DNS reply syslog with resolved IP - any updates?

keyser

Hi all.

Is there any work being done on getting pfSense to natively - or via pfBlockerNG - support remote syslog of DNS replies that includes:

IP of Client asking
Record type asked
FQDN asked for
IP(s) or CNAMEs returned as result of query to client.

It would especially be nice to have the syslog only option, so it is never logged to local disk (thus killing eMMC/SSD write endurance).

PfSense has not been able to this for years. Various HORRIBLE hacks can produce some of the above, but at the cost of local logging first, various workaround to get it off as syslog, and most methods does not support logging the resolved IPs/CNAMEs which is the whole point/essential for this.

keyser

I know about:

1: The unbound log-reply advanced option. That does not log the resolved IPs. It also does local logging

2: There is no DNSTAP support compiled into the Unbound build in pfSense (why not??)

3: pfBlockerNG can reply log to a local log file with the needed info. But to syslog that off pfSense, you both have a horrible log format you need to convert, and you need to install syslog-ng to monitor the logfile, and you get all loglines replayed (doubled) when pfBlockerNG rolls the log file over. Horrible solution.

I simply don’t understand how pfSense can choose NOT to support proper DNS logging - which is probably the one MOST needed forensics security monitoring feature.

keyser

@netgate You really need to compile in DNSTAP features in Unbound for the next pfSense+ release.

https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html

Its a simple build option to enable, and we already have the advanced section in DNS Resolver UI where we could configure the options needed. So No UI rework is needed if I understand how things are currently working.

Gertjan

@keyser

You mean https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#dnstap-options ?

You mean :

DNSTAP is a flexible, structured binary log format for DNS software. When compiled in by using --enable-dnstap,

you want the "--enable-dnstap" being used during compile/build ?

keyser

@Gertjan yes, that way we can export Required DNS activity in a effective binary format to a SEIM/Collector of choice