1

My current job involves auditing systems for compliance with various policies. One of these policies is that all network connections must be logged, so that the origin of the connection (IP address and port) is available to trace any unauthorized or malicious access. Currently we use TCP Wrappers (either the libwrap library or the tcpd executable) for this purpose.

However, Red Hat Enterprise Linux 8 no longer provides tcpd and libwrap in the standard distribution, and it appears other Linux distributions are going to follow suit. Red Hat suggests using firewalld or iptables to enforce rules restricting connections, but it seems like there isn't a good replacement for simply logging new connections, without requiring enforcement and without logging every single packet (which would be a nightmare performance-wise).

Any suggestions on a replacement for TCP Wrappers just for logging purposes?

  • 1
    " without requiring enforcement and without logging every single packet (which would be a nightmare performance-wise)" - It is easy to have an iptables rule which just logs and not blocks and which just matches new connections. A simple search will provide you with the needed rule. – Steffen Ullrich Oct 16 '19 at 5:02
  • @Steffen Ulrich: Your comment jogged my memory as I knew I had seen the answer before on a StackExchange site; I just hadn't remembered which one. The answer is to use iptables to log the second packet of the TCP three-way handshake, as described here: serverfault.com/questions/669488/…. If you post this as your answer I'll mark it accepted. Thanks very much! – Mike McManus Oct 16 '19 at 17:31
1

As noted in Steffen Ullrich's comment, it is possible to use iptables to do this sort of logging.

One of the techniques that come up in the search parameters Steffen provided is to log the second packet of the TCP three-way handshake in order to capture the IP addresses and ports of each accepted connection. The technique is described over on Server Fault: https://serverfault.com/questions/669488/iptables-log-established-connections.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.