RE: UFW logging

["Dermot Paikkos" <Dermot.Paikkos@xxxxxxxxxxxxxxxxxx>]

> -----Original Message-----
> On Thu, 2011-12-22 at 21:28 +0530, Saurabh Bathe wrote:
> > On Tuesday 20 December 2011 07:33 PM, Dermot Paikkos wrote:
> > > Chain ufw-user-limit (0 references)
> > >      pkts      bytes target     prot opt in     out     source
> > >       destination
> > >         0        0 LOG        all  --  *      *       0.0.0.0/0
> > >     0.0.0.0/0           limit: avg 3/min burst 5 LOG flags 0 level
> 4
> > > prefix `[UFW LIMIT BLOCK] '
> >
> > I would say the rule above *could* be suspect, which would log
> anything
> > that it catches. Depending on where in the filter it is being
> > referenced, it maybe catching those packets. I cannot say
> definitively
> > without actually seeing whole iptables -nL output.
> >
> > Thanks,
> > Saurabh
> > --
> > To unsubscribe from this list: send the line "unsubscribe linux-
> admin" in
> > the body of a message to majordomo@xxxxxxxxxxxxxxx
> > More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 
> It's not blocked, it's limited to 3 packets per minute, with a burst 
to
> 5. Only when this limit is reached the connection is blocked and the
> event is logged with the [UFW LIMIT BLOCK]. So you may want to check
> your syslog (or whatever logging system you are using) for this 
prefix.
> While this doesn't prevent users to connect to your server, it can
> affect the legit traffic.

That makes sense give the rules. It must be a default rule as I did not 
add it. I was getting one of these blocks every 30 seconds. I'm guessing 
this is to protect as DOS attacks.


> What you need is an IDS (either ModSecurity for apache [1] and/or 
ossec
> [2] - but hey, a strong tweaking is necessary for both of them in 
order
> to work as desired - you have been warned :) )

I had seen references to modsecurity but ufw seemed like a simpler 
solution.

As it turns out I have to disable ufw yesterday. A user in Switzerland 
reported problems connecting. The IP they gave me can't be found in any 
of the logs, syslog or httpd, so I assume they do not know their IP 
address. 

The attempted php exploits are down today. Just the one yesterday. I 
suspect that might be because the server now correctly returns 404 for 
these url. 

 
> [1] http://www.modsecurity.org/
> [2] http://www.ossec.net/
> 
> P.S. there is a good howto for mod_security on Ubuntu (I presume you
> are
> using Ubuntu) here:
> http://blog.bodhizazen.net/linux/how-to-mod_security-ubuntu-904/

Thanks for the link. I'll have a read.  
Thanks all and happy holidays if your getting one.
Dermot.

--
To unsubscribe from this list: send the line "unsubscribe linux-admin" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html