1

I'm trying to log any requests to port 22 into my syslog, so I have following line in my iptables:

LOG        tcp  --  anywhere             anywhere            tcp dpt:ssh LOG level debug

yet, when I ssh in, nothing gets logged. I'm using RHEL6 (6.2)

Any ideas why?

Improve this question
1
  • don't just downvote! explain why!
    – alexus
    Nov 8, 2012 at 16:30

1 Answer 1

Reset to default
3

I've used the following to log new connections to port 22

iptables -I INPUT -p tcp -m tcp --dport 22 -m state --state NEW  -j LOG --log-level 1 --log-prefix "New Connection "

This rule only logs new connections to port 22. It logs to /var/log/messages on the CentOS box I have to hand

Nov 8 16:20:54 centos6 kernel: New Connection IN=eth0 OUT= MAC=00:0c:29:d2:2c:38:00:0c:29:fe:8e:bb:08:00 SRC=192.168.1.73 DST=192.168.254.188 LEN=52 TOS=0x00 PREC=0x00 TTL=126 ID=9880 DF PROTO=TCP SPT=63861 DPT=22 WINDOW=8192 RES=0x00 SYN URGP=0

Note that iptables actions rules in the order they are defined so if you used iptables -A to add your rule to an existing ruleset then it's possible that packets are being accepted or denied by an earlier rule and your log action is never erm actioned.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .