0

I had a colleague suggest setting up a server on a separate network that doesn't have an IP address to act as a log server. The idea being that you could broadcast log information and the log server could pick it up and store it, but there wouldn't be any way to actually connect to the box.

Is this something that people do? Has it been done before? Is it practical? Is it a good idea? How would it be implemented in Linux?

Thanks

1
  • 2
    Doesn't sound practical at all if you have more than one Layer 3 network...unless you are enabling broadcast forwarding which is pretty dumb
    – TheCleaner
    Sep 23, 2009 at 16:20

2 Answers 2

10

Do you have some mayor paranoia?

Lots of things can be done, but you have to ask yourself, is this useful? Think about the amount of time you would need for such a solution to be implemented.

I guess you could do some kind of broadcast being sniffed by that logger box, but, to be honest, this sounds very impractical to me. Imagine someone sniffing your network and he gets all those interesting infos being written to your log host..

I think the better way is to use someting like syslog-ng with TLS secured communication channels between the sending and receiving servers..

regards, Comradin

2
  • 1
    +1 Great observation, broadcasting log data in the name of security.
    – kmarsh
    Sep 23, 2009 at 16:11
  • Well the idea was that it's a private network in the server room only... so if someone had access to that then sure, they could sniff it... but anyways, I just didn't know if there was stuff out there for doing this already and it was widely supported, or if it was just an idea this guy thought up one day... now I know Sep 23, 2009 at 17:24
0

not to say it's entirely a looney idea, although it is a bit on the fringe of it =)

We did something similar in my environment to track the logs of our custom VMS sockets, however instead of broadcast, we used multicast so that the various developers could fire up a client, set up a couple of filters, and have access to real-time data from said socket code.

For plain logging porpoises, I'd suggest a hardened box, with no services available except syslog, and very limited physical/console access.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .