syslogd: Remote Logging busted?

[Kevin Oberman]

On Fri, Oct 28, 2011 at 8:37 PM, Larry Rosenman <ler at lerctr.org> wrote:
> On Fri, 28 Oct 2011, Kevin Oberman wrote:
>
>> On Fri, Oct 28, 2011 at 7:22 PM, Larry Rosenman <ler at lerctr.org> wrote:
>>>
>>> I enabled remote logging for my home subnet, and syslogd doesn't seem(!)
>>> to
>>> be logging the messages.
>>>
>>> They ARE making it to the system.
>>>
>>> Can someone look at bin/162135 which has all the details, including
>>> tcpdump to show that the messages are making it to the system.
>>
>> Just to be clear, you are running tcpdump on borg, right? The
>> statement "This is from my Cable Modem:" confuses me a bit.
>
> Yes, the tcpdump is running on borg, and the source of the syslog packets
> is from my Cable Modem at 192.168.200.10.
>
> /etc/hosts.allow:
[Comments elided]
> ALL : PARANOID : RFC931 20 : deny
> ALL : localhost 127.0.0.1 : allow
> ALL : [::1] : allow
> exim : localhost : allow
> exim : ALL : allow
> rpcbind : ALL : deny
> ypserv : localhost : allow
> ypserv : ALL : deny
> ftpd : localhost : allow
> ftpd : ALL : allow
> fingerd : ALL \
>        : spawn (echo Finger. | \
>         /usr/bin/mail -s "tcpd\: %u@%h[%a] fingered me!" root) & \
>        : deny

Several superfluous rules, but I can't see anything that would block 514.

>>
>> Assuming tcpdump is on borg, it is making past any firewall (pf or
>> ipfw, at least). What about /etc/hosts.allow? I don't recall if it
>> filters before or after pcap see packets. I used to have a diagram
>> showing the sequence of processing this, but I can't seem to find it
>> now.
>>
>> What does "netstat -af inet | grep syslog" show? Is syslogd actually
>> listening?
>
>
> the netstat output: udp4       0      0 *.syslog               *.*
>
> and sockstat | grep syslog: root     syslogd    65128 4  dgram  /var/run/log
> root     syslogd    65128 5  dgram  /var/run/logpriv
> root     syslogd    65128 6  udp6   *:514                 *:*
> root     syslogd    65128 7  udp4   *:514                 *:*

OK. I'm baffled! I can't see anything that looks wrong, but I'll think
about it a bit more.
-- 
R. Kevin Oberman, Network Engineer
E-mail: kob6558 at gmail.com