Instructor: Syslog. 2 2
In the last lesson, we talked about the event log, 3 3
which was specialized to Windows, 4 4
but if you're using a non-Windows host like Mac or Linux, 5 5
usually you're going to use syslog instead. 6 6
Now, syslog is a protocol for enabling different appliances 7 7
and software applications to transmit their logs 8 8
or event records to a centralized server. 9 9
Syslog is one of the things we talked about 10 10
back when we talked about SIEM a couple 11 11
of lessons ago as well, because it was one 12 12
of the protocols we could use to send data to the SIEM. 13 13
Now, syslog is going to follow a standard client server model 14 14
and this is the de facto standard for logging 15 15
of events from distributed systems across a network. 16 16
You are going to see syslog in use in so many 17 17
of the systems that you're going to work on in a daily basis. 18 18
Now, syslog runs on most operating systems 19 19
and on most networking equipment. 20 20
So whether you're using a Cisco router 21 21
or you're using a Windows machine or a Linux server, 22 22
all of them can use Syslog and it's going to run over port 514 23 23
or 514 using UDP over the TCP/IP protocol. 24 24
Here on the screen, you can see a basic web front end 25 25
for the pfSense Unified Threat Manager. 26 26
Notice here we have the remote logging options. 27 27
The first option is to send log messages 28 28
to a remote syslog server. 29 29
We're going to check that and say, yes, we want that to happen. 30 30
Then we're going to say, where is it coming from? 31 31
The source address is going to be the LAN. 32 32
Remember, this is a pfSense Unified Threat Manager, 33 33
which is essentially a next generation firewall. 34 34
So we have to determine are we going to be logging 35 35
the things coming from the outside 36 36
or things coming from the inside? 37 37
And in this case, 38 38
we want to be logging things from the inside. 39 39
So we're going to use the LAN here. 40 40
Then we have what IP format we're going to use. 41 41
Are we using IPv4 or IPv6? 42 42
In our case, we're going to use IPv4. 43 43
Then we enter in what servers we want it to go to 44 44
via their IP address and notice it's port 514 45 45
or 514 because that is the UDP port for syslog. 46 46
Then we have all of our different options. 47 47
What do we want to send there? 48 48
And notice, we didn't just say send everything 49 49
because we don't want to overwhelm our SIEMs. 50 50
Instead, we've thought about what we want to capture. 51 51
We want to capture system events and firewall events 52 52
and DNS events and PPP events, 53 53
which is things like connecting from over remote access 54 54
and we also want to send over our gateway monitoring events. 55 55
But the rest of it, we decided 56 56
that wasn't important to us, so we left those unchecked. 57 57
This is the idea of how easy it is to set up remote logging 58 58
and using syslog to send data back based 59 59
on the system that's already in place 60 60
using pfSense Unified Threat Manager. 61 61
Now, when we send these messages back, 62 62
what does a syslog message look like? 63 63
Well, a syslog message is going to contain a couple of things. 64 64
It contains a PRI code, which is a priority code. 65 65
It contains a header and it contains a message portion. 66 66
Let's talk about each of these. 67 67
First, we have this PRI code, this priority 68 68
and this is going to be calculated based 69 69
on the facility and the severity level of the data. 70 70
Now, in your book, they go into all the complexity 71 71
of how this is actually calculated, but I will tell you, 72 72
you're not going to get a question on the exam 73 73
about how to calculate a PRI code, 74 74
so I don't want to bore you or waste your time with it. 75 75
If you're really interested in it, 76 76
you can go see that in your official textbook 77 77
in the official CompTIA CySA+ study guide. 78 78
But for our purposes, we're just going to skip that 79 79
and just remember, there's a priority here 80 80
and it is calculated. 81 81
Next, we have a header 82 82
and the header is going to contain the timestamp 83 83
of the event and the host name, 84 84
so we know where it came from 85 85
and what time it was, and hopefully we'll do that 86 86
in UTC so we can have everything in a nice standard format. 87 87
If not, your SIEM will probably convert it to UTC for you. 88 88
And finally, we have the message portion, 89 89
which contains the source process 90 90
of the event and the related content. 91 91
Basically, what data happened 92 92
and what do you want to tell us about? 93 93
And that's the idea here with the message portion. 94 94
This is the meat and potatoes of this message. 95 95
Now, when we dealt with syslog, 96 96
there's a couple of drawbacks to it 97 97
in the original version. 98 98
The original protocol relied 99 99
on UDP, as I said, UDP port 514. 100 100
Now, this can cause delivery issues with congested networks 101 101
because UDP is a fire and forget protocol. 102 102
It sends it and doesn't wait for response 103 103
and acknowledgement, and so it just assumes it got there. 104 104
If you have a congested network, 105 105
you can have data that is being dropped 106 106
and therefore, your information is not going to get 107 107
to the log server and not be logged. 108 108
In the early days, 109 109
this may have been okay because people assumed everyone 110 110
on your network was trustworthy 111 111
but these days, we don't want that. 112 112
We want to make sure our data gets there 113 113
so we're going to have to come up with a solution for this. 114 114
The second thing 115 115
is that there was not very many basic security controls. 116 116
There wasn't anything like encryption 117 117
or authentication included by default with syslog 118 118
and this again was another drawback. 119 119
So in modern implementations of syslog, 120 120
we've corrected these things. 121 121
Now, due to these security issues, 122 122
our newer Syslog implementations have added lots 123 123
of different features and capabilities 124 124
and we're going to talk about a couple of them here. 125 125
First, newer implementations use port 1468 126 126
for TCP for consistent delivery. 127 127
This way, if the network gets congested 128 128
and that message can't get there, it will re-deliver it 129 129
over and over again because it's using TCP. 130 130
The second improvement, newer implementations 131 131
can use TLS or Transport Layer Security 132 132
to encrypt your messages being sent to servers. 133 133
That way that data 134 134
in transit can't be read by somebody else on the network. 135 135
It can only be read by the endpoint who sent it 136 136
and the server who's receiving it. 137 137
The third thing is that newer implementations 138 138
also use MD-5 and SHA-1 139 139
to provide authentication and integrity. 140 140
This way, the messages can have message authentication 141 141
and integrity as they're transiting your network 142 142
to make sure they're not being messed with by anybody else. 143 143
This prevents any kind of man-in-the-middle attack 144 144
that could destroy the integrity of the message. 145 145
Additionally, we have this fourth thing, 146 146
which is that some newer implementations 147 147
can use message filtering, 148 148
automated log analysis, event response scripting 149 149
and alternate message formats. 150 150
Again, lots of other features. 151 151
I'm not focusing too much on this set though 152 152
because really, the three big ones that we care about 153 153
is we've moved to TCP for a consistent delivery, 154 154
we have moved to TLS for encryption, 155 155
and we started using MD-5 and SHA-1 156 156
for authentication and integrity. 157 157
Now, this newer version of the server is usually 158 158
called syslog-ng for syslog next generation or rsyslog. 159 159
Now, the final thing I want to mention 160 160
about Syslog before we end this lesson 161 161
is that Syslog is often used to mean three things. 162 162
It can refer to the protocol that we send the data over. 163 163
It can refer to the server as in a syslog server 164 164
or it can refer 165 165
to the log entries themselves, as in syslog data. 166 166
People will often just say syslog, and they mean all three 167 167
or any of these three depending on the context. 168 168
So just be careful about that as you hear people talking 169 169
in the industry to make sure you understand which one 170 170
of the three they're talking about.