1 1 00:00:00,450 --> 00:00:01,920 Syslog. 2 2 00:00:01,920 --> 00:00:04,380 In the last lesson, we talked about the event log, 3 3 00:00:04,380 --> 00:00:06,240 which was specialized to Windows, 4 4 00:00:06,240 --> 00:00:09,240 but if you're using a non-Windows host like Mac or Linux, 5 5 00:00:09,240 --> 00:00:11,820 usually you're going to use syslog instead. 6 6 00:00:11,820 --> 00:00:14,790 Now, syslog is a protocol for enabling different appliances 7 7 00:00:14,790 --> 00:00:17,460 and software applications to transmit their logs 8 8 00:00:17,460 --> 00:00:20,100 or event records to a centralized server. 9 9 00:00:20,100 --> 00:00:21,960 Syslog is one of the things we talked about 10 10 00:00:21,960 --> 00:00:23,640 back when we talked about SIEM a couple 11 11 00:00:23,640 --> 00:00:25,530 of lessons ago as well, because it was one 12 12 00:00:25,530 --> 00:00:28,620 of the protocols we could use to send data to the SIEM. 13 13 00:00:28,620 --> 00:00:32,400 Now, syslog is going to follow a standard client server model 14 14 00:00:32,400 --> 00:00:34,650 and this is the de facto standard for logging 15 15 00:00:34,650 --> 00:00:37,590 of events from distributed systems across a network. 16 16 00:00:37,590 --> 00:00:40,320 You are going to see syslog in use in so many 17 17 00:00:40,320 --> 00:00:43,050 of the systems that you're going to work on in a daily basis. 18 18 00:00:43,050 --> 00:00:45,720 Now, syslog runs on most operating systems 19 19 00:00:45,720 --> 00:00:47,370 and on most networking equipment. 20 20 00:00:47,370 --> 00:00:49,410 So whether you're using a Cisco router 21 21 00:00:49,410 --> 00:00:52,020 or you're using a Windows machine or a Linux server, 22 22 00:00:52,020 --> 00:00:56,220 all of them can use Syslog and it's going to run over port 514 23 23 00:00:56,220 --> 00:01:00,720 or 514 using UDP over the TCP/IP protocol. 24 24 00:01:00,720 --> 00:01:03,060 Here on the screen, you can see a basic web front end 25 25 00:01:03,060 --> 00:01:05,790 for the pfSense Unified Threat Manager. 26 26 00:01:05,790 --> 00:01:08,400 Notice here we have the remote logging options. 27 27 00:01:08,400 --> 00:01:10,620 The first option is to send log messages 28 28 00:01:10,620 --> 00:01:12,210 to a remote syslog server. 29 29 00:01:12,210 --> 00:01:14,730 We're going to check that and say, yes, we want that to happen. 30 30 00:01:14,730 --> 00:01:16,560 Then we're going to say, where is it coming from? 31 31 00:01:16,560 --> 00:01:18,450 The source address is going to be the LAN. 32 32 00:01:18,450 --> 00:01:21,390 Remember, this is a pfSense Unified Threat Manager, 33 33 00:01:21,390 --> 00:01:23,760 which is essentially a next generation firewall. 34 34 00:01:23,760 --> 00:01:25,680 So we have to determine are we going to be logging 35 35 00:01:25,680 --> 00:01:27,210 the things coming from the outside 36 36 00:01:27,210 --> 00:01:28,890 or things coming from the inside? 37 37 00:01:28,890 --> 00:01:29,723 And in this case, 38 38 00:01:29,723 --> 00:01:32,130 we want to be logging things from the inside. 39 39 00:01:32,130 --> 00:01:34,020 So we're going to use the LAN here. 40 40 00:01:34,020 --> 00:01:36,210 Then we have what IP format we're going to use. 41 41 00:01:36,210 --> 00:01:38,760 Are we using IPv4 or IPv6? 42 42 00:01:38,760 --> 00:01:41,130 In our case, we're going to use IPv4. 