fw1_lea2dlf

Langue: en

Autres versions - même langue

Version: 2006-07-23 (debian - 07/07/09)

Section: 1 (Commandes utilisateur)

Sommaire

NAME

fw1_lea2dlf - convert Check Point FireWall-1 NG logs to firewall DLF

SYNOPSIS

fw1_lea2dlf file

DESCRIPTION

fw1_lea2dlf converts Check Point FireWall-1 NG logs into firewall DLF format. Input for this converter is the output of fw1-loggrabber, a simple LEA (Log Export Api) client.

ACTIVATION INSTRUCTIONS

This DLF converter isn't activated by default in Lire. It requires the Date::Manip perl module and the fw1-loggrabber tool. Date::Manip can be installed from CPAN. fw1-loggrabber is available from http://sourceforge.net/projects/fw1-loggrabber .

If both of these components are installed, you can activate the fw1_lea DLF conveter by uncommenting its line in the file @sysconfdir@/@PACKAGE@/address.cf

OTHER NOTES

Beware! In case you're getting a lot of warnings complaining about UTF-8 characters, looking like: 
  all all UNSET fw1_lea2dlf warning Malformed UTF-8 character
   (unexpected non-continuation byte 0x7a, immediately after
   start byte 0xe3) at /usr/lib/perl5/vendor_perl/5.8.0/Date/Manip.pm
   line 5931.

, and your locale is UTF-8 enabled, there is a workaround: Set the LANG and LC_CTYPE environment variables to en_US instead of e.g. en_US.UTF-8. You can do this temporarily within the call of the converter:

  LANG=en_US LC_CTYPE=en_US ./fw12dlf < /your/log/file

fw1-loggrabber

fw1-loggrabber is build using OPSEC's Software Development Kit. OPSEC (Open Platform for Security, http://www.opsec.com/) is an open, multi-vendor security framework.

Some notes about fw1-loggrabber quoted here.

  ********************************************************
  FW1-LOGGRABBER
 
  Author:           Torsten Fellhauer
  current Version:  1.0
  ********************************************************
 
  1) Prerequisites
  2) How to Build
  3) How to Use
  4) Change History
 
  ********************************************************
 
  1) Prerequisites
 
  a) for running FW1-LOGGRABBER
 
  FW1-LOGGRABBER is statically linked and can therefore be
  run on the following systems:
  * Linux (Tested distributions are Red Hat, SuSE and De-
    bian with Kernel Versions 2.2.x and 2.4.x)
  * Solaris SPARC (Tested versions are Solaris 8 and 9)
   * Windows NT/2000/XP (currently no W32 of FW1-LOGGRABBER
    is available yet and therefore not yet tested)
 
  b) for building FW1-LOGGRABBER
 
  FW1-LOGGRABBER uses API-functions from Checkpoints'
  OPSEC SDK. In order to be able to build applications 
  which are using this SDK, a very special build environ-
  ment has to be used. Currently building FW1-LOGGRABBER is
  supported only for Solaris SPARC platform and the Linux
  platform.
  * Linux
   - Red Hat 6.2
   - gcc 2.95.1
   - Checkpoint OPSEC SDK NG-FP3 for Linux 2.2
  * Solaris SPARC
   - Solaris 8
   - gcc 2.95.2
   - Checkpoint OPSEC SDK NG-FP3 for Solaris SPARC
  * Windows
   - EDITME
 
  3) How to Use
 
  a) Configure FW1 to enable LEA-Protocol
 
  In order to be able to use this tool with a Checkpoint
  FW-1 installation, the following tasks have to be done:
 
  * modify $FWDIR/conf/fwopsec.conf and define the port 
    for unauthenticated lea connections.
      #  lea_server  auth_port   18184
      lea_server       port       50001
  * bounce FW1 (cpstop / cpstart) to activate changes
  * add rule to policy to enable connections on port 
    50001 to the FW-1 Management-Server
 
 
  b) Usage of FW1-LOGGRABBER
 
  FW1-LOGGRABBER is statically linked and therefore not
  dependent of OPSEC libraries. The binary can be run on
  any Linux or Solaris SPARC system.
 
  Command-Line Options:
   -s             IP-Address of FW1-Management-Server
   -p             unauthenticated LEA-Port of FW1-Server
   -f             exact name of FW1-Logfile or pattern to
                  be matched on FW1-Logfiles.
   --resolve      Resolve IP-Addresses to Names
   --noresolve    Do not resolve IP-Addresses to Names
   --showfiles    Only show available FW1-Logfiles and exit.
   --debug        Enable debug-mode of FW1-LOGGRABBER
 
  Examples:
  o fw1-loggrabber -s 192.168.2.254 -p 50001 --showfiles
   
   Show all logfiles that are available on the FW1-Manage-
   ment-Server with the IP-Address 192.168.2.254. The LEA-
   Port the Management-Server is listening for unauthenti-
   cated connections is 50001.
 
  o fw1-loggrabber -s 192.168.2.254 -p 50001
 
   Show all logentries of the default FW1-Logfile (fw.log)
   on the FW1-Management-Server with the IP-Address
   192.168.2.254 and the LEA-Port 50001.
 
  o fw1-loggrabber -s 192.168.2.254 -p 50001 -f 2003-03-27_213652.log
 
   Show all logentries of the specified logfile. If the Log-
   file doesn't exist on the specified FW1-Management-Server,
   no entries are returned.
 
  o fw1-loggrabber -s 192.168.2.254 -p 50001 -f 2003-03
 
   Show all logentries of all logfiles on the FW1-Management-
   Server, that contain the pattern "2003-03", i.e. all Log-
   Files from March 2003
 
  o fw1-loggrabber -s 192.168.2.254 -p 50001 -f fw.adtlog
 
   Show all logentries of audit logfile on FW1-Management-Server
 
  4) Change History
 
  * 1.0 - Initial Version (2003/03/30)
   o get all available FW1-Logfiles
   o get data of one or more FW1-Logfiles
 
  5) Features to be implemented
 
  * Implementation of authenticated connections
  * Win32 build

EXAMPLES

To process a log as produced by FW-1: 
  $ fw1-loggrabber -s 192.168.2.254 -p 50001 -f fw.log | fw12dlf

fw1_lea2dlf will be rarely used on its own, but is more likely called by lr_log2report:

  $ fw1-loggrabber -s 192.168.2.254 -p 50001 -f fw.log | \
     lr_log2report fw1_lea

BUGS / TO DO

This convertor needs perl's Date::Manip library. It'd better use another module for this, used by more Lire code.

The status and licensing of fw1-loggrabber is unknown.

SEE ALSO

Unfortunately, Check Point supplies no easily available documentation: http://www.checkpoint.com/support/technical/documents/index.html is password protected. Some notes about the FireWall-1 product are on http://www.checkpoint.com/products/protect/firewall-1.html .

AUTHORS

Torsten Fellhauer <torsten@fellhauer-web.de>

VERSION

$Id: fw1_lea2dlf.in,v 1.9 2006/07/23 13:16:35 vanbaal Exp $ Copyright (C) 2003 Torsten Fellhauer

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program (see COPYING); if not, check with http://www.gnu.org/copyleft/gpl.html.