Tutorial: Membangun Centralized Logging Server dengan Syslog-ng di Debian Linux

 

Topologi: Centralized Logging System

+----------------+   +----------------+   +----------------+
|   VPN Server   |   | Payload Server |   | Phishing Server|
+--------+-------+   +--------+-------+   +--------+--------+
         |                    |                    |
         |                    |                    |
         |                    |                    |
         |      +-------------+--------------------+--------+
         |      |                                      |     |
+--------v------+   +----------------+   +-------------v--+  |
|  Mail Server  |   | HTTP Redirector|   | Short Term C2  |  |
+--------+------+   +--------+-------+   +--------+--------+  |
         |                  |                    |           |
         |                  |                    |           |
         +------------------+--------------------+-----------+
                                      |
                                      v
                         +------------+-------------+
                         |       Logging Server     |
                         |  (Syslog-ng Listener)    |
                         +------------+-------------+
                                      |
                                      v
                             +--------+--------+
                             |     Dashboard     |
                             |   (OSSEC/Graylog) |
                             +--------+--------+
                                      |
                                      v
                                  +---+---+
                                  |Operator|
                                  +-------+

Topologi:

• Semua server (VPN, Payload, Phishing, Mail, dll) mengirim log ke satu Logging Server.

• Logging Server menampilkan log dalam dashboard via OSSEC atau tool lain.

---

1. Persiapan

a. Update Sistem

sudo apt update && sudo apt upgrade -y

b. Install Syslog-ng

sudo apt install syslog-ng -y

---

2. Konfigurasi Logging Server (Syslog-ng sebagai Penerima Log)

a. Buka konfigurasi utama

sudo nano /etc/syslog-ng/syslog-ng.conf

b. Tambahkan sumber log dari jaringan:

source s_network {
    tcp(ip(0.0.0.0) port(514));
    udp(ip(0.0.0.0) port(514));
};

c. Tambahkan tujuan penyimpanan log berdasarkan host:

destination d_remote_logs {
    file("/var/log/remote/$HOST/$YEAR$MONTH$DAY.log"
        create-dirs(yes)
        owner(root) group(root) perm(0644));
};

d. Tambahkan rule log:

log {
    source(s_network);
    destination(d_remote_logs);
};

e. Restart syslog-ng

sudo systemctl restart syslog-ng

---

3. Konfigurasi Server Klien (Pengirim Log)

a. Install syslog-ng

sudo apt install syslog-ng -y

b. Tambahkan tujuan log ke logging server:

# Edit /etc/syslog-ng/syslog-ng.conf

destination d_loghost {
    udp("IP_LOGGING_SERVER" port(514));
};

log {
    source(s_src);
    destination(d_loghost);
};

c. Restart syslog-ng

sudo systemctl restart syslog-ng

---

4. Monitoring dengan OSSEC (opsional)

a. Install OSSEC server

wget -q -O - https://updates.atomicorp.com/installers/atomic | sudo bash
sudo apt install ossec-hids-server -y

b. Konfigurasikan agent di masing-masing server dan tambahkan ke OSSEC Manager.

c. Akses dashboard melalui web browser jika menggunakan Web UI (Kibana, Graylog, atau OSSEC Web UI).

---

5. Troubleshooting

• Periksa log: /var/log/syslog, /var/log/remote/

• Tes konektivitas port 514 dari klien ke server:

nc -vzu IP_LOGGING_SERVER 514

---

Penutup

Dengan setup ini, kamu bisa memusatkan semua log ke satu server untuk dianalisis dan dipantau secara real-time melalui dashboard OSSEC atau tool lainnya.