Hack Like a Pro: Linux Basics for the Aspiring Hacker, Part 23 (Logging) « Null Byte :: WonderHowTo

Welcome back, my amateur hackers!When you are using and administeringLinux, it is important to be conversant in the use of the log files. As you know, log files are the repository for much information about our system, including errors and security alerts.If we are trying to secure Linux, it is crucial to know how to manage the logging functions to be able to know if your system has been attacked, and to then decipher what actually happened and who did it. If you are the attacker, it is crucial to understand what information can be gathered about you and your methods from these same log files so you can avoid leaving any trace behind.Generally, Linux uses a daemon (a program that runs in the background) called syslogd that is a unified system for logging events on your computer. Several variations of syslog exist, including rsyslog and syslog-ng. Although they operate very similarly, they do have some minor differences. Since ourKali Linuxis built on Debian, it comes with rsyslog by default, so that is what we will be using in this tutorial.Step 1: Open a Terminal in KaliLet's begin by opening a terminal in terminal. To find our rsyslog, we can simply type:kali > locate rsyslogStep 2: Open the Rsyslog Configuration File (rsyslog.conf)Like nearly every application in Linux, rsyslog is managed and configured by a plain text configuration file. As you hopefully learned inearlier Linux tutorials, generally, configuration files are located in the/etcdirectory. In the case of rsyslog, it is located at/etc/rsyslog.conf. Let's open that file with any text editor (here I will use Leafpad).kali > leafpad /etc/rsyslog.confAs you can see above, the rsyslog.conf file comes well documented with numerous comments explaining its use.Step 3: Format of the Rsyslog Configuration FileLet's navigate down a bit to below Line 50. Here begins the "Rules" section. This is where we can set the rules for what Linux logs.The basic format for these rules is:facility.priority actionThefacilityword references the program (such asmail,kernel,lpr, etc.) that generates the message to be logged. Theprioritykeyword references the importance of the log message. Finally, theactionkeyword references the location that the log is to be sent to. This can be a file, remote computer, etc.FacilitiesThe valid codes to put in place of the facility keyword in our configuration file rules include:authauthprivdaemonkernlprmailmarknewssecuritysysloguseruucpAn asterisk (*) refers to all facilities. You can select more than one facility by listing them separated by a comma.PrioritiesThe valid codes for priority are:debuginfonoticewarningwarnerrorerrcritalertemergpanicThe priority codes are listed from lowest (debug) priority to highest (emerg,panic). Thewarningis the same aswarn,erroris the same aserr, andemergis the same aspanic.Error,warn, andpanicare all deprecated and should not be used.For instance, if you specify a priority code ofalert, the system will log messages that are classified asalertoremerg, but notcritor below.ActionsThe action is usually a file name with its location. For instance,/var/log/messages.Step 4: Examples of Facility.Priority ActionLet's look at some examples.mail.* /var/log/mailThis example will logmailevents of all (*) priorities to/var/log/mail.kern.crit /var/log/kernelThis example will log kernel (kern) events of critical (crit) priority or higher tovar/log/kernel.*.emerg *This example will log all events (*) of the emergency priority (emerg) to all logged on users.Step 5: LogrotateIf you don't delete your log files, they will eventually fill your entire hard drive. On the other hand, if you delete your log files too frequently, you will not have them for an investigation at some future point in time. We can uselogrotateto determine the balance between these opposing requirements.We can rotate our log files by creating acron jobthat periodically rotates our log files through the logrotate utility. The logroate utility is configured with the/etc/logrotate.conf. Let's open it with a text editor and take a look at it.In most cases, the default configuration will work for most people, but note on Line 6 that the default setting is to rotate logs every 4 weeks. If you want to keep your logs for a longer or shorter time, this is the setting you should change.Keep coming back, my amateur hackers, as we explore the use and administration of Linux that will help make you a professional hacker!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaShutterstockRelatedNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 1 (Getting Started)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 6 (Networking Basics)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 22 (Samba)How To:The Essential Skills to Becoming a Master HackerHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 11 (Using Splunk)How to Hack Like a Pro:Getting Started with MetasploitHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 13 (Mounting Drives & Devices)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 12 (Loadable Kernel Modules)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 2 (Creating Directories & Files)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 21 (GRUB Bootloader)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 14 (MySQL)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 9 (Managing Environmental Variables)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 5 (Installing New Software)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 25 (Inetd, the Super Daemon)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 17 (Client DNS)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 4 (Finding Files)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 15 (Creating a Secure Tunnel to MySQL)News:What to Expect from Null Byte in 2015Goodnight Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 9 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 8 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 1 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 2 - Legal Hacker TrainingHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterGoodnight Byte:HackThisSite Walkthrough, Part 10 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 4 - Legal Hacker TrainingNews:Let Me Introduce MyselfHack Logs and Linux Commands:What's Going On Here?Community Byte:HackThisSite Walkthrough, Part 10 - Legal Hacker TrainingHow To:How Hackers Take Your Encrypted Passwords & Crack ThemCommunity Byte:HackThisSite, Realistic 2 - Real Hacking SimulationsCommunity Byte:HackThisSite Walkthrough, Part 9 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 5 - Legal Hacker Training