How to log crackers with ipchains?

[haux]

I had installed a firewall (ipchains) in our school but what i want to know is the IP of people that want to crack our servers, i.e packets that don't much the ipchains rules.
Any idea is welcom !

Thanks for all

 

[marsd]

#/bin/sh

#example webserver and ftp

#globals
trusted="netblock or trusted hosts"
ourbox="server address"


ipchains -F
ipchains -P input DENY
ipchains -P output ACCEPT
ipchains -P forward DENY
(standalone machine)

ipchains -A input -s ! $trusted -d $ourbox -p tcp --dport 80 -j ACCEPT -l
ipchains -A input -s ! $trusted -d $ourbox -p tcp --dport 20:21 -j ACCEPT -l
ipchains -A input -s ! $trusted -d $ourbox -p udp --dport 20:21 -j ACCEPT -l

Happy Holidays.

 

[haux]

Thanks very very much marsd, but i want to know one thing: where the logs are writen ?

;-)

 

[haux]

I had made a test with a machine with kernel2.4 (iptables), i have seen the logs in the /var/log/messages (made by kernel), but with our firewall (kernel 2.4) the option "-l" was always there, but no logs in the /var/log/messages
I suppose that, it is the configuration of the syslog deamon, can somebody tell me an idea because i am lost (

 

[ifincham]

Hi,

With iptables the logging is different to ipchains. For example, you might have something like this to LOG and DROP all other tcp traffic after your ACCEPT rules :

/sbin/iptables -A INPUT -i eth0 -p tcp -j LOG --log-prefix "TCP-IN: "
/sbin/iptables -A INPUT -i eth0 -p tcp -j DROP

/sbin/iptables -A OUTPUT -o eth0 -p tcp -j LOG --log-prefix "TCP-OUT: "
/sbin/iptables -A OUTPUT -o eth0 -p tcp -j DROP

Basically, you have two rules instead of one for each logging. The first one would do the logging and the second one would perform that actual filtering - DROP or ACCEPT, etc. The --log-prefix parameter is something you can use to customise log entries for easier analysis. You can also use --log-level if you like. You also need to load the LOG module if it isn't already loaded :

/sbin/modprobe ipt_LOG

Hope this helps