ULOG on Debian Woody

I like to use iptables. I also like to know about break-in attempts. Using the LOG target produces so much of exhibit A and its ilk in /var/log/syslog, that I can't read anything else in said file. I could use the ULOG target, but I don't know how to interface to netlink. Thankfully, there's a ulogd package. Sadly, the Woody package doesn't work (at least not with my 2.4.19 kernel, even though it was sourced from Woody). Packets were matched by my rule in iptables and sent to the ULOG target but nothing would be written to /var/log/ulogd.syslogemu. Florian suggested building ulogd from Sarge.

a solution

This is how to build your own ulogd package for Woody from the Sarge source. dpkg-buildpackage is the elegant way of building a package from source but differences between Sarge and Woody gave rise to problems that I couldn't be arsed with. This is the dirty method of building the package.

This dirty package has many faults (including not stopping and starting the daemon on installation or removal) but none that cause me problems.

using ulogd

Part of the reason I want to use ULOG is to avoid writing packets to disc every minute or however often attackers choose to attack. It keeps my discs awake. The perl script reads packet logging (the output of ulogd) on stdin and summarises the day's attacks in two CSV files. A named pipe at /var/log/ulogd.syslogemu connects ulogd and the script.

#!/usr/bin/perl
#
# put netfilter packet logging on stdin, stats written daily to files
#
# maintains two maps:
#  1. (dpt,proto) -> packet_count  (for in=red,spt!=80)
#  2. src -> packet_count  (for in=red,spt-80 - reverse DDOS)
#
# $Revision: 1.2 $
#

use strict;

my $LOG_DIR = '/tmp';
my $INET_IFACE = 'red';

my $when_last;  # when the last packet was received in the form yyyy-MM-dd
my %rddos_popularity_by_host;
my %attack_popularity_by_vector;

sub sync
{
    my $today = shift or die;

    my $path_to_file = "$LOG_DIR/$today.RDDoS.csv";
    open F, ">$path_to_file" or die "$path_to_file: $!";
    for ( sort {$a <=> $b} keys %rddos_popularity_by_host )
    {
        print F "$_,$rddos_popularity_by_host{$_}\n";
    }
    close F;

    $path_to_file = "$LOG_DIR/$today.attacks.csv";
    open F, ">$path_to_file" or die "$path_to_file: $!";
    for ( sort {$a <=> $b} keys %attack_popularity_by_vector )
    {
        print F "$_,$attack_popularity_by_vector{$_}\n";
    }
    close F;
}

sub today
{
    my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time);
    $year += 1900;
    $mon ++;
    $mon = "0$mon" if $mon <= 9;
    $mday = "0$mday" if $mday <= 9;
    return "$year-$mon-$mday";
}

sub categorise
{
    my $src = shift or die;
    my $proto = shift or die;
    my $spt = shift or die;
    my $dpt = shift or die;

    # determine the date today
    my $today = today();

    # if a packet was last received yesterday..
    if ( $when_last ne $today )
    {
        # write yesterdays data to file
        sync( $when_last ) if $when_last;

        $when_last = $today;
    }

    # categorise the packet
    if ( 80 == $spt )  # this attack is probably a RDDoS
    {
        $rddos_popularity_by_host{ $src } ++;
    }
    else {
        $attack_popularity_by_vector{ "$dpt,$proto" } ++;
    }
}

while ( <> )
{
    if ( m/ .+? IN=(.*?) OUT=.* MAC=.* SRC=(.*?) DST=.*? .* PROTO=(.*?) SPT=(.*?) DPT=(.*?) / )
    {
        my ($in, $src, $proto, $spt, $dpt) = ($1, $2, $3, $4, $5);
        categorise( $src, $proto, $spt, $dpt ) if $INET_IFACE eq $in;
    }
    elsif ( m/ .+? IN=(.*?) OUT=.* MAC=.* SRC=(.*?) DST=.*? .* PROTO=(.*?) TYPE=(.*?) / )
    {
        my ($in, $src, $proto, $type) = ($1, $2, $3, $4);
        categorise( $src, $proto, 'n/a', $type ) if $INET_IFACE eq $in;
    }
    elsif ( "sync\n" eq $_ )
    {
        sync( today() );
    }
    else {
        print stderr "bad: $_";
    }
}

sync( today() );

ULOG on Debian Woody

the problem

a solution

using ulogd

exhibit A