fixed quotes, add CVS Id

git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1002 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
mhnoyes 2003-12-28 17:56:45 +00:00
parent 424bfe9f2d
commit 65002ec162
2 changed files with 36 additions and 29 deletions

View File

@ -2,6 +2,8 @@
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" <!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"> "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
<article id="IPIP"> <article id="IPIP">
<!--$Id$-->
<articleinfo> <articleinfo>
<title>Shorewall Logging</title> <title>Shorewall Logging</title>
@ -26,8 +28,8 @@
document under the terms of the GNU Free Documentation License, Version document under the terms of the GNU Free Documentation License, Version
1.2 or any later version published by the Free Software Foundation; with 1.2 or any later version published by the Free Software Foundation; with
no Invariant Sections, with no Front-Cover, and with no Back-Cover no Invariant Sections, with no Front-Cover, and with no Back-Cover
Texts. A copy of the license is included in the section entitled &#34;<ulink Texts. A copy of the license is included in the section entitled
url="GnuCopyright.htm">GNU Free Documentation License</ulink>&#34;.</para> <quote><ulink url="GnuCopyright.htm">GNU Free Documentation License</ulink></quote>.</para>
</legalnotice> </legalnotice>
</articleinfo> </articleinfo>
@ -63,16 +65,16 @@
<para>The packet matches a rule in <ulink <para>The packet matches a rule in <ulink
url="Documentation.htm#Rules">/etc/shorewall/rules</ulink>. By url="Documentation.htm#Rules">/etc/shorewall/rules</ulink>. By
including a syslog level (see below) in the ACTION column of a rule including a syslog level (see below) in the ACTION column of a rule
(e.g., &#34;ACCEPT<emphasis role="bold">:info</emphasis> net fw tcp (e.g., <quote>ACCEPT<emphasis role="bold">:info</emphasis> net fw tcp
22&#34;), the connection attempt will be logged at that level.</para> 22</quote>), the connection attempt will be logged at that level.</para>
</listitem> </listitem>
<listitem> <listitem>
<para>The packet doesn&#39;t match a rule so it is handled by a policy <para>The packet doesn&#39;t match a rule so it is handled by a policy
defined in <ulink url="Documentation.htm#Policy">/etc/shorewall/policy</ulink>. defined in <ulink url="Documentation.htm#Policy">/etc/shorewall/policy</ulink>.
These may be logged by specifying a syslog level in the LOG LEVEL These may be logged by specifying a syslog level in the LOG LEVEL
column of the policy&#39;s entry (e.g., &#34;loc net ACCEPT <emphasis column of the policy&#39;s entry (e.g., <quote>loc net ACCEPT
role="bold">info</emphasis>&#34;).</para> <emphasis role="bold">info</emphasis></quote>).</para>
</listitem> </listitem>
</orderedlist> </orderedlist>
</section> </section>
@ -91,7 +93,7 @@
<para>Throughout the Shorewall documentation, I will use the term <para>Throughout the Shorewall documentation, I will use the term
<emphasis>level</emphasis> rather than <emphasis>priority </emphasis>since <emphasis>level</emphasis> rather than <emphasis>priority </emphasis>since
<emphasis>level</emphasis> is the term used by NetFilter. The syslog <emphasis>level</emphasis> is the term used by NetFilter. The syslog
documentation uses the term <emphasis>priority</emphasis>. </para> documentation uses the term <emphasis>priority</emphasis>.</para>
<section> <section>
<title>Syslog Levels</title> <title>Syslog Levels</title>
@ -165,8 +167,8 @@
target support (and most vendor-supplied kernels do), you may also target support (and most vendor-supplied kernels do), you may also
specify a log level of ULOG (must be all caps). When ULOG is used, specify a log level of ULOG (must be all caps). When ULOG is used,
Shorewall will direct netfilter to log the related messages via the ULOG Shorewall will direct netfilter to log the related messages via the ULOG
target which will send them to a process called &#39;ulogd&#39;. The target which will send them to a process called <quote>ulogd</quote>.
ulogd program is available from <ulink The ulogd program is available from <ulink
url="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</ulink> url="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</ulink>
and can be configured to log all Shorewall message to their own log and can be configured to log all Shorewall message to their own log
file.</para> file.</para>
@ -241,15 +243,15 @@
</simplelist> </simplelist>
<para>I also copied the file /usr/local/src/ulogd-<emphasis>version</emphasis>/ulogd.init <para>I also copied the file /usr/local/src/ulogd-<emphasis>version</emphasis>/ulogd.init
to /etc/init.d/ulogd. I had to edit the line that read &#34;daemon to /etc/init.d/ulogd. I had to edit the line that read <quote>daemon
/usr/local/sbin/ulogd&#34; to read daemon /usr/local/sbin/ulogd -d&#34;. /usr/local/sbin/ulogd</quote> to read <quote>daemon
On a RedHat system, a simple &#34;chkconfig --level 3 ulogd on&#34; /usr/local/sbin/ulogd -d</quote>. On a RedHat system, a simple
starts ulogd during boot up. Your init system may need something else <quote>chkconfig --level 3 ulogd on</quote> starts ulogd during boot up.
done to activate the script.</para> Your init system may need something else done to activate the script.</para>
<para>You will need to change all instances of log levels (usually <para>You will need to change all instances of log levels (usually
&#39;info&#39;) in your configuration files to &#39;ULOG&#39; - this <quote>info</quote>) in your configuration files to <quote>ULOG</quote>
includes entries in the policy, rules and shorewall.conf files. - this includes entries in the policy, rules and shorewall.conf files.
Here&#39;s what I have:</para> Here&#39;s what I have:</para>
<programlisting> [root@gateway shorewall]# grep ULOG * <programlisting> [root@gateway shorewall]# grep ULOG *
@ -263,8 +265,8 @@
<para>Finally edit /etc/shorewall/shorewall.conf and set LOGFILE=&#60;<emphasis>file <para>Finally edit /etc/shorewall/shorewall.conf and set LOGFILE=&#60;<emphasis>file
that you wish to log to</emphasis>&#62;. This tells the /sbin/shorewall that you wish to log to</emphasis>&#62;. This tells the /sbin/shorewall
program where to look for the log when processing its &#34;show program where to look for the log when processing its <quote>show log</quote>,
log&#34;, &#34;logwatch&#34; and &#34;monitor&#34; commands.</para> <quote>logwatch</quote> and <quote>monitor</quote> commands.</para>
</section> </section>
</section> </section>

