From owner-freebsd-security@FreeBSD.ORG Tue Feb 22 15:21:02 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 8127216A4CE for ; Tue, 22 Feb 2005 15:21:02 +0000 (GMT) Received: from colt.tsua.net (colt.tsua.net [212.40.34.10]) by mx1.FreeBSD.org (Postfix) with ESMTP id AE68943D46 for ; Tue, 22 Feb 2005 15:21:01 +0000 (GMT) (envelope-from pbl@colt.tsua.net) Received: from localhost (localhost [127.0.0.1]) by colt.tsua.net (Postfix) with ESMTP id 54BDE105196 for ; Tue, 22 Feb 2005 17:21:00 +0200 (EET) Received: from colt.tsua.net ([127.0.0.1]) by localhost (colt.tsua.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 29127-04 for ; Tue, 22 Feb 2005 17:21:00 +0200 (EET) Received: by colt.tsua.net (Postfix, from userid 1011) id 06E3F105195; Tue, 22 Feb 2005 17:21:00 +0200 (EET) Date: Tue, 22 Feb 2005 17:21:00 +0200 From: Peter Lavee To: freebsd-security@freebsd.org Message-ID: <20050222152059.GB11631@tsua.net> References: <421AEF1B.6000707@icyb.net.ua> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <421AEF1B.6000707@icyb.net.ua> X-Operating-System: FreeBSD 4.10-RELEASE-p5 i386 X-NCC-RegID: ua.tsystems User-Agent: Mutt/1.5.6i Subject: Re: periodic/security/550.ipfwlimit X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Feb 2005 15:21:02 -0000 On Tue, Feb 22, 2005 at 10:36:43AM +0200, Andriy Gapon wrote: Quickfixed version, may apply to 4-STABLE, 4-10 & 4.11 ---------------------------->8------------------------------------------------------------------------- #!/bin/sh - # # Copyright (c) 2001 The FreeBSD Project # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. # # $FreeBSD: src/etc/periodic/security/550.ipfwlimit,v 1.2.2.3 2002/08/28 05:13:53 cjc Exp $ # # Show ipfw rules which have reached the log limit # # If there is a global system configuration file, suck it in. # if [ -r /etc/defaults/periodic.conf ] then . /etc/defaults/periodic.conf source_periodic_confs fi rc=0 case "$daily_status_security_ipfwlimit_enable" in [Yy][Ee][Ss]) TMP=`mktemp ${TMPDIR:-/tmp}/security.XXXXXXXXXX` IPFW_LOG_LIMIT=`sysctl -n net.inet.ip.fw.verbose_limit 2> /dev/null` if [ $? -eq 0 ] && [ "${IPFW_LOG_LIMIT}" -ne 0 ]; then ipfw -a l | grep " log " | grep -v " logamount " | perl -n -e \ '/^\d+\s+(\d+)/; print if ($1 >= '$IPFW_LOG_LIMIT')' > ${TMP} ipfw -a l | grep " log " | grep " logamount " | perl -n -e \ '/^\d+\s+(\d+).+?logamount\s+(\d+)/; print if ($1 >= $2)' >> ${TMP} if [ -s "${TMP}" ]; then rc=1 echo "" echo 'ipfw log limit reached:' cat ${TMP} fi fi rm -f ${TMP};; *) rc=0;; esac exit $rc ---------------------------->8------------------------------------------------------------------------- > > 550.ipfwlimit check in /etc/periodic/security takes into account only > global/default verbosity limit and does not account for a specific > logging limit set for a particular rule e.g.: > > $ ipfw -a l | fgrep log > 65000 *521* 41764 deny log logamount *1000* ip from any to any > > $ sysctl -n net.inet.ip.fw.verbose_limit > *100* > > >From security run output: > > ipfw log limit reached: > 65000 519 41672 deny log logamount 1000 ip from any to any -- WBR, Peter Lavee Hostmaster Technological Systems CJVC