Firestarter's hit list stays blank when portscanned locally

longhornxtreme · 2004-08-04 03:45:32

I have no real understanding of Iptables and just realized that after switching to AL I needed to set up some sort of firewall on my desktop.

So I pacman'd firestarted, found it in /opt/gnome/bin and ran the gui app

I set up everything according to how I wanted it to act and then dropped it down into KDE's tray.

I hopped over to one of my other local computers and scanned it with nmap and Xscan and both turned up blanks. Thats great... but Firestarter's hitlist is staying blank. Not a single notification has popped up as it should, the home LAN has numerous M$ and *nix boxes.... and our public IP is scanned quite regularly by kiddies out there....

Is there some configuration I need to carry out? I've read the manual at Firestarter's homepage and drew a blank.

Anyone seen this behavior with firestarter? It will stay running on the comp as its keeping my desktop slightly less vulnerable but I'd really like to gain full functionality from the program.

If ya'll need any more information please don't hesitate to ask... Or a URL to go read at... I've drawn a blank on google and linuxquestions.org....

Appreciate any replies,
James

ghostwalker · 2004-08-04 04:01:51

Take a look at /var/log/kernel that is where my iptable logging is ending up. I have used firestarter for sometime now. It is the easiest to firewall to setup and is somewhat extensive. I just use tail -f /var/log/kernel.

Walt

longhornxtreme · 2004-08-04 04:05:42

Thanks for the quick reply...

But I don't quite understand what the tail -f /var/log/kernel command does....

I'll check out the kernel log once i get home from school....

ghostwalker · 2004-08-04 04:27:38

At the root prompt in a terminal tail -f /var/log/kernel will display any new messages that reported as the datat is appended to the end of kernel file, let alone any file.

Walt

longhornxtreme · 2004-08-05 03:04:02

That still doesn't help me out with the GUI functionality at all...

I would still like to be able to monitor my firewall without digging through log files but I appreciate the help anyways!

IceRAM · 2004-08-05 06:39:29

longhornxtreme wrote:

I would still like to be able to monitor my firewall without digging through log files but I appreciate the help anyways!

I use normal iptables logging (the LOG chain) [from gShield (PKGBUILD available on the forums)] and I redirect all my kernel output to vc12 from within syslog-ng. I could create a filter for those messages in syslog-ng to show, for example, the firewall messages on vc11, but haven't looked in the configs yet.

Or, now I've thought of something else. You can create a FIFO with mkfifo and pipe all the firewall messages to that (also using a filter in syslog-ng). Let's assume you've created it with

mkfifo /var/log/iptables_pipe

Config your syslog-ng (I don't know if syslog is so flexible) to redirect iptables messages to /var/log/iptables_pipe (I can't tell you how to do this, because I haven't tried it yet).
Do (in a console)

while read line; do echo $line; done < /var/log/iptables_pipe

and you'll have live report from iptables.
^ I think this should work, but haven't tested it yet (as I've said).

Good luck.

IceRAM

P.S.1. There are some more advanced programs (as far as I remember) for detecting intrusions on Linux. I don't remember these advanced programs having a GUI, probably because they're enough complicated on the inside to create an interface for them. They just put the output in a log, you follow it whatever you want. You won't see much interactivity from the Linux firewalls, mostly because they were supposed to just sit on a machine and do their work.
P.S.2. I haven't seen on linux a GUI firewall on linux doing popups and so on. This is probably because the components are well defined, the firewall runs as root and you probably log in as a normal user. Allowing a normal user to modify live the firewall rules creates a security hole.

longhornxtreme · 2004-08-06 08:18:35

I joined Firestarter's mailing list and found a solution...

The key was to edit the firestarter script in /root/.gnome2/firestarter

by adding these two lines to the end of it... fixed the GUI functionality right up....

[Files]
syslog=/var/log/kernel

Thanks a bunch for all your help!

steveed · 2004-08-21 02:00:13

Hello these tips helped me get firestarter .92 working fine, but since the update I have not been able to get .93 working correctly. I followed the instructions from the firestarter-user mailing list which stated that you should issue the following command:
In Firestarter 0.9.3, as root, run "gconftool-2 --set --type string /apps/firestarter/client/system-log /var/log/syslog".

I tried using both the kernel and the iptables logs as well with no luck. Anyone have any experience with this.

ghostwalker · 2004-08-21 03:04:20

Hey I tried it. Also what happens when you try tail -f /var/log/kernel ?

steveed · 2004-08-21 11:44:14

ghostwalker wrote:

Hey I tried it. Also what happens when you try tail -f /var/log/kernel ?

Thanks, if I do "tail -f /var/log/kernel.log" I get a the hit list along with the other kernel info, so I guess this provides the information. Hopefully this will work the other way soon.
-Stephen

wickedlester · 2004-08-24 20:21:42

steveed: try changing this "gconftool-2 --set --type string /apps/firestarter/client/system-log /var/log/syslog" to this
"gconftool-2 --set --type string /apps/firestarter/client/system_log /var/log/kernel" thats how mine is in gconf-editor.

edit: note the - between system log is changed to underscore_

Arch Linux

#1 2004-08-04 03:45:32

Firestarter's hit list stays blank when portscanned locally

#2 2004-08-04 04:01:51

Re: Firestarter's hit list stays blank when portscanned locally

#3 2004-08-04 04:05:42

Re: Firestarter's hit list stays blank when portscanned locally

#4 2004-08-04 04:27:38

Re: Firestarter's hit list stays blank when portscanned locally

#5 2004-08-05 03:04:02

Re: Firestarter's hit list stays blank when portscanned locally

#6 2004-08-05 06:39:29

Re: Firestarter's hit list stays blank when portscanned locally

#7 2004-08-06 08:18:35

Re: Firestarter's hit list stays blank when portscanned locally

#8 2004-08-21 02:00:13

Re: Firestarter's hit list stays blank when portscanned locally

#9 2004-08-21 03:04:20

Re: Firestarter's hit list stays blank when portscanned locally

#10 2004-08-21 11:44:14

Re: Firestarter's hit list stays blank when portscanned locally

#11 2004-08-24 20:21:42

Re: Firestarter's hit list stays blank when portscanned locally

Board footer