sysklogd: Fix sending packets to remove syslog servers

When sysklogd binds to localhost, it will try to use that socket to
reach any remove syslog servers which fails because of obvious reasons.

Therefore we will have to let sysklogd bind to 0.0.0.0 and we create a
separate firewall so that we won't accept any packets from the network
but localhost which is accepted in the LOOPBACK chain.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index c7642282f6eb5d5a03d2ccb157dbf815883684f4..a97758dc371b9cddf2d00b1014ada562f39c47dd 100644 (file)
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -322,6 +322,12 @@ iptables_init() {
                iptables -A GUIINPUT -i "${GREEN_DEV}" -p tcp --dport 444 -j ACCEPT
        fi
 
+       # Drop any messages to syslog
+       iptables -N SYSLOG
+       iptables -A SYSLOG -p udp --dport 514 -j DROP
+       iptables -A SYSLOG -p tcp --dport 514 -j DROP
+       iptables -A INPUT -j SYSLOG
+
        # WIRELESS chains
        iptables -N WIRELESSINPUT
        iptables -A INPUT -m conntrack --ctstate NEW -j WIRELESSINPUT

diff --git a/src/initscripts/system/sysklogd b/src/initscripts/system/sysklogd
index c2531b1eb36b19ce91e92d3f2c12515d931bae0b..9263daf0cb8bdf57218ce1d7cb734be31ad5b16a 100644 (file)
--- a/src/initscripts/system/sysklogd
+++ b/src/initscripts/system/sysklogd
@@ -25,7 +25,7 @@
 case "${1}" in
        start)
                boot_mesg "Starting system log daemon..."
-               loadproc syslogd -m 0 -r -k -b 127.0.0.1
+               loadproc syslogd -m 0 -r -k
 
                boot_mesg "Saving Bootlog..."
                if [ -e /var/log/bootlog ]; then