Tools

Log Viewer
Fingerprint Files
Reporting

Log Viewer

The Log Viewer Utility will allow you to view the contents of your firewall logs and provides filters so that you can view only the data the is pertinent to your needs. Once you have chosen your filters, you can hit 'View Log' and fBuilder will bring you to a screen that will provide you with the information about the packets that were logged.

The first option in the Log Viewer is for you to choose the location of your log file. By default, fBuilder will populate this list with the messages files located in /var/log. Typically, you will see /var/log/messages, /var/log/messages.1, /var/log/messages.2, etc. This is because your system is moving your log files out to a different name as they get too big or on a certain time schedule. If you are looking for data in a certain time range and it is not located in the messages file, you may have to look though messages.1, .2, etc.

The last option on the 'Choose Log File' list is 'Other'. You can use this option of your firewall logs are going to a location other than /var/log/messages. If you choose other, the 'Alternate Location' section will become available for you to type in the path and filename of the appropriate log file. fBuilder will remember the last 'Alternate Location' that you chose and add it to the drop down under 'Choose Log File' so that you don't have to type it every time.

After choosing your log file, you will want to explore the filters in the next section. If you do not want to filter, you do not need to choose any of the options. In this senerio, you will see all of the firewall log messages that are in the file that you chose above. To activate a filter, you click the check box next to the filter you want to use. You can use any combination of filters to get the desired result. The filters are defined below:

Filter by Time and Date -- This defaults to the last hour. You can change these values to any range you want to see those log entries. Remember, your log file may not include the entire range that you specify as the log file may have been circulated somewhere in the middle of the range. If that is the case, you may have to check with one of the other log file (.1 or .2, etc) to see if you can find the rest of the range.
Filter by IP -- You can filter by ip address or network block with this filter. If you want to see all logs from 192.168.1.0/24, you can enter 192.168.1 in this field. Alternately, you can separate multiple ip addresses with a | with no spaces. An example of this technique would be 192.168.1.22|192.168.1.23
Filter by Port -- This filter allows you to specify the port number you with to filter on. This must be used as a port number and not the name. In other words, you would use 110, NOT pop3. This filter does not allow you to enter half of a port number to get all 'like' port numbers as the ip filter does. You must use the exact port number you wish to view -- 80 will not show 8000. As with the ip filter, you can show multiple ports by using a | with no spaces. An example would be 80|110.
Filter by Protocol -- Allows you to filter on a specific protocol. Be advised, this filter is case sensitive to speed up the processing of the log. TCP is NOT the same as tCp. If you are not sure of the case listed in your log file, you can run the log viewer without this filter and check the case on the output page. Again, you can specify multiple protocols with the | and not spaces: TCP|UDP. If you choose not to use this filter, all protocols will be shown.
Filter by Type -- Allows you to narrow down your search by choosing to view log entries from a specific type, or target. Please note that the target may not be as you expect. When fBuilder automatically creates a LOG rule for you, it will create the log prefix with the target of the rule you are logging. This helps when viewing your logs because you can see what the log rule was intended to do. In reality, a LOG rule has a LOG target, but that wouldn't tell you much. If you chose the 'Log this Rule' option when creating a rule to ACCEPT port 80, you would see ACCEPT when viewing the log entires.

Below the filters you will see two options; Resolve Host Names and Resolve Common Port Names. These options are on by default so that the display is easier to read. If your logs are very large, this can significantly slow down the processing of your log file. fBuilder builds a cache for name resolution to speed up the process, but there are occasions that you will want to turn these options off. Some of these times could include: A machine that can not access DNS, you may want to know the port numbers or ip addresses so you can create a filter, or on a large log file.

Clicking 'View Log' will allow fBuilder to parse your log file and return the data that has been filtered. The fields returned are:

Time -- The date and time of the log entry
Target -- The target of the rule you are logging. Again, this could be LOG if it is a stand alone log rule, however, if you created the rule with the 'Log this rule' option, it should match the target of the original rule.
Chain -- This is the chain that LOG entry was called from (The chain the packet was traversing when the LOG match was made)
Protocol -- This is the protocol of the packet logged.
Source IP -- This is the address of the machine that sent the packet that was logged.
Source Port -- This is the source port of the packet that was sent. Typically you should not be too worried about this value as it is created dynamically by most applications.
Destination IP -- This is address of where the packet was heading.
Destination Port -- This is the port where the packet was heading. This is an important value to recognize what service the firewall was blocking.

