logo
Apache Lounge
Webmasters

 

About Forum Index Downloads Search Register Log in  RSS Apache Lounge  


Keep Server Online

If you find the Apache Lounge, the downloads and overall help useful, please express your satisfaction with a donation.

or

Bitcoin

A donation makes a contribution towards the costs, the time and effort that's going in this site and building.

Thank You! Steffen

Your donations will help to keep this site alive and well, and continuing building binaries. Apache Lounge is not sponsored.


Post new topic   Forum Index -> Other Software View previous topic :: View next topic
Reply to topic   Topic: ufw and apparmor
Author
MysteryFalcon



Joined: 01 Dec 2021
Posts: 3
Location: Stockholm

PostPosted: Sat 05 Mar '22 10:55    Post subject: ufw and apparmor Reply with quote

Hello

I've just setup a new webserver and I thought I'd explore apparmor with ufw.

I see in the sysinfo log, a constant brigade of outputs like:
[ 4089.623593] [UFW BLOCK] IN=enp1s0 OUT= MAC=00:e0:4c:68:01:49:00:d0:f6:59:af:88:08:00 SRC=..... DST=....... LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=47869 PROTO=TCP SPT=58920 DPT=62900 WINDOW=1024 RES=0x00 SYN URGP=0

This was to be expected I guess. But I'm wondering, if anyone knows, since I can't find anything on it when I search for it: how do I list all blocked IPs?

Furthermore, if anyone knows: is it possible to turn off logging for this to syslog but still keep it in the ufw.log ?

Cheers!
Back to top
tangent



Joined: 16 Aug 2020
Posts: 217
Location: UK

PostPosted: Sat 05 Mar '22 18:27    Post subject: Reply with quote

I decided not to use ufw as a wrapper to iptables, but rather tackled using iptables directly. That said, I don't believe the default ufw configuration is working against a blacklist of IPs, but rather is simply logging (and blocking) non-approved port requests, invalid packets, etc.

Any server that is Internet facing will be getting an enormous number of connection attempts/probes from various sources, so over time your blocked IP list will be massive. If you really want to, believe you'd have to script parsing all the blocked SRC IPs from the ufw.log file (a non-trivial task), bearing in mind those logs get rotated and aged via /etc/logrotate.d/ufw. This was one of the reasons I chose to use iptables directly, in that I could decide what gets dropped, logged, etc.

The solution to removing the ufw entries from syslog, is out there on the net. Namely, edit the /etc/rsyslog.d/20-ufw.conf file, and uncomment the final entry to leave "& stop". Then restart rsyslogd "systemctl restart rsyslog".
Back to top


Reply to topic   Topic: ufw and apparmor View previous topic :: View next topic
Post new topic   Forum Index -> Other Software