0

i have some problem with syslog-ng, i've configured a server wich recive logs from different remotes devices.

My syslog-ng demon is configured for swap logs in a file based pipe, a different process will flush this pipe (inserting data in a mysql server).

Sometimes (randomly once for week or for month) syslog-ng go crazy and log recoursively filling my disk in less then a minute.

The logs: Normal log:

    INSERT INTO db.table (data,time,msg)   VALUES ('2011-12-05','09:27','administrator logged in');

When syslog-ng go crazy:

    INSERT INTO db.table (data,time,msg) VALUES ('2011-12-05','09:27','INSERT like INSERT INTO db.table (data,time,msg) VALUES ('2011-12-05','09:27','...');');

and it continue to spam the same log recursively, posting the query in the msg field.

Syslog-ng socket is binded on a VPN network locked by RSA certificates, and remotes send their logs to another server too witch has no problem (so i think not probable malicius attacks or a crazy remote wich spam logs to syslog-ng).

On my server works CentOS 5.6 and syslog-ng v2.1.4

my syslog-ng destination rule:

destination file_sql {file("/var/syslog-ng-pipe" template("INSERT INTO logs (host, date, time, msg) VALUES ( '$HOST', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$MSG');\n")suppress(2));

1 Answer 1

1

I believe you've written an SQL injection vulnerability into your logging.

What happens if your $MSG includes a '? The $MSG will be prematurely terminated, and whatever content is left over will almost certainly severely confuse your pipe-sink or database server.

syslog-ng claims that it can insert into an SQL database using an sql() directive. I would recommend using this approach instead, because syslog-ng can easily use parameterized SQL queries that are immune to SQL injection attacks. (I'd love to paste in the URL to the documentation, but the Balabit web site is horrible. I gave up. I'm much more familiar with rsyslog, and their documentation is significantly better -- if changing syslog daemons is acceptable, consider changing to rsyslog. Having tolerable documentation is important...)

You must log in to answer this question.