I'm looking to duplicate UDP traffic for SYSLOG and NetFlow data and was hoping to use iptables to do so, but so far I'm not having much luck.
I'm aware of other user space software packages that can accomplish this, but they don't seem very well maintained by their developers, so I'd prefer to avoid them if at all possible.
I'm running several RHEL based systems which utilize the audit functionality within the 2.6 kernel to track user activity and I need to have these logs sent to centralized SYSLOG servers for monitoring and event correlation. Anyone know how to achieve this?
I'm about to lose my mind. How in the world do you tell CPAN to download via HTTP only? ...and NOT via a proxy.
Currently running BIND on RHEL 5.4 and am looking for a more efficient manner of providing DNS redirection to a honeypot server for a large (30,000+) list of forbidden domains.
Our current solution for this requirement is to include a file containing a zone master declaration for each blocked domain in named.conf. Subsequently, each of these zone declarations point to the same zone file, which resolves all hosts in that domain to our honeypot servers. ...basically this allows us to capture any "phone home" attempts by malware that may infiltrate the internal systems.
The problem with this configuration is the large amount of time taken to load all 30,000+ domains as well as management of the domain list configuration file itself... if any errors creep into this file, the BIND server will fail to start, thereby making automation of the process a little frightening. So I'm looking for something more efficient and potentially less error prone.
include "blackholes.conf";
zone "bad-domain.com" IN { type master; file "/var/named/blackhole.zone"; allow-query { any; }; notify no; };
$INCLUDE std.soa
@ NS ns1.ourdomain.com.
@ NS ns2.ourdomain.com.
@ NS ns3.ourdomain.com.IN A 192.168.0.99
* IN A 192.168.0.99