From owner-freebsd-security@FreeBSD.ORG Sun Jan 6 22:12:02 2013 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.FreeBSD.org [8.8.178.115]) by hub.freebsd.org (Postfix) with ESMTP id 98CE7D39 for ; Sun, 6 Jan 2013 22:12:02 +0000 (UTC) (envelope-from mike@sentex.net) Received: from smarthost1.sentex.ca (smarthost1-6.sentex.ca [IPv6:2607:f3e0:0:1::12]) by mx1.freebsd.org (Postfix) with ESMTP id 69A221A48 for ; Sun, 6 Jan 2013 22:12:02 +0000 (UTC) Received: from [192.168.43.26] (pyroxene.sentex.ca [199.212.134.18]) by smarthost1.sentex.ca (8.14.5/8.14.5) with ESMTP id r06MC0qj089810 for ; Sun, 6 Jan 2013 17:12:00 -0500 (EST) (envelope-from mike@sentex.net) Message-ID: <50E9F6A8.5050502@sentex.net> Date: Sun, 06 Jan 2013 17:11:52 -0500 From: Mike Tancsa Organization: Sentex Communications User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 MIME-Version: 1.0 To: "freebsd-security@freebsd.org" Subject: audit events confusion X-Enigmail-Version: 1.4.2 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Scanned-By: MIMEDefang 2.72 on 64.7.153.18 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 06 Jan 2013 22:12:02 -0000 On a rather full customer web server, I am trying to track down whose web site script is trying to make outbound network connections when they should not be. In /etc/security/audit_control, I added to the flags line dir:/var/audit flags:lo,aa,-nt minfree:5 to log failed network connection. When I try an make an outbound connection to something that is blocked in pf, it seems to sometimes work. eg. from the command line, if I manually try via telnet 8.8.8.8 25 pf shows 17:03:23.572682 rule 433/0(match): block out on em0: 64.7.x.x.17017 > 8.8.8.8.25: Flags [S], seq 1420411574, win 65535, options [mss 1460,nop,wscale 3,sackOK,TS val 177061484 ecr 0], length 0 and praudit records it as expected including the userid who tried to do it. header,79,11,connect(2),0,Sun Jan 6 17:06:04 2013, + 439 msec,argument,1,0x3,fd,subject,tw,tw,tw,tw,tw,54100,54064,13556,64.7.yy.yy,return,failure : Operation not permitted,4294967295,trailer,79, But if I make a simple php script to try and connect out, again, pflog0 blocks it and logs it, but it does not show up in the audit logs 17:07:46.518501 rule 433/0(match): block out on em0: 64.7.xx.xx.36528 > 8.8.8.8.25: Flags [S], seq 1724105073, win 65535, options [mss 1460,nop,wscale 3,sackOK,TS val 177324430 ecr 0], length 0 Any idea what I am missing ? This is a RELENG_8 box from this week. ---Mike -- ------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike@sentex.net Providing Internet services since 1994 www.sentex.net Cambridge, Ontario Canada http://www.tancsa.com/ From owner-freebsd-security@FreeBSD.ORG Sun Jan 6 22:30:45 2013 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id 2DC631F2 for ; Sun, 6 Jan 2013 22:30:45 +0000 (UTC) (envelope-from patpro@patpro.net) Received: from rack.patpro.net (rack.patpro.net [193.30.227.216]) by mx1.freebsd.org (Postfix) with ESMTP id B13361B12 for ; Sun, 6 Jan 2013 22:30:44 +0000 (UTC) Received: from rack.patpro.net (localhost [127.0.0.1]) by rack.patpro.net (Postfix) with ESMTP id 812431CC020; Sun, 6 Jan 2013 23:25:19 +0100 (CET) X-Virus-Scanned: amavisd-new at patpro.net Received: from amavis-at-patpro.net ([127.0.0.1]) by rack.patpro.net (rack.patpro.