How to log Web and FTP files downloaded

[BarryStiefel]

How to log Web and FTP files downloaded



The security servers were designed to do this sort of thing. In order to use them, you will need to make sure they are on. Look in $FWDIR/conf/fwauthd.conf. You should see lines like the following: 80 in.ahttpd wait 0 21 in.aftpd wait 0These are the two lines for HTTP and FTP respectively. If they are missing or commented out, you can either add/uncomment them manually or run fwconfig. In either case, you should restart the firewall (fwstop; fwstart) after doing so.



The idea here is to create a resource that matches "everything" and then funnel all web and ftp traffic through those resources. To create a resource that matches all FTP downloads, create a new FTP resource called "ftpmatchall". Set the exception track to Log, set the path to "*" and check GET (to track uploads too, also check PUT).

To create a resource that matches all HTTP URLs, create a new URI resource called "httpmatchall". Set the exception track to Log, set the URI Match Spec to Wildcard, if NG, also specify "Optimize URL Logging," match all schemes, all methods, and put "*" in the host, path, and query fields.

Now that you've created both the resources, add this rule to your rulebase:

Source Destination Service Action Track Internal-hosts Any ftp->ftpmatchall
http->httpmatchall Accept Long

When you add the services "HTTP" and "FTP", you will need to add them with resource to add in the httpmatchall and ftpmatchall resources that were created.

Install your security policy and install the user database. In some cases, it may be necessary to bounce the firewall (fwstop; fwstart). The URLs will appear in the info field of the log viewer.

Note that in FireWall-1 4.1 SP2 and above, you can do URL logging without using the HTTP Security Server. See the release notes for details. In NG, this can be done more efficiently by checking the "Optimize URL Logging" box in the resource.

-- PhoneBoy - 30 Dec 2003

FAQForm FAQs.Class: ContentSecurityFAQs OperatingSystem?: FAQs.Version: