[Announce] Nulog 1.1.0 is available

[Announce] Nulog 1.1.0 is available

[Eric Leblond]

Hi,

INL is proud to announce the availability of Nulog 1.1.0. 

Nulog, previously known as ulog-php, is a firewall log analysis
interface written in php. Netfilter is able to log selected packets
directly in a database like MySQL or PostgreSQL. Nulog uses this feature
to display security events in real-time on a user-friendly interface.

It now integrates deeply with NuFW user activities logging and can now
cope with multiples logging tables. Thus, a single NuFW interface can
now be used to managed multiple firewalls or a set of archive tables.

Nulog is, of course, released under GPL licence.

Nulog : http://www.inl.fr/article.php3?id_article=36
NuFW : http://www.nufw.org/

BR,
-- 
Eric Leblond <eric@inl.fr>

Re: [Announce] Nulog 1.1.0 is available

[R. DuFresne]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


considering the history of php, and many php applications and their 
bi-weekly appearance in the various sec lists for newly discovered vulns, 
how afe is this application and would one want to place it on or near 
their main security device?

thanks,

Ron DuFresne

On Thu, 30 Jun 2005, Eric Leblond wrote:

> Hi,
>
> INL is proud to announce the availability of Nulog 1.1.0.
>
> Nulog, previously known as ulog-php, is a firewall log analysis
> interface written in php. Netfilter is able to log selected packets
> directly in a database like MySQL or PostgreSQL. Nulog uses this feature
> to display security events in real-time on a user-friendly interface.
>
> It now integrates deeply with NuFW user activities logging and can now
> cope with multiples logging tables. Thus, a single NuFW interface can
> now be used to managed multiple firewalls or a set of archive tables.
>
> Nulog is, of course, released under GPL licence.
>
> Nulog : http://www.inl.fr/article.php3?id_article=36
> NuFW : http://www.nufw.org/
>
> BR,
> --
> Eric Leblond <eric@inl.fr>
>
>

- -- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         admin & senior security consultant:  sysinfo.com
                         http://sysinfo.com
Key fingerprint = 9401 4B13 B918 164C 647A  E838 B2DF AFCC 94B0 6629

...We waste time looking for the perfect lover
instead of creating the perfect love.

                 -Tom Robbins <Still Life With Woodpecker>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFCxZq2st+vzJSwZikRAo+SAKCsXdWrA4PSRutH26tymiYg4HiOrwCaAsuB
ThBRuEY7+ONTB1aobNeP0ps=
=QY3F
-----END PGP SIGNATURE-----

Re: [Announce] Nulog 1.1.0 is available

[Eric Leblond]

Le vendredi 01 juillet 2005 à 15:34 -0400, R. DuFresne a écrit :
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> 
> considering the history of php, and many php applications and their 
> bi-weekly appearance in the various sec lists for newly discovered vulns, 
> how afe is this application and would one want to place it on or near 
> their main security device?

This application exists since some years now and we have proceed to some
code audits and have carefully checked user entries to avoid SQL
injection or other problems.

The other point is that this application has not to be available for
evryone has it contains private information. Thus, it can be protected
from "bad people" by authentication or other mean. To be simple, access
has to be restricted to admins.

An other point is that permissions on the MySQL database should and can
be carefully set to have only read-only permission on the table
containing the ulogd/NuFW logs. This restricted permissions can assure
that the logged datas can not be corrupted. Futhermore, in the case of
an Ulogd installation, the logged packets can be duplicated in syslog,
thus any hypothetic datas corruption is armless.

Finally, as ulogd can log on a database running on a separate host, your
firewall is safe as there is no server running on it. 

BR,
-- 
Eric Leblond <eric@inl.fr>

RE: [Announce] Nulog 1.1.0 is available

[matt]

The Nulog 1.1.0 release has a bug.

The mysql dumpfile does not contain the conntrack_ulog table.

This has been reported to the nulog email account.



-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Eric Leblond
Sent: 03 July 2005 22:43
To: R. DuFresne
Cc: netfilter@lists.netfilter.org
Subject: Re: [Announce] Nulog 1.1.0 is available

Le vendredi 01 juillet 2005 à 15:34 -0400, R. DuFresne a écrit :
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> 
> considering the history of php, and many php applications and their 
> bi-weekly appearance in the various sec lists for newly discovered vulns, 
> how afe is this application and would one want to place it on or near 
> their main security device?

This application exists since some years now and we have proceed to some
code audits and have carefully checked user entries to avoid SQL
injection or other problems.

The other point is that this application has not to be available for
evryone has it contains private information. Thus, it can be protected
from "bad people" by authentication or other mean. To be simple, access
has to be restricted to admins.

An other point is that permissions on the MySQL database should and can
be carefully set to have only read-only permission on the table
containing the ulogd/NuFW logs. This restricted permissions can assure
that the logged datas can not be corrupted. Futhermore, in the case of
an Ulogd installation, the logged packets can be duplicated in syslog,
thus any hypothetic datas corruption is armless.

Finally, as ulogd can log on a database running on a separate host, your
firewall is safe as there is no server running on it. 

BR,
-- 
Eric Leblond <eric@inl.fr>


-- 
No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.323 / Virus Database: 267.8.8/37 - Release Date: 01/07/2005
 

-- 
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.323 / Virus Database: 267.8.8/37 - Release Date: 01/07/2005
 

RE: [Announce] Nulog 1.1.0 is available

[Eric Leblond]

Le lundi 04 juillet 2005 à 18:07 +0100, matt a écrit :
> The Nulog 1.1.0 release has a bug.
> 
> The mysql dumpfile does not contain the conntrack_ulog table.
> 
> This has been reported to the nulog email account.

Hi,

This is related to default value of variables that are badly set (Or at
least badly documented).

Set 
	$conntrack_enabled="no";
	$actif_and_passif=0;
in include/config.inc

PS : sorry for the delay, I did not see this e-mail till today.

BR,
-- 
Eric Leblond <eric@inl.fr>