Eureka Ikara's questions

My requirements are to do extensive logging of various iptables rules that must be logged into a file other than Syslog or the Journal.

For some time have been using ulogd that enables setting up custom log files. However ulogd isn't supported in systemd on Fedora, that seems to indicate it is no longer a preferred option, and may be going the way of the dodo bird.

Wondering if there is a newer preferred option? (conntrack doesn't seem to provide full logging to a file.)

EDIT: Ok - some more details. Am using ipset that blocks and or logs traffic from particular countries. So for example, if there is outgoing traffic to particular countries, we need to know about it and investigate further. Having a large volume of logging information from iptables rules going into Syslog (and the new Journal used in Fedora) means that normal Syslog messages are swamped and important messages are being missed due to the volume of iptables logs. Hence we need to separate the normal Syslog messages from the high volume iptables logs

Am implementing ipset on some Fedora 16 systems.

Since ipset rules run in memory and are lost on reboot planning to use a crontab @reboot script to reload the rules and send an email to administrator confirming the ruleset has been loaded.

Is there any problem in this approach or other recommended way to reload ipset rules after a reboot?

I have a script that backs-up remote systems, and want it to display disk space on the remote backup device prior and post running backup script.

Thanks to another post have learnt how to run remote commands via SSH such as (SSH keys have been setup for auto login).

echo `ssh -t user@host uname -a`

However, how can I get a multi line response that comes from a command such as

echo `ssh -t user@host df`

Response just shows the last line of output from df

Looking for a Linux script solution that can send alerts to a service such as Twitter, Skype or Google Talk and sends to Android and iPhone clients.

Have found twurl for Twitter with previous Bash scripts using curl no longer supported. But twurl looks promising. But haven't seen how to get Android Twitter client to make a distinctive sound when a tweet arrives.

Found some info about Skype4Py from several years ago that supports Skype Chats. But doesn't look like it is currently supported.

Have tried a few CLI clients for XMPP/Google Talk including xmpp4r-simple and freetalk, but found xmpp4r-simple buggy and freetalk succeeded in sending one chat message, but most never arrived.

Whatever is used needs to support Android and iPhone clients. Reason why email is problematic is that Gmail gets very upset when emails start flooding in every minute as a result of alerts.

Any suggestions?

A recent article from UNIXy http://blog.unixy.net/2010/08/the-penultimate-guide-to-stopping-a-ddos-attack-a-new-approach/ has suggestions to harden a Linux box against DDoS attacks.

Example of sysctl.conf

net.ipv4.tcp_syncookies = 1

net.ipv4.conf.all.rp_filter = 1

net.ipv4.conf.default.rp_filter = 1

kernel.pid_max = 65536

net.ipv4.ip_local_port_range = 9000 65000

Any other recommendations for hardening Linux against DDoS attacks?

Recently installed OSSEC on Linux machine to test.

Most results are expected, however yesterday I received emails with a number of notifications about Integrity checksum changing on files such as /usr/bin/whoami /usr/bin/md5sum /usr/bin/ls and about another 50 similar files

Since I didn't install any new versions of these files, how do I find out what caused the integrity checksum to change 2 days after I installed the OSSEC program?

Eureka