mirror of
https://gitlab.com/shorewall/code.git
synced 2025-01-03 12:09:14 +01:00
fixed quotes, add CVS Id
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1002 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
parent
424bfe9f2d
commit
65002ec162
@ -2,6 +2,8 @@
|
|||||||
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
|
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
|
||||||
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
|
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
|
||||||
<article id="IPIP">
|
<article id="IPIP">
|
||||||
|
<!--$Id$-->
|
||||||
|
|
||||||
<articleinfo>
|
<articleinfo>
|
||||||
<title>Shorewall Logging</title>
|
<title>Shorewall Logging</title>
|
||||||
|
|
||||||
@ -26,8 +28,8 @@
|
|||||||
document under the terms of the GNU Free Documentation License, Version
|
document under the terms of the GNU Free Documentation License, Version
|
||||||
1.2 or any later version published by the Free Software Foundation; with
|
1.2 or any later version published by the Free Software Foundation; with
|
||||||
no Invariant Sections, with no Front-Cover, and with no Back-Cover
|
no Invariant Sections, with no Front-Cover, and with no Back-Cover
|
||||||
Texts. A copy of the license is included in the section entitled "<ulink
|
Texts. A copy of the license is included in the section entitled
|
||||||
url="GnuCopyright.htm">GNU Free Documentation License</ulink>".</para>
|
<quote><ulink url="GnuCopyright.htm">GNU Free Documentation License</ulink></quote>.</para>
|
||||||
</legalnotice>
|
</legalnotice>
|
||||||
</articleinfo>
|
</articleinfo>
|
||||||
|
|
||||||
@ -63,16 +65,16 @@
|
|||||||
<para>The packet matches a rule in <ulink
|
<para>The packet matches a rule in <ulink
|
||||||
url="Documentation.htm#Rules">/etc/shorewall/rules</ulink>. By
|
url="Documentation.htm#Rules">/etc/shorewall/rules</ulink>. By
|
||||||
including a syslog level (see below) in the ACTION column of a rule
|
including a syslog level (see below) in the ACTION column of a rule
|
||||||
(e.g., "ACCEPT<emphasis role="bold">:info</emphasis> net fw tcp
|
(e.g., <quote>ACCEPT<emphasis role="bold">:info</emphasis> net fw tcp
|
||||||
22"), the connection attempt will be logged at that level.</para>
|
22</quote>), the connection attempt will be logged at that level.</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
|
|
||||||
<listitem>
|
<listitem>
|
||||||
<para>The packet doesn't match a rule so it is handled by a policy
|
<para>The packet doesn't match a rule so it is handled by a policy
|
||||||
defined in <ulink url="Documentation.htm#Policy">/etc/shorewall/policy</ulink>.
|
defined in <ulink url="Documentation.htm#Policy">/etc/shorewall/policy</ulink>.
|
||||||
These may be logged by specifying a syslog level in the LOG LEVEL
|
These may be logged by specifying a syslog level in the LOG LEVEL
|
||||||
column of the policy's entry (e.g., "loc net ACCEPT <emphasis
|
column of the policy's entry (e.g., <quote>loc net ACCEPT
|
||||||
role="bold">info</emphasis>").</para>
|
<emphasis role="bold">info</emphasis></quote>).</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
</orderedlist>
|
</orderedlist>
|
||||||
</section>
|
</section>
|
||||||
@ -91,7 +93,7 @@
|
|||||||
<para>Throughout the Shorewall documentation, I will use the term
|
<para>Throughout the Shorewall documentation, I will use the term
|
||||||
<emphasis>level</emphasis> rather than <emphasis>priority </emphasis>since
|
<emphasis>level</emphasis> rather than <emphasis>priority </emphasis>since
|
||||||
<emphasis>level</emphasis> is the term used by NetFilter. The syslog
|
<emphasis>level</emphasis> is the term used by NetFilter. The syslog
|
||||||
documentation uses the term <emphasis>priority</emphasis>. </para>
|
documentation uses the term <emphasis>priority</emphasis>.</para>
|
||||||
|
|
||||||
<section>
|
<section>
|
||||||
<title>Syslog Levels</title>
|
<title>Syslog Levels</title>
|
||||||
@ -165,8 +167,8 @@
|
|||||||
target support (and most vendor-supplied kernels do), you may also
|
target support (and most vendor-supplied kernels do), you may also
|
||||||
specify a log level of ULOG (must be all caps). When ULOG is used,
|
specify a log level of ULOG (must be all caps). When ULOG is used,
|
||||||
Shorewall will direct netfilter to log the related messages via the ULOG
|
Shorewall will direct netfilter to log the related messages via the ULOG
|
||||||
target which will send them to a process called 'ulogd'. The
|
target which will send them to a process called <quote>ulogd</quote>.
|
||||||
ulogd program is available from <ulink
|
The ulogd program is available from <ulink
|
||||||
url="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</ulink>
|
url="http://www.gnumonks.org/projects/ulogd">http://www.gnumonks.org/projects/ulogd</ulink>
|
||||||
and can be configured to log all Shorewall message to their own log
|
and can be configured to log all Shorewall message to their own log
|
||||||
file.</para>
|
file.</para>
|
||||||
@ -241,15 +243,15 @@
|
|||||||
</simplelist>
|
</simplelist>
|
||||||
|
|
||||||
<para>I also copied the file /usr/local/src/ulogd-<emphasis>version</emphasis>/ulogd.init
|
<para>I also copied the file /usr/local/src/ulogd-<emphasis>version</emphasis>/ulogd.init
|
||||||
to /etc/init.d/ulogd. I had to edit the line that read "daemon
|
to /etc/init.d/ulogd. I had to edit the line that read <quote>daemon
|
||||||
/usr/local/sbin/ulogd" to read daemon /usr/local/sbin/ulogd -d".
