Smoothwall Enhanced Firewall Log Module

I really love my Smoothwall firewall. It offers good security using an older computer and it is infinitely customizable. One of the big strengths of Smoothwall is that with a little bit of Perl you can make it do almost whatever you want. There is a large ecosystem of third party modules that allow you to customize the functionality of your Smoothwall box.

One of the modules that I use is the enhanced firewall log. It is currently at version 1.4.3 and it enhances the normal log viewer and allows you to sort on different values and adds color coding to the entries.

This module has worked fine for me up until today. I was having some issues reaching some sites on the Internet and it appeared the firewall was the issue. I logged into the Smoothwall and it was slow to respond. The box had an uptime of a little over 9 months so I decided to reboot it. After the reboot was complete the firewall log was giving me an HTTP 500 error. Every other page was fine.

The error log showed:

Premature end of script headers: firewalllog.dat,
 at /httpd/cgi-bin/logs.cgi/firewalllog.dat line 409

After some Internet searching I found the following link in the Smoothwall communities.

Copy and paste of relevant information that fixed my problem.

he enhanced firewall logs mod with the CIDR capabilities assumes that all of the data the first field of the ipblock file will be numeric but it doesn't test it... my fix adds two lines and gets us around this problem... at least at the stage of reading the data from the ipblock file

 in /httpd/cgi-bin/logs.cgi/firewalllog.dat, near line 57, you should find

# Added by fwlogmod

use Socket;

use Net::CIDR;

# END added by fwlogmod

right after that, add

use Scalar::Util qw(looks_like_number);

so the block looks like this (until the maintainer possibly adds this to their released code)

# Added by fwlogmod

use Socket;

use Net::CIDR;

# END added by fwlogmod

use Scalar::Util qw(looks_like_number);

then down near line 217 you should find

open (ACTIVEBLOCKFILE, "/var/smoothwall/ipblock/config");

@ll=;
close(ACTIVEBLOCKFILE);
foreach $lll (@ll) {
            chomp($lll);
            @ittt=split(/,/,$lll);
            $cidrstr= $ittt[0];

between those last two lines, add

next if !looks_like_number($ittt[0]);  ## make sure it is a number!

so the whole block now looks like this

open (ACTIVEBLOCKFILE, "/var/smoothwall/ipblock/config");

@ll=;
close(ACTIVEBLOCKFILE);
foreach $lll (@ll) {
            chomp($lll);
            @ittt=split(/,/,$lll);
            next if !looks_like_number($ittt[0]);  ## make sure it is a number!
            $cidrstr= $ittt[0];

save and done... now if the first field of the ipblock file is not numeric, your firewall log viewer won't blow up on you.

Syslog to MySql on openSUSE

I have been experimenting with openSUSE lately as I am not impressed with the direction Mandriva Linux is going. Mandriva has been my main distribution since early versions of Mandrake back around 1998.

I followed the steps in my earlier post but I had to fiddle with a few more things to get it running on openSUSE.

In /etc/rsyslog.conf I added:

$ModLoad imudp         # load udp server
$UDPServerRun 514      # start udp server

the UDP server was not running by default so I added it and poked a hole in the firewall so that I could log the router messages to the database.

Syslog to MySQL

I had a need to put Syslog data into a database for further analysis.
Using one of my linux boxes this turned out to be much easier than I thought, at least for basic functionality.

Basically I followed the instructions at http://www.rsyslog.com/doc/rsyslog_mysql.html
 and everything just worked.

I already had MySQL installed and Rsyslog was the default syslog on my Linux distribution so I used the included script to create the database, then I created the account.

mysql -u root -p < /usr/share/doc/rsyslog-mysql/createDB.sql

grant all privileges on Syslog.* to 'Syslog'@'%' identified by 'password' with grant option;

Then I modified the rsyslog config file.

#put this line as the first line in /etc/rsyslog.conf
$ModLoad ommysql

#this line logs everything
*.*       :ommysql:127.0.0.1,Syslog,Syslog,password
#*.*       :ommysql:127.0.0.1,db-name,db-user,db-password

Then I restarted the Rsyslog process.
/etc/rc.d/init.d/rsyslogd restart

Then I issued a 'SELECT * FROM Syslog.SystemEvents;'


I saw that the local machine was logging all of its syslog data and the other devices that were logging to the syslog server were also showing up in the database. As a point of interest, all of the data was still being put in the regular syslog file as well.

Future work on this will be to tailor what gets logged and some possible customizations.

Create an Animated Gif with ImageMagick

I needed to create an animated series of images to observe some change over time.
To do this I decided to use ImageMagick on my linux machine. I save all of the images in a folder named image1.png, image2.png, image3.png, ... .

Then I used the following command.

convert -verbose -delay 200 -loop 0 image*.png output.gif

This takes the files named image*.png in the order that they are listed and makes a GIF out of them with a 200 hundreths of a second delay between each frame. The -loop 0 flag makes it loop indefinitely. You can put 4 in there to loop 4 times etc.

This worked fine but the order was not correct when I got over 10 images so for now I renamed them to imageA.png and went from there.

That solved my immediate need for an animated image but I need to find a neater solution to sorting the filenames.

MySql Shortcut

If you access a MySql database from a linux machine here is a tip that can save you some time. In your home directory create a file named .my.cnf. That is dot-my-dot-cnf.

Then in that file you can create multiple entries like the following:

[client]
user=username
password=%!;*;^123
host=localhost

Now when you ssh in and type mysql, the client will automatically parse and use those credentials. You can specify multiple hosts if you want like this:

[client]
user=username
password=%$**^123
host=hosta.example.com

[client]
user=usernameB
password=%B^123
host=hostb.example.com

Then the MySql client will choose the proper set depending on the host you are connecting to. This feature served me well when using R scripts. In a R script that access a database you can specify the particular client group that you want to use.

In the .my.cnf file.

[Rdata]
user=Ruser
password=password
host=localhost

Then in the R file itself you can create the connection like this:

dbcon <- dbConnect( MySQL(), group="Rdata")

Now you can move the script around or share it without worrying about revealing your password information.