43 43 00:01:41,130 --> 00:01:43,410 Then we enter in what servers we want it to go to 44 44 00:01:43,410 --> 00:01:46,740 via their IP address and notice it's port 514 45 45 00:01:46,740 --> 00:01:50,910 or 514 because that is the UDP port for syslog. 46 46 00:01:50,910 --> 00:01:52,440 Then we have all of our different options. 47 47 00:01:52,440 --> 00:01:53,850 What do we want to send there? 48 48 00:01:53,850 --> 00:01:56,040 And notice, we didn't just say send everything 49 49 00:01:56,040 --> 00:01:58,440 because we don't want to overwhelm our SIEMs. 50 50 00:01:58,440 --> 00:02:00,660 Instead, we've thought about what we want to capture. 51 51 00:02:00,660 --> 00:02:03,150 We want to capture system events and firewall events 52 52 00:02:03,150 --> 00:02:05,520 and DNS events and PPP events, 53 53 00:02:05,520 --> 00:02:08,280 which is things like connecting from over remote access 54 54 00:02:08,280 --> 00:02:10,620 and we also want to send over our gateway monitoring events. 55 55 00:02:10,620 --> 00:02:11,790 But the rest of it, we decided 56 56 00:02:11,790 --> 00:02:14,460 that wasn't important to us, so we left those unchecked. 57 57 00:02:14,460 --> 00:02:17,160 This is the idea of how easy it is to set up remote logging 58 58 00:02:17,160 --> 00:02:19,500 and using syslog to send data back based 59 59 00:02:19,500 --> 00:02:20,910 on the system that's already in place 60 60 00:02:20,910 --> 00:02:22,980 using pfSense Unified Threat Manager. 61 61 00:02:22,980 --> 00:02:24,870 Now, when we send these messages back, 62 62 00:02:24,870 --> 00:02:27,300 what does a syslog message look like? 63 63 00:02:27,300 --> 00:02:30,180 Well, a syslog message is going to contain a couple of things. 64 64 00:02:30,180 --> 00:02:32,880 It contains a PRI code, which is a priority code. 65 65 00:02:32,880 --> 00:02:35,760 It contains a header and it contains a message portion. 66 66 00:02:35,760 --> 00:02:36,960 Let's talk about each of these. 67 67 00:02:36,960 --> 00:02:39,420 First, we have this PRI code, this priority 68 68 00:02:39,420 --> 00:02:40,710 and this is going to be calculated based 69 69 00:02:40,710 --> 00:02:43,590 on the facility and the severity level of the data. 70 70 00:02:43,590 --> 00:02:45,840 Now, in your book, they go into all the complexity 71 71 00:02:45,840 --> 00:02:48,150 of how this is actually calculated, but I will tell you, 72 72 00:02:48,150 --> 00:02:49,890 you're not going to get a question on the exam 73 73 00:02:49,890 --> 00:02:51,780 about how to calculate a PRI code, 74 74 00:02:51,780 --> 00:02:54,330 so I don't want to bore you or waste your time with it. 75 75 00:02:54,330 --> 00:02:55,710 If you're really interested in it, 76 76 00:02:55,710 --> 00:02:57,810 you can go see that in your official textbook 77 77 00:02:57,810 --> 00:03:00,990 in the official CompTIA CySA+ study guide. 78 78 00:03:00,990 --> 00:03:03,090 But for our purposes, we're just going to skip that 79 79 00:03:03,090 --> 00:03:05,040 and just remember, there's a priority here 80 80 00:03:05,040 --> 00:03:06,540 and it is calculated. 81 81 00:03:06,540 --> 00:03:07,770 Next, we have a header 82 82 00:03:07,770 --> 00:03:09,660 and the header is going to contain the timestamp 83 83 00:03:09,660 --> 00:03:11,280 of the event and the host name, 84 84 00:03:11,280 --> 00:03:12,900 so we know where it came from 85 85 00:03:12,900 --> 00:03:15,150 and what time it was, and hopefully we'll do that 86 86 00:03:15,150 --> 00:03:18,810 in UTC so we can have everything in a nice standard format. 