBSD 7.0-prerelease machine sitting behind
>> it in the DMZ which is running ssh/web/etc. I'm trying to get the FG
>> to log to the BSD box's syslog. I have set up the necessary stuff on
>> the FG, and can send test logs from there to the bsd box. Running
>> tcpdump on the bsd [...]
>> So I know that the packets are getting to the machine. I've set up
>> syslogd to accept packets from in rc.conf, and
>> confirmed that the FG's IP should be accepted [...]
>> I've restarted syslogd after every change I've made, but no dice. Can
>> anyone shed some light on why these messages aren't logging and what
>> I need to do to fix it?
> I'm sure that there is a simple answer for getting syslogd to work
> properly.  But after similar experiences to yours (on other systems), I now
> use syslog-ng (in ports) for any system that is going to be a remote syslog
> server.

To the original poster, since I missed the message which started the

Andy, the default mode of syslogd in FreeBSD is `secure mode', because
the -s option is enabled in `/etc/defaults/rc.conf':

% [EMAIL PROTECTED]:/root# grep '^syslogd_' /etc/defaults/rc.conf
% syslogd_enable="YES"            # Run syslog daemon (or NO).
% syslogd_program="/usr/sbin/syslogd" # path to syslogd, if you want a 
different one.
% syslogd_flags="-s"              # Flags to syslogd (if enabled).

The -s flag in the default options means that syslogd will *not* log
messages from remote hosts.  Quoting the syslogd manpage:

     -s      Operate in secure mode.  Do not log messages from
             remote machines.  If specified twice, no network
             socket will be opened at all, which also disables
             logging to remote machines.

I'm using the following in `/etc/rc.conf':

% [EMAIL PROTECTED]:/root# grep '^syslogd_' /etc/rc.conf
% syslogd_enable="YES"
% syslogd_flags=""

and the syslogd on the system where this message is typed properly logs
messages from my DSL modem:

% [EMAIL PROTECTED]:/root# fgrep ' fire ' /var/log/messages | head -1
% Jan 12 22:04:26 fire kernel: Intrusion -> IN=ppp_8_35_1 OUT= MAC= \
%     SRC= DST= LEN=48 TOS=0x00 PREC=0x00 \
%     TTL=126 ID=39175 DF PROTO=TCP SPT=2213 DPT=445 WINDOW=16384 \
%     RES=0x00 SYN URGP=0

NOTE: If you are also using a firewall, you will have to make sure that
incoming UDP messages for the `syslog' service are allowed.  This is the
`pf.conf' snippet from my home network setup:

    pass in proto udp from to any port = syslog


freebsd-questions@freebsd.org mailing list
To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Reply via email to