mailing list archives
Re: DoS-ing sysklogd?
From: Christophe Garault <bugtraq () garault org>
Date: Mon, 03 Apr 2006 13:14:36 +0200
Milen Rangelov wrote:
I know that good IP filtering on the sysklogd box is the best fix, but
always resolving hostnames of the log messages' sender is definitely not
a good idea..
That's why you should use syslog-ng instead. With it you can tweak all
the DNS parameters (see below) and create filters to drop unwanted log
From syslog-ng.conf man page:
Enable or disable DNS usage. syslog-ng blocks on DNS
queries, so enabling DNS may lead to a
Denial of Service attack. To prevent DoS, protect your
syslog-ng network endpoint with fire-
wall rules, and make sure that all hosts, which may get to
syslog-ng is resolvable.
Add Fully Qualified Domain Name instead of short hostname.
Enable or disable whether the hostname contains valid
A regexp which matches hostnames which should not be taken
Enable or disable DNS cache usage.
Number of seconds while a successful lookup is cached.
Number of seconds while a failed lookup is cached.
Number of hostnames in the DNS cache.