At the bottom of the log page you will see some summary information about the data that was filtered from your log file as well as a refresh button. The refresh function has been programmed to update your the time to 'current' time when filtering on Time and Date. If you are filtering information from 1 hour, 2 days ago there would be no reason to use the refresh function so this should never be a concern. If you were filtering from the past 5 minutes and you wanted to refresh the data, then you would WANT this behavior so you could view the new packets that have been logged.

Fingerprint Files

Fingerprinting a file in fBuilder will build a checksum of the file fingerprinted. Once the file has been fingerprinted, fBuilder will know if the file has changed (by even ONE character). The benefit is that you can fingerprint some or all of your files and if your machine is compromised, you will know.

When you first enter the fingerprinting utility for the first time, you will be prompted to 'Add Common Files' or 'Manually Add Files'. If you choose the 'Add Common Files' option, you will still have the ability to manually add files at a later time. The 'Add Common Files' option to add some of the system files that are typically compromised by a root kit.

Once the common files are fingerprinted, or if you chose 'Manually Add Files', you will be brought to the main interface for the fingerprint utility known as the 'Fingerprint View'. If any of the files listed in the common files did not fingerprint correctly, you will see the error on the top of the screen listed in red.

The interface consists of five fields:

Update -- Used when you have updated a file and the fingerprint needs to be updated
Delete -- Used to delete the file from the fingerprint list
File -- The full path and file name that has been fingerprinted
State -- Shows that the file has been fingerprinted
Status -- Shows the status of that fingerprint

Below this table, you will see a refresh button and an 'Add Files' button. By refreshing the page, fBuilder will check the status of your file fingerprints and list any of the files that has been changed. The 'Add files' button will bring you to a screen where you can manually add additional files to be fingerprinted. Once inside the 'Add files' function, you will be asked how many files you would like to fingerprint. Adding an number in the field and clicking 'Go >>' will bring up the desired number of fields to fill in. You should type the full path and filename for each of the files you wish to fingerprint and then click 'Add'. Any file that does not exist will be silently discarded. You will be brought back to the 'Fingerprint View' screen and you should see your new files listed.

You can add any of the files located on your system. When you are viewing the fingerprinted files, you will see a status of each of these files. If a file changes (even by one character) you should see a status that says 'File Changed'.

You can try this out on a text file by clicking 'Add files' and add 1 file. After submitting, make an edit and click refresh. If a file has been changed by a known source, such as you or an upgrade, you can click the 'Update' button to update the fingerprint for that file.

Reporting

The Reporting tool in fBuilder can email your firewall log to you or send you alerts if the firewall is receiving a certain number of log entries per hour. The 'Report Setup' screen will configure your fb-report.conf file for use with fb-report, the utility that actually does the work. To start using this functionality, you can configure the following items on the Report Setup screen:

fBuilder Location -- This tells fb-report where fBuilder is located. fb-report does not assume that fBuilder is located in the same directory, so this must be set. If you decided to move fb-report out of the usr/local/fbuilder directory, you will need to move fb-report.conf as well.
Sendmail Location -- This is the location where sendmail is located. fb-report uses sendmail to send email alerts
Firewall Log Location -- This is the location of the log that will be monitored by fb-report. This should be the log that is actively being populated by LOG rules and NOT one of the old log files.
Recipients -- This is the email addresses of the people that should be receiving alerts. You can put in multiple addresses by separating them by commas (,). For example, you can put two recipients like this: me@me.com,you@you.com
Email From -- This is the address that the email that is created by fBuilder will come from. This allows you to customize the 'from' address if you have multiple firewalls sending you alerts.
Logs Per Hour -- This allows you to set the number of log messages per hour before the reporting system sends you an email to alert you of a possible condition. Most people will have to work with this a bit to find a number that is not too low, so you don't get a message every hour, but not too high so you can get alerted if an abnormal situation was occurring. 0 shuts this feature off.
Email Log File -- This check box tells fb-report to send a copy of the log file via email to the recipients listed above.
Log Range -- The number of hours you want included from the log file. For instance, you can have the last 24 hours worth of firewall logs sent to you every day.
Email Time -- When the email containing the log should be sent to the recipients listed above.
How often will this cron job run? -- Listed in minutes. This tells fb-report how often you are running it from cron. fb-report uses this information for some calculations.
Submit Changes -- Writes your changes to the fb-report.conf file.

Once you have set up your configuration, you can create a cron job that will run fb-report.