Facebook
Twitter
Thomas Wilhelmi
Regular Pleskian
Hi,
again I have a question about the Firewall-module. How can I enable logging for some rules?
again I have a question about the Firewall-module. How can I enable logging for some rules?
-
Halloween is coming! To celebrate the occasion, we dusted off a couple of old skins, and even created a brand new one (Pixel).
To get into the festive spirit, install the Skins extension. -
The new Python extension is now available. It allows customers to deploy and manage WSGI-based Python applications on their websites directly from Plesk.
-
The Plesk Mobile apps for iOS and Android and the Plesk Mobile Center extension have been deprecated, and are no longer available for new installations. In Plesk Obsidian 18.0.84, the Plesk Mobile Center extension will be removed from servers during the upgrade, and the Plesk Mobile apps will lose their server management features.
-
The Social Login extension has been deprecated and will be removed in Plesk Obsidian 18.0.84. After that, it will no longer be possible to log in to Plesk with a Google, Facebook, GitHub account, or with a passkey. Plesk usernames and passwords, as well as logging in with a WebPros Account, are not affected.
Again firewall question
- Thread starter Thomas Wilhelmi
- Start date
Thomas Wilhelmi
Regular Pleskian
Hm, that means I have to create the entries for logging myself and add it in the created script myself after activating it and execute it again?
Thomas Wilhelmi
Regular Pleskian
Thx. Of course I would backup my changes 
And of yourse you may ask. That's the meaning of a Forum. I have 2 main ideas here. First of all you're right I would like to see if a (new) rule is being hit and the second is to probably analyse attack-patterns.
And of yourse you may ask. That's the meaning of a Forum. I have 2 main ideas here. First of all you're right I would like to see if a (new) rule is being hit and the second is to probably analyse attack-patterns.
That thought also crossed my mind. You mean detecting stuff like port probing? Because in case of various types of DoS relying on heavy traffic having tons of log records to write may be quite harmful.
Thomas Wilhelmi
Regular Pleskian
That's definitely a good Point. I think I have to make some experience to get a feeling what is a good compromise.
atomicturtle
Golden Pleskian
There are certainly options that would let you limit the rate of logging in a LOG rule. For example in ASL we have blacklist rulesets with LOG rules at the bottom that fire at 10 in 1 minute, and a limit burst of 2. A limit for a TOR blacklist looks like this:
-A ASL-TOR-DROP-LOG -m limit --limit 10/minute --limit-burst 2 -j LOG --log-level info --log-prefix "ASL_TOR_BLOCK " --log-tcp-sequence --log-tcp-options --log-ip-options
This way you will log the event with its own syslog prefix, and limit the total number of log messages to no more than 2 events in 1 minute.
-A ASL-TOR-DROP-LOG -m limit --limit 10/minute --limit-burst 2 -j LOG --log-level info --log-prefix "ASL_TOR_BLOCK " --log-tcp-sequence --log-tcp-options --log-ip-options
This way you will log the event with its own syslog prefix, and limit the total number of log messages to no more than 2 events in 1 minute.
Thomas Wilhelmi
Regular Pleskian
Thanks for this hint
