Outils pour utilisateurs
anthony_messe:banana_pi:logs_des_connexions
Différences
Ci-dessous, les différences entre deux révisions de la page.
| Les deux révisions précédentes Révision précédente Prochaine révision | Révision précédente | ||
|
anthony_messe:banana_pi:logs_des_connexions [2018/05/28 13:49] Anthony Messé |
anthony_messe:banana_pi:logs_des_connexions [2018/06/14 13:01] (Version actuelle) Anthony Messé |
||
|---|---|---|---|
| Ligne 23: | Ligne 23: | ||
| module(load="omrelp") | module(load="omrelp") | ||
| #On log avec le protocole relp vers une adresse et un port précis | #On log avec le protocole relp vers une adresse et un port précis | ||
| - | action(type="omrelp" target="192.168.16.11" port="20514" tls="off") | + | action(type="omrelp" target="192.168.16.11" port="20514" tls="on") |
| </code> | </code> | ||
| Ligne 31: | Ligne 31: | ||
| <code> | <code> | ||
| - | # /etc/rsyslog.conf Configuration file for rsyslog. | ||
| - | # | ||
| - | # For more information see | ||
| - | # /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html | ||
| - | |||
| - | |||
| - | ################# | ||
| - | #### MODULES #### | ||
| - | ################# | ||
| - | |||
| module(load="imuxsock") # provides support for local system logging | module(load="imuxsock") # provides support for local system logging | ||
| module(load="imklog") # provides kernel logging support | module(load="imklog") # provides kernel logging support | ||
| - | #module(load="immark") # provides --MARK-- message capability | ||
| - | # provides UDP syslog reception | ||
| - | #module(load="imudp") | ||
| - | #input(type="imudp" port="514") | ||
| - | |||
| - | # provides TCP syslog reception | ||
| - | #module(load="imtcp") | ||
| - | #input(type="imtcp" port="514") | ||
| - | |||
| - | |||
| - | ########################### | ||
| - | #### GLOBAL DIRECTIVES #### | ||
| - | ########################### | ||
| - | |||
| - | # | ||
| # Use traditional timestamp format. | # Use traditional timestamp format. | ||
| - | # To enable high precision timestamps, comment out the following line. | ||
| - | # | ||
| $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat | $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat | ||
| - | # | ||
| # Set the default permissions for all log files. | # Set the default permissions for all log files. | ||
| - | # | ||
| $FileOwner root | $FileOwner root | ||
| $FileGroup adm | $FileGroup adm | ||
| Ligne 73: | Ligne 44: | ||
| $Umask 0022 | $Umask 0022 | ||
| - | # | ||
| # Where to place spool and state files | # Where to place spool and state files | ||
| - | # | ||
| $WorkDirectory /var/spool/rsyslog | $WorkDirectory /var/spool/rsyslog | ||
| - | |||
| - | # | ||
| - | # Include all config files in /etc/rsyslog.d/ | ||
| - | # | ||
| - | $IncludeConfig /etc/rsyslog.d/*.conf | ||
| - | |||
| - | |||
| - | ############### | ||
| - | #### RULES #### | ||
| - | ############### | ||
| - | # | ||
| - | # First some standard log files. Log by facility. | ||
| - | # | ||
| - | auth,authpriv.* /var/log/auth.log | ||
| - | *.*;auth,authpriv.none -/var/log/syslog | ||
| - | #cron.* /var/log/cron.log | ||
| - | daemon.* -/var/log/daemon.log | ||
| - | kern.* -/var/log/kern.log | ||
| - | lpr.* -/var/log/lpr.log | ||
| - | mail.* -/var/log/mail.log | ||
| - | user.* -/var/log/user.log | ||
| - | |||
| - | # | ||
| - | # Logging for the mail system. Split it up so that | ||
| - | # it is easy to write scripts to parse these files. | ||
| - | # | ||
| - | mail.info -/var/log/mail.info | ||
| - | mail.warn -/var/log/mail.warn | ||
| - | mail.err /var/log/mail.err | ||
| - | |||
| - | # | ||
| - | # Some "catch-all" log files. | ||
| - | # | ||
| - | *.=debug;\ | ||
| - | auth,authpriv.none;\ | ||
| - | news.none;mail.none -/var/log/debug | ||
| - | *.=info;*.=notice;*.=warn;\ | ||
| - | auth,authpriv.none;\ | ||
| - | cron,daemon.none;\ | ||
| - | mail,news.none -/var/log/messages | ||
| - | |||
| - | # | ||
| - | # Emergencies are sent to everybody logged in. | ||
| - | # | ||
| - | *.emerg :omusrmsg:* | ||
| #On charge le module relp (output) | #On charge le module relp (output) | ||
| module(load="omrelp") | module(load="omrelp") | ||
| #On log avec le protocole relp vers une adresse et un port précis | #On log avec le protocole relp vers une adresse et un port précis | ||
| - | action(type="omrelp" target="192.168.16.11" port="20514" tls="off") | + | action(type="omrelp" target="192.168.16.11" port="20514" tls="on") |
| </code> | </code> | ||
| On redémarre rsyslog et on vérifie son état | On redémarre rsyslog et on vérifie son état | ||
| - | /etc/init.d/rsyslog restart && /etc/init.d/rsyslog status | + | systemctl restart rsyslog && systemctl status rsyslog |
| ===== Configuration du serveur ===== | ===== Configuration du serveur ===== | ||
| Ligne 161: | Ligne 85: | ||
| <code> | <code> | ||
| - | # /etc/rsyslog.conf Configuration file for rsyslog. | ||
| - | # | ||
| - | # For more information see | ||
| - | # /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html | ||
| - | |||
| - | |||
| - | ################# | ||
| - | #### MODULES #### | ||
| - | ################# | ||
| - | |||
| module(load="imuxsock") # provides support for local system logging | module(load="imuxsock") # provides support for local system logging | ||
| module(load="imklog") # provides kernel logging support | module(load="imklog") # provides kernel logging support | ||
| - | #module(load="immark") # provides --MARK-- message capability | ||
| - | # provides UDP syslog reception | ||
| - | #module(load="imudp") | ||
| - | #input(type="imudp" port="514") | ||
| - | |||
| - | # provides TCP syslog reception | ||
| - | #module(load="imtcp") | ||
| - | #input(type="imtcp" port="514") | ||
| - | |||
| - | |||
| - | ########################### | ||
| - | #### GLOBAL DIRECTIVES #### | ||
| - | ########################### | ||
| - | |||
| - | # | ||
| # Use traditional timestamp format. | # Use traditional timestamp format. | ||
| - | # To enable high precision timestamps, comment out the following line. | ||
| - | # | ||
| $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat | $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat | ||
| - | # | ||
| # Set the default permissions for all log files. | # Set the default permissions for all log files. | ||
| - | # | ||
| $FileOwner root | $FileOwner root | ||
| $FileGroup adm | $FileGroup adm | ||
| Ligne 203: | Ligne 98: | ||
| $Umask 0022 | $Umask 0022 | ||
| - | # | ||
| # Where to place spool and state files | # Where to place spool and state files | ||
| - | # | ||
| $WorkDirectory /var/spool/rsyslog | $WorkDirectory /var/spool/rsyslog | ||
| - | # | ||
| - | # Include all config files in /etc/rsyslog.d/ | ||
| - | # | ||
| - | $IncludeConfig /etc/rsyslog.d/*.conf | ||
| - | |||
| - | |||
| - | ############### | ||
| - | #### RULES #### | ||
| - | ############### | ||
| # | # | ||
| # First some standard log files. Log by facility. | # First some standard log files. Log by facility. | ||
| Ligne 228: | Ligne 112: | ||
| mail.* -/var/log/mail.log | mail.* -/var/log/mail.log | ||
| user.* -/var/log/user.log | user.* -/var/log/user.log | ||
| - | |||
| - | # | ||
| - | # Logging for the mail system. Split it up so that | ||
| - | # it is easy to write scripts to parse these files. | ||
| - | # | ||
| - | mail.info -/var/log/mail.info | ||
| - | mail.warn -/var/log/mail.warn | ||
| - | mail.err /var/log/mail.err | ||
| - | |||
| - | # | ||
| - | # Some "catch-all" log files. | ||
| - | # | ||
| - | *.=debug;\ | ||
| - | auth,authpriv.none;\ | ||
| - | news.none;mail.none -/var/log/debug | ||
| - | *.=info;*.=notice;*.=warn;\ | ||
| - | auth,authpriv.none;\ | ||
| - | cron,daemon.none;\ | ||
| - | mail,news.none -/var/log/messages | ||
| # | # | ||
| Ligne 277: | Ligne 142: | ||
| rotate 365 | rotate 365 | ||
| compress | compress | ||
| + | dateformat %Y-%m-%d | ||
| } | } | ||
| </code> | </code> | ||
| - | |||
| - | |||
| - | |||
| - | |||
| - | |||
| - | On va ajouter la ligne suivante dans la crontab | ||
| - | |||
| - | 0 1 * * * /bin/sh /root/logs_analyzer.sh | ||
| - | |||
| - | > Ainsi le script s'exécutera une fois par jour à 1h | ||
| - | |||
| - | On crée le script | ||
| - | nano logs_analyzer.sh | ||
| - | |||
| - | On le chmod | ||
| - | chmod +x logs_analyzer.sh | ||
| - | |||