|
/usr/local/sbin/ulogd</quote> to read <quote>daemon
|
||||||
On a RedHat system, a simple "chkconfig --level 3 ulogd on"
|
/usr/local/sbin/ulogd -d</quote>. On a RedHat system, a simple
|
||||||
starts ulogd during boot up. Your init system may need something else
|
<quote>chkconfig --level 3 ulogd on</quote> starts ulogd during boot up.
|
||||||
done to activate the script.</para>
|
Your init system may need something else done to activate the script.</para>
|
||||||
|
|
||||||
<para>You will need to change all instances of log levels (usually
|
<para>You will need to change all instances of log levels (usually
|
||||||
'info') in your configuration files to 'ULOG' - this
|
<quote>info</quote>) in your configuration files to <quote>ULOG</quote>
|
||||||
includes entries in the policy, rules and shorewall.conf files.
|
- this includes entries in the policy, rules and shorewall.conf files.
|
||||||
Here's what I have:</para>
|
Here's what I have:</para>
|
||||||
|
|
||||||
<programlisting> [root@gateway shorewall]# grep ULOG *
|
<programlisting> [root@gateway shorewall]# grep ULOG *
|
||||||
@ -263,8 +265,8 @@
|
|||||||
|
|
||||||
<para>Finally edit /etc/shorewall/shorewall.conf and set LOGFILE=<<emphasis>file
|
<para>Finally edit /etc/shorewall/shorewall.conf and set LOGFILE=<<emphasis>file
|
||||||
that you wish to log to</emphasis>>. This tells the /sbin/shorewall
|
that you wish to log to</emphasis>>. This tells the /sbin/shorewall
|
||||||
program where to look for the log when processing its "show
|
program where to look for the log when processing its <quote>show log</quote>,
|
||||||
log", "logwatch" and "monitor" commands.</para>
|
<quote>logwatch</quote> and <quote>monitor</quote> commands.</para>
|
||||||
</section>
|
</section>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
|
@ -2,6 +2,8 @@
|
|||||||
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
|
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
|
||||||
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
|
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
|
||||||
<article id="shorewall_prerequisites">
|
<article id="shorewall_prerequisites">
|
||||||
|
<!--$Id$-->
|
||||||
|
|
||||||
<articleinfo>
|
<articleinfo>
|
||||||
<title>Shorewall Requirements</title>
|
<title>Shorewall Requirements</title>
|
||||||
|
|
||||||
@ -24,8 +26,8 @@
|
|||||||
document under the terms of the GNU Free Documentation License, Version
|
document under the terms of the GNU Free Documentation License, Version
|
||||||
1.2 or any later version published by the Free Software Foundation; with
|
1.2 or any later version published by the Free Software Foundation; with
|
||||||
no Invariant Sections, with no Front-Cover, and with no Back-Cover
|
no Invariant Sections, with no Front-Cover, and with no Back-Cover
|
||||||
Texts. A copy of the license is included in the section entitled "<ulink
|
Texts. A copy of the license is included in the section entitled
|
||||||
url="GnuCopyright.htm">GNU Free Documentation License</ulink>".</para>
|
<quote><ulink url="GnuCopyright.htm">GNU Free Documentation License</ulink></quote>.</para>
|
||||||
</legalnotice>
|
</legalnotice>
|
||||||
</articleinfo>
|
</articleinfo>
|
||||||
|
|
||||||
@ -44,18 +46,21 @@
|
|||||||
|
|
||||||
<listitem>
|
<listitem>
|
||||||
<para>iptables 1.2 or later but beware version 1.2.3 -- see the <ulink
|
<para>iptables 1.2 or later but beware version 1.2.3 -- see the <ulink
|
||||||
url="errata.htm">Errata</ulink>. <emphasis role="bold">WARNING</emphasis>:
|
url="errata.htm">Errata</ulink>.</para>
|
||||||
The buggy iptables version 1.2.3 is included in RedHat 7.2 and you
|
|
||||||
should upgrade to iptables 1.2.4 prior to installing Shorewall.
|
<warning>
|
||||||
Version 1.2.4 is available <ulink
|
<para>The buggy iptables version 1.2.3 is included in RedHat 7.2 and
|
||||||
url="http://www.redhat.com/support/errata/RHSA-2001-144.html">from
|
you should upgrade to iptables 1.2.4 prior to installing Shorewall.
|
||||||
RedHat</ulink> and in the <ulink url="errata.htm">Shorewall Errata</ulink>.</para>
|
Version 1.2.4 is available <ulink
|
||||||
|
url="http://www.redhat.com/support/errata/RHSA-2001-144.html">from
|
||||||
|
RedHat</ulink> and in the <ulink url="errata.htm">Shorewall Errata</ulink>.</para>
|
||||||
|
</warning>
|
||||||
</listitem>
|
</listitem>
|
||||||
|
|
||||||
<listitem>
|
<listitem>
|
||||||
<para>Iproute ("ip" utility). The iproute package is included
|
<para>Iproute (<quote>ip</quote> utility). The iproute package is
|
||||||
with most distributions but may not be installed by default. The
|
included with most distributions but may not be installed by default.
|
||||||
official download site is <ulink type="remote"
|
The official download site is <ulink type="remote"
|
||||||
url="ftp://ftp.inr.ac.ru/ip-routing">ftp://ftp.inr.ac.ru/ip-routing</ulink>.</para>
|
url="ftp://ftp.inr.ac.ru/ip-routing">ftp://ftp.inr.ac.ru/ip-routing</ulink>.</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user