Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Somehow an iptables rule was added to one of my systems. Does (or can) iptables keep a log about when and (maybe) who made a rule change? If iptables itself can't, is there a wrapper that might do that? I know sudo logs commands, but once someone does "sudo su -", that is the end of that.

share|improve this question
3  
iptables does not log changes, it just processes what ever command lines are used with it. There may be wrappers to iptables (none that I've come across), but then someone with a bit of clue may be able to get around that. May be you are better off with auditd, which can be set to log all commands issued by root (both to a local file and also syslog'ed off to a separate server). The added bonus being you get to see all root account usage, and not just iptables. –  Drav Sloan Sep 10 '13 at 22:24
add comment

1 Answer

up vote 1 down vote accepted

No, there is no change log for iptables.

Since only root can run iptables, an administrator who wants to bypass whatever logging you set up also has the power to turn off that logging, so you can only log changes made by cooperating administrators.

If you use iptables-save, use version control on the rules file. Train your fellow administrators to commit changes with a meaningful change message.

If you want the logging to happen automatically, replace the iptables executable by a wrapper script that performs the logging. Here's a quick-and-dirty script that isn't robust with respect to oddball arguments (e.g. containing newlines). If the log file cannot be written, this script displays an error message but proceeds with the iptables call.

#!/bin/sh
( exec >/var/log/iptables.log;
  echo -n "$(date '+%Y:%m:%d %H:%M:%S')" "$(id -run)" iptables
  for x; do echo -n "'$x'"; done )
exec /sbin/iptables.real "$@"
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.