Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 1 Aug 2017 19:06:37 +0200
From: Solar Designer <solar@...nwall.com>
To: Александр Носарев <nosarev-ay@...bler.ru>
Cc: oss-security@...ts.openwall.com
Subject: Re: Syslog forwarding with IP spoofing

Hi all,

On Tue, Aug 01, 2017 at 05:27:26PM +0300,   wrote:
> I need to recive syslog messages, filter them and send them forward to the 
> SIEM.
> 
> Also HOST field is not represented in syslog, so i need to spoof IP of 
> forwarding
> packets to bind messages recived by SIEM to it's original source IP.
> 
> If i will try to add some marks to syslog message, I will need to override
> parsers for each syslog source type, so it seems like abad idea.
> 
> Is there any open source tool for that task?

Somehow we almost didn't have this sort of messages - someone seeking an
open source security tool - sent in here so far.  Do we want them in
here going forward?  The current list content guidelines do not address
this possibility, as it certainly wasn't the purpose of the oss-security
list so far.  Is there another mailing list where the above message
would have been more appropriate?

http://oss-security.openwall.org/wiki/mailing-lists/oss-security#list-content-guidelines

Meanwhile, please feel free to address the actual question about the
tool.  (I don't know of such a tool.)

Alexander

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