5. Configuring Mason

Most of the configuration is set via environment variables. For permanent changes, try

export VARIABLE=value

For one time settings, just put the variables on the command line just before calling the program. For example:

tail -f --lines=0 /var/log/messages | ECHOCOMMAND=ipchains mason

If you set a variable both on the command line and in /etc/masonrc, be warned that /etc/masonrc wins.

• ECHOCOMMAND=ipchains|ipfwadm|none #Autodetected if unset or invalid

  Which kind of command should Mason display? This does _not_ have to match the firewalling in the current kernel; this lets you create an ipfwadm firewall ruleset on an ipchains kernel and vice-versa.

  The following two commands will spit out an ipfwadm firewall and an ipchains firewall, respectively, from the same input: cat /var/log/messages | grep ' L=' | ECHOCOMMAND=ipfwadm mason >ipfwadm-wall cat /var/log/messages | grep ' L=' | ECHOCOMMAND=ipchains mason >ipchains-wall

  Both kinds of firewall log entries have L= in them; this is a reasonably good filter to keep Mason from having to process _all_ the junk entries.

• DOCOMMAND=ipchains|ipfwadm|none #Autodetected if unset or invalid

  Which kind of command should Mason run to prevent that type of traffic from being logged in the future? Set to none if you're processing the log entries later, or on another machine.

  Unless you're forcing it to "none", probably best to let Mason autodetect.

• HEARTBEAT=yes|no If yes, mason displays a "." or "-" when it processes an input line that has been handled by one of the recently implemented rules. The heartbeat character is sent to stderr so it doesn't screw up logging to a file or piping to some other program.
• DYNIF="ppp0 sl0" If your machine has interfaces whose entries change IP address, put the interface name(s) in quotes, separated by spaces. Mason will handle these interfaces specially by handing you a line that will assign that interfaces IP address to an environment variable when executed, and uses that variable throughout the ruleset. If your Ethernet IP address is assigned via DHCP, BOOTP, or RARP, _and_ _changes_ from time to time, you might even want to put your Ethernet interface name(s) in the list. If the addresses are assigned via one of those tools, but _never_ _change_ (those protocols are supposed to try to give you the same address you had last time if at all possible), don't put the Ethernet interface(s) in there. Make sure you re-run your firewall ruleset (or at least the rules with dynamic IP entries) when the address changes. For ppp interfaces, restart your firewall inside /etc/ppp/ip-up. I think DHCP has a similar ability to run commands when the address changes; consult the DHCP documentation.

The main documentation for all the configurable fields is conveniently in /etc/masonrc .