Linux firewall, iptables has the capability to log network activity to the syslog system. This is very useful to detect problems as well as to generate reports of network activity. You can also use this to detect all intrusion detection or unwanted incoming/outgoing connections etc.
To enable logging option you need to use LOG iptables/kernel module. It turn on kernel logging of matching packets. When this option is set for a rule, the Linux kernel will print some information on all matching packets (like most IP header fields) via the kernel log.
For example, drop all connection coming from hacker/cracker IP address 18.104.22.168 and log them to syslog:
iptables -A INPUT -s 22.214.171.124 -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix ‘** FW-DROP-HACKER **’
iptables -A INPUT -s 126.96.36.199 -j DROP
Firewall rules are checked in a sequential manner So first you logged message with first rule and second rule drops the connection.
- -m limit --limit 5/m: This will prevent excessive log data to /var/log/message file from being granted. The limit specified is 5/minute (it is maximum average matching rate). And a burst rate of 7 is specified (it is maximum initial number of packets to match).
- --log-prefix ‘** FW-DROP-HACKER **’: This is nothing but log prefix to dropped rule. Useful to search using grep command:
# grep ‘** FW-DROP-HACKER **’ /var/log/message
LOG module supports other options, read man page of iptables for more information.
- 30 Handy Bash Shell Aliases For Linux / Unix / Mac OS X
- Top 30 Nmap Command Examples For Sys/Network Admins
- 25 PHP Security Best Practices For Sys Admins
- 20 Linux System Monitoring Tools Every SysAdmin Should Know
- 20 Linux Server Hardening Security Tips
- Linux: 20 Iptables Examples For New SysAdmins
- Top 20 OpenSSH Server Best Security Practices
- Top 20 Nginx WebServer Best Security Practices
- 20 Examples: Make Sure Unix / Linux Configuration Files Are Free From Syntax Errors
- 15 Greatest Open Source Terminal Applications Of 2012
- My 10 UNIX Command Line Mistakes
- Top 10 Open Source Web-Based Project Management Software
- Top 5 Email Client For Linux, Mac OS X, and Windows Users
- The Novice Guide To Buying A Linux Laptop