Configure a Logging Syslog Channel

Како се проверава

Метод провере: Команда љуске

if [ -f /var/named/chroot/etc/named.conf ]; then out=$(named-checkconf -t /var/named/chroot -p /etc/named.conf 2>/dev/null) || exit 1
else conf=/etc/named.conf; [ -f "$conf" ] || conf=/etc/bind/named.conf
  out=$(named-checkconf -p "$conf" 2>/dev/null) || exit 1; fi
flat=$(printf '%s\n' "$out" | tr '\t\n' '  ' | tr -s ' ')
opts=$(printf '%s\n' "$out" | awk '/^options[ \t]*\{/{f=1} f{print} f&&/^\};/{exit}' | tr '\t\n' '  ' | tr -s ' ')
printf '%s\n' "$flat" | grep -Eq 'channel "?[^ ]+"? \{[^}]*[{; ]syslog( "?[a-z0-9]+"?)?;' && echo compliant || echo 'no logging syslog channel'

Очекивани излаз

compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Configure a syslog channel to capture at least the default and general categories of log events. For external authoritative name servers, the category lame-servers may be redirect to null, so that it is not logged. Using lame name servers is common for the domains used for SPAM and may overload the log with information that is not very useful. logging { . . . // Syslog channel default_syslog { syslog daemon; # send to syslog's daemon facility severity info; # only send priority info and higher }; category default { default_syslog; }; category general { default_syslog; }; // Too many lame servers, especially from SPAM category lame-servers { null; };

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

tmaegis scan --target bind