| - | Collez-y les lignes ci-dessous : | ||
| - | <code=bash> | ||
| - | #!/bin/sh | ||
| - | _date=`date +%Y-%m-%d` | ||
| - | mkdir -p /root/access_point_logs | ||
| - | mkdir -p /tmp/access_point_logs | ||
| - | echo "Récupération des logs..." | ||
| - | cat /var/log/syslog.1 | grep -e hostapd -e DST -e dnsmasq| grep -v CRON > /tmp/access_point_logs/$_date.log | ||
| - | cd /tmp/access_point_logs | ||
| - | echo "Compression..." | ||
| - | gzip $_date.log -f | ||
| - | echo "Copie..." | ||
| - | cp $_date.log.gz /root/access_point_logs/ | ||
| - | rm $_date.log.gz | ||
| - | </code> | ||
| - | |||
| - | |||
| - | Il est nécessaire de compresser les données pour économiser de la place. En effet, comme on peut le voir ci dessous, les données compressées prennent 20 fois moins de place. | ||
| - | <code=bash> | ||
| - | root@debian:~# ls -l -h | ||
| - | total 31M | ||
| - | -rw-r--r-- 1 root root 31M mai 9 13:10 access_point.log | ||
| - | -rwxrwxrwx 1 root sys 2,4K mai 9 12:04 iptables.sh | ||
| - | root@debian:~# gzip access_point.log | ||
| - | root@debian:~# ls -l -h | ||
| - | total 1,5M | ||
| - | -rw-r--r-- 1 root root 1,5M mai 9 13:10 access_point.log.gz | ||
| - | -rwxrwxrwx 1 root sys 2,4K mai 9 12:04 iptables.sh | ||
| - | root@debian:~# | ||
| - | </code> | ||
| - | |||
| - | ===== Résultat ===== | ||
| - | |||
| - | Au final, on peut observer le contenu en fichier en faisant un cat. | ||
| - | Voici un exemple ce ce qu'on trouve à l'intérieur | ||
| - | <code> | ||
| - | May 4 09:14:25 debian kernel: [21983.824425] New input connection: IN=wlx503eaa3d7d6c OUT= MAC=50:3e:aa:3d:7d:6c:cc:b0:da:67:65:31:08:00 SRC=10.255.255.50 DST=10.255.255.254 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=8195 DF PROTO=TCP SPT=55915 DPT=9040 WINDOW=17520 RES=0x00 SYN URGP=0 | ||
| - | May 4 09:14:31 debian kernel: [21989.958539] New input connection: IN=wlx503eaa3d7d6c OUT= MAC=50:3e:aa:3d:7d:6c:cc:b0:da:67:65:31:08:00 SRC=10.255.255.50 DST=10.255.255.254 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=23855 DF PROTO=TCP SPT=55916 DPT=9040 WINDOW=17520 RES=0x00 SYN URGP=0 | ||
| - | May 4 09:17:13 debian kernel: [22151.745982] New input connection: IN=wlx503eaa3d7d6c OUT= MAC=ff:ff:ff:ff:ff:ff:cc:b0:da:67:65:31:08:00 SRC=10.255.255.50 DST=10.255.255.255 LEN=229 TOS=0x00 PREC=0x00 TTL=128 ID=17657 PROTO=UDP SPT=138 DPT=138 LEN=209 | ||
| - | May 4 09:18:17 debian hostapd: wlx503eaa3d7d6c: WPA rekeying GTK | ||
| - | May 4 09:18:17 debian hostapd: wlx503eaa3d7d6c: STA cc:b0:da:67:65:31 WPA: sending 1/2 msg of Group Key Handshake | ||
| - | May 4 09:18:17 debian hostapd: wlx503eaa3d7d6c: STA cc:b0:da:67:65:31 WPA: received EAPOL-Key frame (2/2 Group) | ||
| - | May 4 09:18:17 debian hostapd: wlx503eaa3d7d6c: STA cc:b0:da:67:65:31 WPA: group key handshake completed (RSN) | ||
| - | May 4 09:19:36 debian kernel: [22295.592654] New input connection: IN=wlx503eaa3d7d6c OUT= MAC=50:3e:aa:3d:7d:6c:cc:b0:da:67:65:31:08:00 SRC=10.255.255.50 DST=10.255.255.254 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=24462 DF PROTO=TCP SPT=55917 DPT=9040 WINDOW=17520 RES=0x00 SYN URGP=0 | ||
| - | </code> | ||
| - | |||
| - | ===== Conclusion ===== | ||
| - | |||
| - | On a bien rempli les obligations légales qui étaient : | ||
| - | * Les informations relatives à l'appareil utilisé | ||
| - | Il suffit de se rendre sur https://aruljohn.com/mac/ et de renseigner l'adresse mac de l'équipement | ||
| - | Au final on obtient par exemple //OnePlus Tech (Shenzhen) Ltd//. | ||
| - | * La date horaire et durée des communications | ||
| - | * Les informations d'authentification | ||
| - | On récupère l'adresse MAC et l'adresse IP associée (on est donc en mesure de dire qui s'est rendu sur tel ou tel site) | ||
| - | * L'adresse IP cible des communications | ||
| - | Avec les logs iptables | ||
| ===== Ressources ===== | ===== Ressources ===== | ||
| - | * https://access.redhat.com/solutions/70465 | + | * |
anthony_messe/banana_pi/logs_des_connexions.1527508175.txt.gz · Dernière modification: 2018/05/28 13:49 par Anthony Messé
Outils de la page
Sauf mention contraire, le contenu de ce wiki est placé sous les termes de la licence suivante : CC0 1.0 Universal
