5

I have a firewalled router that connects to two virtual Lans. The first lan is an administration network and the second a DMZ. My virtual machines in the DMZ need to send syslog messages to a syslog vm in the admin vlan. In order to do this i must enable a rule from the DMZ to my admin network for syslog. This implies that if a DMZ server were compromised it could be used to attack the syslog server on the admin lan.
I assume the syslog server must be on the admin vlan asit contains vaulable and sensitive information I do not want on my DMZ.
Is there any way to transfer theese logs safely without exposing a path to my admin network form the DMZ?

Improve this question

2 Answers 2

Reset to default
4

This is actually a deceptively complex question. :) One of my favorites.

The question can be restated as "should a less trusted network be allowed access to a more trusted network, given that the only protocol is syslog"?

You need to weigh the cost / benefit of placing your syslog server on the inside. I'm personally a proponent of having the syslog server residing in the internal network - it's actually a rather high value asset.

The question then becomes the likelihood of an attack breaching specifically via the syslog daemon. If you think that your syslog server can be breached you want to isolate it from your admin network.

I personally think that a breach of a syslog server is pretty low in likelihood but there are a lot of ways of doing this with different combinations of hardware and software firewalls.

For example you could have your syslog server physically reside in the DMZ. From there iptables can allow syslog from any host both DMZ and your admin network and then restrict SSH and web access if required from only your admin segment.

Or you could have two separate DMZ subnets via your hardware firewall. DMZ1 -> DMZ2 <- Admin where DMZ2 contains your syslog server.

Improve this answer
1
  • I would also place the syslog-server in the DMZ and then poll this one from the internal network. Thus you would not have a need to open a hole in the "wrong" direction.
    – Nils
    Oct 22, 2013 at 8:04
1

Put the syslog server in the DMZ and allow polling connections (eg rsync) initiated from the admin network.

Log any SYN requests from the syslog server as it would be a clear indication of an intrusion attempt

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .