Date: Fri, 28 Jan 2000 17:34:33 -0600 (CST) From: Gene Harris <zeus@tetronsoftware.com> To: Cy Schubert - ITSD Open Systems Group <Cy.Schubert@uumail.gov.bc.ca> Cc: Brett Glass <brett@lariat.org>, The Mad Scientist <madscientist@thegrid.net>, freebsd-security@FreeBSD.ORG Subject: Re: Riddle me this Message-ID: <Pine.BSF.4.10.10001281732300.2050-100000@tetron02.tetronsoftware.com> In-Reply-To: <200001282100.NAA38136@cwsys.cwsent.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Ahh, I like what you've done. However, the purpose of placing stuff into a separate ipfw file is so I can move it around without dragging all the kernel messages around as well. However, I will check out swatch, and where is the PR you haven't submitted for swatch(3)? Surely, you need an inexperienced newbie like me to test it? *grin* *==============================================* *Gene Harris http://www.tetronsoftware.com* *FreeBSD Novice * *All ORBS.org SMTP connections are denied! * *==============================================* On Fri, 28 Jan 2000, Cy Schubert - ITSD Open Systems Group wrote: > In message <Pine.BSF.4.10.10001271010530.3225-100000@tetron02.tetronsoft > ware.co > m>, Gene Harris writes: > > I prefer a slightly different approach. My syslog.conf file > > contains the two lines: > > > > !ipfw > > *.* /var/log/ipfw > > I use swatch3 (swatch3 and 2 Perl module ports are ready but I haven't > submitted the PR's yet to have them included in ports). > > I use the following .swatchrc to display some messages in red, others > in blue, and the rest black (or white). > > ignore = /ipfw:.* Deny .* blahblah.*/ > ignore = /ipfw:.* Deny .* 10\.blahblah.*/ > watchfor = /refused connect from/ > echo=red,inverse > bell > watchfor = /ALERT:/ > echo=red,inverse > bell > watchfor = /Deny TCP blahblah blah blah in via xl0/ > echo=blue > watchfor = /Deny TCP blahblah blahblah:113 in via xl0/ > echo=blue > watchfor = /Deny TCP blahblah blahblah:80 in via xl0/ > echo=blue > watchfor = /ipfw:.* Deny .* in via / > echo=red > bell > watchfor = /ipfw:.* Deny .* out via / > echo > ignore = /.*/ > > > > Regards, Phone: (250)387-8437 > Cy Schubert Fax: (250)387-5766 > Sun/DEC Team, UNIX Group Internet: Cy.Schubert@uumail.gov.bc.ca > ITSD > Province of BC > "COBOL IS A WASTE OF CARDS." > > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.10.10001281732300.2050-100000>