From owner-freebsd-security@FreeBSD.ORG Sun Apr 18 19:15:45 2004 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D6F5D16A4CF; Sun, 18 Apr 2004 19:15:45 -0700 (PDT) Received: from bimmer.dtmpower.net (bimmer.dtmpower.net [66.250.68.101]) by mx1.FreeBSD.org (Postfix) with ESMTP id 91DED43D55; Sun, 18 Apr 2004 19:15:45 -0700 (PDT) (envelope-from jd@ods.org) Received: from localhost (localhost [127.0.0.1]) by bimmer.dtmpower.net (Postfix) with ESMTP id 5CFC66E85A; Sun, 18 Apr 2004 22:09:26 -0400 (EDT) Received: from bimmer.dtmpower.net ([127.0.0.1]) by localhost (bimmer.dtmpower.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 77289-02; Sun, 18 Apr 2004 22:09:26 -0400 (EDT) Received: from pcp08928390pcs.anapol01.md.comcast.net (pcp08928390pcs.anapol01.md.comcast.net [68.50.232.202]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by bimmer.dtmpower.net (Postfix) with ESMTP id 016D9536F5; Sun, 18 Apr 2004 22:09:26 -0400 (EDT) Date: Sun, 18 Apr 2004 22:15:43 -0400 From: Jason DiCioccio To: "Crist J. Clark" Message-ID: <2147483647.1082326543@pcp08928390pcs.anapol01.md.comcast.net> In-Reply-To: <20040419021239.GA67288@blossom.cjclark.org> References: <1998.213.112.193.35.1082212115.squirrel@mail.hackunite.net> <20040419021239.GA67288@blossom.cjclark.org> X-Mailer: Mulberry/3.1.2 (Mac OS X) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline X-Virus-Scanned: by amavisd-new at dtmpower.net X-Mailman-Approved-At: Mon, 19 Apr 2004 02:31:39 -0700 cc: freebsd-security@freebsd.org Subject: Re: Is log_in_vain really good or really bad? X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Apr 2004 02:15:46 -0000 I've actually seen something similar happen. What happens, is when syslog gets backed up with lots and lots and lots of messages, it leaks a couple via wall. I'm not sure why, but I've seen it happen. Usually you only receive a fragment of a log entry. Perhaps it's a bug in syslogd, but it's only occurred maybe 2-3 times with me, so I just wrote it off. Regards, -JD- --On Sunday, April 18, 2004 7:12 PM -0700 "Crist J. Clark" wrote: > On Sat, Apr 17, 2004 at 04:28:35PM +0200, z3l3zt@hackunite.net wrote: > [snip] > >> My server box is a Intel Celeron 733Mhz, 384Mb of RAM.. yet it's slow >> from time to time since I only run ATA66 due to the old motherboard. >> When this "attack" occurred yesterday, the box almost died and the box >> were working 100%.. all users who were logged in got "spammed" since the >> default *.emerg in /etc/syslog.conf is set to "*" .. > > Not sure what that has to do with anything. The log_in_vain messages get > logged at "info" level. What messages were your users seeing? > -- > Crist J. Clark | cjclark@alum.mit.edu > | cjclark@jhu.edu > http://people.freebsd.org/~cjc/ | cjc@freebsd.org > _______________________________________________ > freebsd-security@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to > "freebsd-security-unsubscribe@freebsd.org"