87 87 00:03:18,810 --> 00:03:22,710 If not, your SIEM will probably convert it to UTC for you. 88 88 00:03:22,710 --> 00:03:24,750 And finally, we have the message portion, 89 89 00:03:24,750 --> 00:03:26,220 which contains the source process 90 90 00:03:26,220 --> 00:03:28,290 of the event and the related content. 91 91 00:03:28,290 --> 00:03:29,910 Basically, what data happened 92 92 00:03:29,910 --> 00:03:31,140 and what do you want to tell us about? 93 93 00:03:31,140 --> 00:03:33,090 And that's the idea here with the message portion. 94 94 00:03:33,090 --> 00:03:35,940 This is the meat and potatoes of this message. 95 95 00:03:35,940 --> 00:03:37,380 Now, when we dealt with syslog, 96 96 00:03:37,380 --> 00:03:38,880 there's a couple of drawbacks to it 97 97 00:03:38,880 --> 00:03:40,320 in the original version. 98 98 00:03:40,320 --> 00:03:42,060 The original protocol relied 99 99 00:03:42,060 --> 00:03:45,570 on UDP, as I said, UDP port 514. 100 100 00:03:45,570 --> 00:03:48,330 Now, this can cause delivery issues with congested networks 101 101 00:03:48,330 --> 00:03:50,820 because UDP is a fire and forget protocol. 102 102 00:03:50,820 --> 00:03:52,860 It sends it and doesn't wait for response 103 103 00:03:52,860 --> 00:03:55,620 and acknowledgement, and so it just assumes it got there. 104 104 00:03:55,620 --> 00:03:56,790 If you have a congested network, 105 105 00:03:56,790 --> 00:03:58,740 you can have data that is being dropped 106 106 00:03:58,740 --> 00:04:00,870 and therefore, your information is not going to get 107 107 00:04:00,870 --> 00:04:02,970 to the log server and not be logged. 108 108 00:04:02,970 --> 00:04:03,930 In the early days, 109 109 00:04:03,930 --> 00:04:06,270 this may have been okay because people assumed everyone 110 110 00:04:06,270 --> 00:04:07,860 on your network was trustworthy 111 111 00:04:07,860 --> 00:04:09,420 but these days, we don't want that. 112 112 00:04:09,420 --> 00:04:11,100 We want to make sure our data gets there 113 113 00:04:11,100 --> 00:04:13,290 so we're going to have to come up with a solution for this. 114 114 00:04:13,290 --> 00:04:14,190 The second thing 115 115 00:04:14,190 --> 00:04:17,010 is that there was not very many basic security controls. 116 116 00:04:17,010 --> 00:04:18,600 There wasn't anything like encryption 117 117 00:04:18,600 --> 00:04:21,420 or authentication included by default with syslog 118 118 00:04:21,420 --> 00:04:23,190 and this again was another drawback. 119 119 00:04:23,190 --> 00:04:25,590 So in modern implementations of syslog, 120 120 00:04:25,590 --> 00:04:27,120 we've corrected these things. 121 121 00:04:27,120 --> 00:04:28,560 Now, due to these security issues, 122 122 00:04:28,560 --> 00:04:30,960 our newer Syslog implementations have added lots 123 123 00:04:30,960 --> 00:04:32,850 of different features and capabilities 124 124 00:04:32,850 --> 00:04:34,770 and we're going to talk about a couple of them here. 125 125 00:04:34,770 --> 00:04:38,880 First, newer implementations use port 1468 126 126 00:04:38,880 --> 00:04:41,520 for TCP for consistent delivery. 