[4.720] Logging of WebAdmin Access

I have a simple lab installation with 2 rules:

S: Internal (Network) -> D: Any - Service: Any - Accept (no log)
S: Any -> D: External (Address) - Service: Any - Drop (log)

I have "zillions" of logentries like this one:
8:50:39 ACCEPT 4634 -> 443 TCP SYN

Even if there was something wrong with my IE at least ASL should NOT log those connections...

Has anybody else experienced this kind of behaviour yet?

techno.kid

Parents

0 Gert Hansen over 21 years ago

Hi there,

Every Admin session is logged and every packet that is sent to the administration port is logged
this is required by several govermental certifications we want to meet with ASL V5.

regards
Gert
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 techno.kid over 21 years ago in reply to Gert Hansen

Hello Gert,

I understand that this "feature" might be neccessary to "someone" but isn´t it a kind of DOS since I get plenty of [06:28:23 ACCEPT 4198 -> 443 TCP SYN]???
Maybe you can add a button to disable this "feature" or have different "local" versions of ASL...

However, I wonder that I´m the only one who is "complaining"... :-)

techno.kid
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 techno.kid over 21 years ago in reply to Gert Hansen

Hello Gert,

I understand that this "feature" might be neccessary to "someone" but isn´t it a kind of DOS since I get plenty of [06:28:23 ACCEPT 4198 -> 443 TCP SYN]???
Maybe you can add a button to disable this "feature" or have different "local" versions of ASL...

However, I wonder that I´m the only one who is "complaining"... :-)

techno.kid
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 JimmyM over 21 years ago in reply to techno.kid

I can see your point but, unless you stay connected for extended periods, the log size shouldn't be an issue. I doesn't seem to take up any real processing power either. I was concerned because of seemingly unexplained 443 packets logs being generated. Now that Astaro has explained it, It's really not a big deal, and certainly not a DOS.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 techno.kid over 21 years ago in reply to JimmyM

Hi Jim,

conisder: if you do some troubleshooting and therefore need to use the LiveLog all the interesting events will "scroll away".
In any other situation I´d agree with you point.

techno.kid
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 JimmyM over 21 years ago in reply to techno.kid

You can always use the logs. I see your point about up to the second live log entries. For that, perhaps a longer live-log display would be of use.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel