Date: Fri, 9 Jul 1999 04:20:13 -0400 (EDT) From: Robert Watson <robert@cyrus.watson.org> To: Darren Reed <avalon@coombs.anu.edu.au> Cc: Alla Bezroutchko <alla@sovlink.ru>, security@FreeBSD.ORG Subject: Re: Syslog alternatives? Message-ID: <Pine.BSF.3.96.990709041344.24202C-100000@fledge.watson.org> In-Reply-To: <199907090707.RAA16350@cheops.anu.edu.au>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, 9 Jul 1999, Darren Reed wrote: > In some mail from Alla Bezroutchko, sie said: > > > > This is not exactly FreeBSD security question. More like general > > Unix security. Hope it is not completely off topic. > > > > I was looking at several syslogd alternatives (BTW, I don't think > > I have a complete list, can you suggest something?) and found out > > that I don't understand what is wrong with traditional syslogd from > > security standpoint. > > > > Could someone explain me or point me to some resources that explain > > why syslogd is bad? > > Prove to me that your log files have any integrity, in such a way that > I cannot dispute it. Or even less interesting: What happens to log records being sent over the network to a host that is in the process of rebooting? Or: What happens to network logging if you send an ICMP connection refused to the client syslog host? I noticed the other day that unlike our newsyslog, BSD/OS 3.0 actually loses lots of records when they perform log rotation, as they gzip the rotated file before sending the HUP to syslogd! I don't know if BSD/OS 4.0 does this also. We were upset to find that 3 hours of log records were missing from our maillog following the rotation. Clearly syslogd leaves much to be desired. However, it works fairly well if configured carefully. There have been discussions of alternatives, and I think someone claimed to have written a secure syslog at one point; I don't have a reference for it. I believe Schneier coauthored a paper on some of the cryptographic issues, also. Again, no references here as I'm out of town. If you can rely on kernel integrity due to securelevels, then presumably you can have it hold onto secrets and provide certain cryptographic integrity services. Robert N M Watson robert@fledge.watson.org http://www.watson.org/~robert/ PGP key fingerprint: AF B5 5F FF A6 4A 79 37 ED 5F 55 E9 58 04 6A B1 TIS Labs at Network Associates, Computing Laboratory at Cambridge University Safeport Network Services To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.3.96.990709041344.24202C-100000>