127 127 00:04:41,520 --> 00:04:43,740 This way, if the network gets congested 128 128 00:04:43,740 --> 00:04:46,080 and that message can't get there, it will re-deliver it 129 129 00:04:46,080 --> 00:04:48,600 over and over again because it's using TCP. 130 130 00:04:48,600 --> 00:04:50,850 The second improvement, newer implementations 131 131 00:04:50,850 --> 00:04:53,580 can use TLS or Transport Layer Security 132 132 00:04:53,580 --> 00:04:56,430 to encrypt your messages being sent to servers. 133 133 00:04:56,430 --> 00:04:57,570 That way that data 134 134 00:04:57,570 --> 00:04:59,930 in transit can't be read by somebody else on the network. 135 135 00:04:59,930 --> 00:05:02,580 It can only be read by the endpoint who sent it 136 136 00:05:02,580 --> 00:05:04,860 and the server who's receiving it. 137 137 00:05:04,860 --> 00:05:06,990 The third thing is that newer implementations 138 138 00:05:06,990 --> 00:05:09,510 also use MD-5 and SHA-1 139 139 00:05:09,510 --> 00:05:12,330 to provide authentication and integrity. 140 140 00:05:12,330 --> 00:05:15,120 This way, the messages can have message authentication 141 141 00:05:15,120 --> 00:05:17,430 and integrity as they're transiting your network 142 142 00:05:17,430 --> 00:05:20,310 to make sure they're not being messed with by anybody else. 143 143 00:05:20,310 --> 00:05:22,320 This prevents any kind of man-in-the-middle attack 144 144 00:05:22,320 --> 00:05:24,930 that could destroy the integrity of the message. 145 145 00:05:24,930 --> 00:05:26,610 Additionally, we have this fourth thing, 146 146 00:05:26,610 --> 00:05:28,320 which is that some newer implementations 147 147 00:05:28,320 --> 00:05:29,880 can use message filtering, 148 148 00:05:29,880 --> 00:05:32,340 automated log analysis, event response scripting 149 149 00:05:32,340 --> 00:05:34,230 and alternate message formats. 150 150 00:05:34,230 --> 00:05:36,030 Again, lots of other features. 151 151 00:05:36,030 --> 00:05:38,250 I'm not focusing too much on this set though 152 152 00:05:38,250 --> 00:05:40,260 because really, the three big ones that we care about 153 153 00:05:40,260 --> 00:05:43,230 is we've moved to TCP for a consistent delivery, 154 154 00:05:43,230 --> 00:05:45,210 we have moved to TLS for encryption, 155 155 00:05:45,210 --> 00:05:47,460 and we started using MD-5 and SHA-1 156 156 00:05:47,460 --> 00:05:49,350 for authentication and integrity. 157 157 00:05:49,350 --> 00:05:51,870 Now, this newer version of the server is usually 158 158 00:05:51,870 --> 00:05:56,790 called syslog-ng for syslog next generation or rsyslog. 159 159 00:05:56,790 --> 00:05:58,080 Now, the final thing I want to mention 160 160 00:05:58,080 --> 00:06:00,120 about Syslog before we end this lesson 161 161 00:06:00,120 --> 00:06:03,210 is that Syslog is often used to mean three things. 162 162 00:06:03,210 --> 00:06:06,030 It can refer to the protocol that we send the data over. 163 163 00:06:06,030 --> 00:06:09,090 It can refer to the server as in a syslog server 164 164 00:06:09,090 --> 00:06:09,960 or it can refer 165 165 00:06:09,960 --> 00:06:13,110 to the log entries themselves, as in syslog data. 166 166 00:06:13,110 --> 00:06:15,780 People will often just say syslog, and they mean all three 167 167 00:06:15,780 --> 00:06:18,150 or any of these three depending on the context. 168 168 00:06:18,150 --> 00:06:20,370 So just be careful about that as you hear people talking 169 169 00:06:20,370 --> 00:06:22,470 in the industry to make sure you understand which one 170 170 00:06:22,470 --> 00:06:24,203 of the three they're talking about.