View File

@ -2,6 +2,8 @@
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" <!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"> "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
<article id="shorewall_prerequisites"> <article id="shorewall_prerequisites">
<!--$Id$-->
<articleinfo> <articleinfo>
<title>Shorewall Requirements</title> <title>Shorewall Requirements</title>
@ -24,8 +26,8 @@
document under the terms of the GNU Free Documentation License, Version document under the terms of the GNU Free Documentation License, Version
1.2 or any later version published by the Free Software Foundation; with 1.2 or any later version published by the Free Software Foundation; with
no Invariant Sections, with no Front-Cover, and with no Back-Cover no Invariant Sections, with no Front-Cover, and with no Back-Cover
Texts. A copy of the license is included in the section entitled &#34;<ulink Texts. A copy of the license is included in the section entitled
url="GnuCopyright.htm">GNU Free Documentation License</ulink>&#34;.</para> <quote><ulink url="GnuCopyright.htm">GNU Free Documentation License</ulink></quote>.</para>
</legalnotice> </legalnotice>
</articleinfo> </articleinfo>
@ -44,18 +46,21 @@
<listitem> <listitem>
<para>iptables 1.2 or later but beware version 1.2.3 -- see the <ulink <para>iptables 1.2 or later but beware version 1.2.3 -- see the <ulink
url="errata.htm">Errata</ulink>. <emphasis role="bold">WARNING</emphasis>: url="errata.htm">Errata</ulink>.</para>
The buggy iptables version 1.2.3 is included in RedHat 7.2 and you
should upgrade to iptables 1.2.4 prior to installing Shorewall. <warning>
Version 1.2.4 is available <ulink <para>The buggy iptables version 1.2.3 is included in RedHat 7.2 and
url="http://www.redhat.com/support/errata/RHSA-2001-144.html">from you should upgrade to iptables 1.2.4 prior to installing Shorewall.
RedHat</ulink> and in the <ulink url="errata.htm">Shorewall Errata</ulink>.</para> Version 1.2.4 is available <ulink
url="http://www.redhat.com/support/errata/RHSA-2001-144.html">from
RedHat</ulink> and in the <ulink url="errata.htm">Shorewall Errata</ulink>.</para>
</warning>
</listitem> </listitem>
<listitem> <listitem>
<para>Iproute (&#34;ip&#34; utility). The iproute package is included <para>Iproute (<quote>ip</quote> utility). The iproute package is
with most distributions but may not be installed by default. The included with most distributions but may not be installed by default.
official download site is <ulink type="remote" The official download site is <ulink type="remote"
url="ftp://ftp.inr.ac.ru/ip-routing">ftp://ftp.inr.ac.ru/ip-routing</ulink>.</para> url="ftp://ftp.inr.ac.ru/ip-routing">ftp://ftp.inr.ac.ru/ip-routing</ulink>.</para>
</listitem> </listitem>