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VKZi2o1E7z00; Sun, 6 Jan 2013 23:25:17 +0100 (CET) Received: from [127.0.0.1] (localhost [127.0.0.1]) by rack.patpro.net (Postfix) with ESMTP; Sun, 6 Jan 2013 23:25:17 +0100 (CET) Subject: Re: audit events confusion Mime-Version: 1.0 (Apple Message framework v1085) Content-Type: multipart/signed; boundary=Apple-Mail-56--900688607; protocol="application/pkcs7-signature"; micalg=sha1 From: Patrick Proniewski In-Reply-To: <50E9F6A8.5050502@sentex.net> Date: Sun, 6 Jan 2013 23:25:16 +0100 Message-Id: <27758D4F-14E0-4BEB-AF89-E78D75FD89D7@patpro.net> References: <50E9F6A8.5050502@sentex.net> To: Mike Tancsa X-Mailer: Apple Mail (2.1085) Cc: "freebsd-security@freebsd.org" X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 06 Jan 2013 22:30:45 -0000 --Apple-Mail-56--900688607 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On 06 janv. 2013, at 23:11, Mike Tancsa wrote: > But if I make a simple php script to try and connect out, again, = pflog0 > blocks it and logs it, but it does not show up in the audit logs >=20 > 17:07:46.518501 rule 433/0(match): block out on em0: 64.7.xx.xx.36528 = > > 8.8.8.8.25: Flags [S], seq 1724105073, win 65535, options [mss > 1460,nop,wscale 3,sackOK,TS val 177324430 ecr 0], length 0 >=20 > Any idea what I am missing ? I think auditd can catch events only for users that have logged in at = least once. To audit Apache, I've had to install setaudit and launch = httpd process by using setaudit with proper flags. I've modified my /usr/local/etc/rc.d/apache22 file, mainly changing the = start command to start_cmd=3D"apache22_auditstart" and adding the proper = command definition: apache22_auditstart() { echo "Starting apache22 with audit" eval /usr/local/sbin/setaudit ${apache22_auditflags} ${command} = ${apache22_flags} -k start=20 } In /etc/rc.conf, I've added: apache22_auditflags=3D"-a www -m ex,lo,ad,-pc,fd,-fc,-fm,-fw" I'm then able to log audit events for Apache, according to flags I've = set in apache22_auditflags. hope this helps, patpro= --Apple-Mail-56--900688607 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIINTTCCBjQw ggQcoAMCAQICAR4wDQYJKoZIhvcNAQEFBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxKTAn BgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA3MTAyNDIxMDE1NVoX DTE3MTAyNDIxMDE1NVowgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSsw KQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFy dENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQTCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAMcJg8zOLdgasSmkLhOrlr6KMoOMpohBllVHrdRvEg/q6r8jR+EK 75xCGhR8ToREoqe7zM9/UnC6TS2y9UKTpT1v7RSMzR0t6ndl0TWBuUr/UXBhPk+Kmy7bI4yW4urC +y7P3/1/X7U8ocb8VpH/Clt+4iq7nirMcNh6qJR+xjOhV+VHzQMALuGYn5KZmc1NbJQYclsGkDxD z2UbFqE2+6vIZoL+jb9x4Pa5gNf1TwSDkOkikZB1xtB4ZqtXThaABSONdfmv/Z1pua3FYxnCFmdr /+N2JLKutIxMYqQOJebr/f/h5t95m4JgrM3Y/w7YX9d7YAL9jvN4SydHsU6n65cCAwEAAaOCAa0w ggGpMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRTcu2SnODaywFc fH6WNU7y1LhRgjAfBgNVHSMEGDAWgBROC+8apEBbpRdphzDKNGhD0EGu8jBmBggrBgEFBQcBAQRa MFgwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9jYTAtBggrBgEFBQcwAoYh aHR0cDovL3d3dy5zdGFydHNzbC5jb20vc2ZzY2EuY3J0MFsGA1UdHwRUMFIwJ6AloCOGIWh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2NhLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5j b20vc2ZzY2EuY3JsMIGABgNVHSAEeTB3MHUGCysGAQQBgbU3AQIBMGYwLgYIKwYBBQUHAgEWImh0 dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUHAgEWKGh0dHA6Ly93d3cu c3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwDQYJKoZIhvcNAQEFBQADggIBAAqDCH14qywG XLhjjF6uHLkjd02hcdh9hrw+VUsv+q1eeQWB21jWj3kJ96AUlPCoEGZ/ynJNScWy6QMVQjbbMXlt UfO4n4bGGdKo3awPWp61tjAFgraLJgDk+DsSvUD6EowjMTNx25GQgyYJ5RPIzKKR9tQW8gGK+2+R HxkUCTbYFnL6kl8Ch507rUdPPipJ9CgJFws3kDS3gOS5WFMxcjO5DwKfKSETEPrHh7p5shuuNktv sv6hxHTLhiMKX893gxdT3XLS9OKmCv87vkINQcNEcIIoFWbP9HORz9v3vQwR4e3ksLc2JZOAFK+s sS5XMEoznzpihEP0PLc4dCBYjbvSD7kxgDwZ+Aj8Q9PkbvE9sIPP7ON0fz095HdThKjiVJe6vofq +n6b1NBc8XdrQvBmunwxD5nvtTW4vtN6VY7mUCmxsCieuoBJ9OlqmsVWQvifIYf40dJPZkk9YgGT zWLpXDSfLSplbY2LL9C9U0ptvjcDjefLTvqSFc7tw1sEhF0n/qpA2r0GpvkLRDmcSwVyPvmjFBGq Up/pNy8ZuPGQmHwFi2/14+xeSUDG2bwnsYJQG2EdJCB6luQ57GEnTA/yKZSTKI8dDQa8Sd3zfXb1 9mOgSF0bBdXbuKhEpuP9wirslFe6fQ1t5j5R0xi72MZ8ikMu1RQZKCyDbMwazlHiMIIHETCCBfmg AwIBAgIDBQpEMA0GCSqGSIb3DQEBBQUAMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYG A1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwHhcN MTIxMDA0MDQzOTI4WhcNMTMxMDA0MTg0MzA2WjBZMRkwFwYDVQQNExB6bTg4dll2aWZKejR0SWo5 MRowGAYDVQQDDBFwYXRwcm9AcGF0cHJvLm5ldDEgMB4GCSqGSIb3DQEJARYRcGF0cHJvQHBhdHBy by5uZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDPnjSHKomiN/ouGyfzNJwkkB3K aZGRWv+DkP+X29YKei9/uIoMJ5dPqebvpQe3Xjt45a/QC30xFmF/WLhIkconC4+1xjFEMkP5VKuU 1SkrFmQW9ZEF9wYGBBtJG7q9jKBqSJdz3DJyd3gIfHwbuTa7eK0G5GztU9jkEac/JJ0DqakQ0nZ1 IdwrULAN5RQQHPD5+6uzNOI8xJk2QIJG+6hBoR1hl0Y6v8tYrTqo2sRGMFjBZoORFc58gIR9DeP1 VT/7Nu5OLAGYqZkprAU3+ZGP1PZO4c6XlDyUAAhLos7tuHD79owAM33uYJxqrWuB6Oq/KC0MN3Bn NrWL3DLepPeVAgMBAAGjggOsMIIDqDAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAU BggrBgEFBQcDAgYIKwYBBQUHAwQwHQYDVR0OBBYEFLXTKAc1MLwuaL4NGpy86bc7H0qbMB8GA1Ud IwQYMBaAFFNy7ZKc4NrLAVx8fpY1TvLUuFGCMBwGA1UdEQQVMBOBEXBhdHByb0BwYXRwcm8ubmV0 MIICIQYDVR0gBIICGDCCAhQwggIQBgsrBgEEAYG1NwECAjCCAf8wLgYIKwYBBQUHAgEWImh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUHAgEWKGh0dHA6Ly93d3cuc3Rh cnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgfcGCCsGAQUFBwICMIHqMCcWIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5MAMCAQEagb5UaGlzIGNlcnRpZmljYXRlIHdhcyBpc3N1ZWQg YWNjb3JkaW5nIHRvIHRoZSBDbGFzcyAxIFZhbGlkYXRpb24gcmVxdWlyZW1lbnRzIG9mIHRoZSBT dGFydENvbSBDQSBwb2xpY3ksIHJlbGlhbmNlIG9ubHkgZm9yIHRoZSBpbnRlbmRlZCBwdXJwb3Nl IGluIGNvbXBsaWFuY2Ugb2YgdGhlIHJlbHlpbmcgcGFydHkgb2JsaWdhdGlvbnMuMIGcBggrBgEF BQcCAjCBjzAnFiBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTADAgECGmRMaWFiaWxp dHkgYW5kIHdhcnJhbnRpZXMgYXJlIGxpbWl0ZWQhIFNlZSBzZWN0aW9uICJMZWdhbCBhbmQgTGlt aXRhdGlvbnMiIG9mIHRoZSBTdGFydENvbSBDQSBwb2xpY3kuMDYGA1UdHwQvMC0wK6ApoCeGJWh0 dHA6Ly9jcmwuc3RhcnRzc2wuY29tL2NydHUxLWNybC5jcmwwgY4GCCsGAQUFBwEBBIGBMH8wOQYI KwYBBQUHMAGGLWh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9zdWIvY2xhc3MxL2NsaWVudC9jYTBC BggrBgEFBQcwAoY2aHR0cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvc3ViLmNsYXNzMS5jbGll bnQuY2EuY3J0MCMGA1UdEgQcMBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzANBgkqhkiG9w0B AQUFAAOCAQEAM2FDWTDUfusK/57vjVYFjCRXOqjCvkK+ESP2qYOm/jXYS+Q1jLFhdT0OaUkajM4H 5VHcLmq0S3bvYu/rYHi19dE9+f0uRSVVqHpPL0GpNK7E2MWjwH306me7UMCnK6M+gFuYKZX487AT v8w9rATqr4omdwZAzlVytxJkKdacc4jq36tAlaFlYw2j45sgTSR2qjfufoiUX3+OKo02JfLp3rlt o6g+i8v9VF4/2NVgrfbd2fqAEODCgdjmqe0zjXy52n/ncxpnL6XjcS+LtzQ8KH5eKl/hJ1BmAFIO PQ7e9aT5a/AT1/cCLwRbfyxkuvSavp/la9wrCqEsXXbZHKdtsjGCA28wggNrAgEBMIGUMIGMMQsw CQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0 YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5 IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAwUKRDAJBgUrDgMCGgUAoIIBrzAYBgkqhkiG9w0BCQMx CwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xMzAxMDYyMjI1MTdaMCMGCSqGSIb3DQEJBDEW BBQqBokekRnz10zsfuYkh+dhvGU4mjCBpQYJKwYBBAGCNxAEMYGXMIGUMIGMMQswCQYDVQQGEwJJ TDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlm aWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVk aWF0ZSBDbGllbnQgQ0ECAwUKRDCBpwYLKoZIhvcNAQkQAgsxgZeggZQwgYwxCzAJBgNVBAYTAklM MRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZp Y2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJtZWRp YXRlIENsaWVudCBDQQIDBQpEMA0GCSqGSIb3DQEBAQUABIIBAB53OY+PvXhqaN6SFBs77TP8C4mg C9mj5J8y7sSQzkkJjMcdDicb7E6BiTcX0f2RwNBwikOm21+0UhkIPAYvH71ErkPanLSDVLFxRhwx YIxckWwaLdvTMMo/XefJvxQ2SElVX75dnSKnw+oeAcsseiIClPrUiNhgFLzaA40NeZD2/RmfvdgE H3/s1ePs2CIF86D6TmEE91FWouwaA+brCKMw8cx/Y1JfsnLr/hvautKcHnWDrwbZav4wRRZ/U9Vy GpcAAdaNeFfmhXSwbLh6kf9s1uxp/Wg8nrBzOcuioVMPthBgsRbdnrzH62v2cDCCf0OsiB8ty6gl 1NkGuJxRR2QAAAAAAAA= --Apple-Mail-56--900688607-- From owner-freebsd-security@FreeBSD.ORG Sun Jan 6 22:47:08 2013 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id F1FF65B6 for ; Sun, 6 Jan 2013 22:47:08 +0000 (UTC) (envelope-from mike@sentex.net) Received: from smarthost1.sentex.ca (smarthost1-6.sentex.ca [IPv6:2607:f3e0:0:1::12]) by mx1.freebsd.org (Postfix) with ESMTP id C2E2B1BC1 for ; Sun, 6 Jan 2013 22:47:08 +0000 (UTC) Received: from [192.168.43.26] (pyroxene.sentex.ca [199.212.134.18]) by smarthost1.sentex.ca (8.14.5/8.14.5) with ESMTP id r06Ml7LH092329; Sun, 6 Jan 2013 17:47:07 -0500 (EST) (envelope-from mike@sentex.net) Message-ID: <50E9FEE2.7030106@sentex.net> Date: Sun, 06 Jan 2013 17:46:58 -0500 From: Mike Tancsa Organization: Sentex Communications User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 MIME-Version: 1.0 To: Patrick Proniewski Subject: Re: audit events confusion References: <50E9F6A8.5050502@sentex.net> <27758D4F-14E0-4BEB-AF89-E78D75FD89D7@patpro.net> In-Reply-To: <27758D4F-14E0-4BEB-AF89-E78D75FD89D7@patpro.net> X-Enigmail-Version: 1.4.2 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Scanned-By: MIMEDefang 2.72 on 64.7.153.18 Cc: "freebsd-security@freebsd.org" X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 06 Jan 2013 22:47:09 -0000 On 1/6/2013 5:25 PM, Patrick Proniewski wrote: > On 06 janv. 2013, at 23:11, Mike Tancsa wrote: > >> But if I make a simple php script to try and connect out, again, pflog0 >> blocks it and logs it, but it does not show up in the audit logs >> >> >> Any idea what I am missing ? > > I think auditd can catch events only for users that have logged in at least once. To audit Apache, I've had to install setaudit and launch httpd process by using setaudit with proper flags. > I've modified my /usr/local/etc/rc.d/apache22 file, mainly changing the start command to start_cmd="apache22_auditstart" and adding the proper command definition: > I'm then able to log audit events for Apache, according to flags I've set in apache22_auditflags. > Hi, Thanks for the reply! Where can I find setaudit ? ---Mike -- ------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike@sentex.net Providing Internet services since 1994 www.sentex.net Cambridge, Ontario Canada http://www.tancsa.com/ From owner-freebsd-security@FreeBSD.ORG Mon Jan 7 06:05:08 2013 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.FreeBSD.org [8.8.178.115]) by hub.freebsd.org (Postfix) with ESMTP id 9E22A386 for ; Mon, 7 Jan 2013 06:05:08 +0000 (UTC) (envelope-from patpro@patpro.net) Received: from rack.patpro.net (rack.patpro.net [193.30.227.216]) by mx1.freebsd.org (Postfix) with ESMTP id 3E8C2ACE for ; Mon, 7 Jan 2013 06:05:07 +0000 (UTC) Received: from rack.patpro.net (localhost [127.0.0.1]) by rack.patpro.net (Postfix) with ESMTP id 7CD4A1CC020; Mon, 7 Jan 2013 07:05:05 +0100 (CET) X-Virus-Scanned: amavisd-new at patpro.net Received: from amavis-at-patpro.net ([127.0.0.1]) by rack.patpro.net (rack.patpro.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vfkuSJLamLqH; Mon, 7 Jan 2013 07:05:03 +0100 (CET) Received: from [127.0.0.1] (localhost [127.0.0.1]) by rack.patpro.net (Postfix) with ESMTP; Mon, 7 Jan 2013 07:05:03 +0100 (CET) Subject: Re: audit events confusion Mime-Version: 1.0 (Apple Message framework v1085) Content-Type: multipart/signed; boundary=Apple-Mail-57--873102646; protocol="application/pkcs7-signature"; micalg=sha1 From: Patrick Proniewski In-Reply-To: <50E9FEE2.7030106@sentex.net> Date: Mon, 7 Jan 2013 07:05:02 +0100 Message-Id: <3B904525-515D-495F-AA65-FB32AB57BCD3@patpro.net> References: <50E9F6A8.5050502@sentex.net> <27758D4F-14E0-4BEB-AF89-E78D75FD89D7@patpro.net> <50E9FEE2.7030106@sentex.net> To: Mike Tancsa X-Mailer: Apple Mail (2.1085) Cc: "freebsd-security@freebsd.org" X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Jan 2013 06:05:08 -0000 --Apple-Mail-57--873102646 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii On 06 janv. 2013, at 23:46, Mike Tancsa wrote: > Thanks for the reply! Where can I find setaudit ? here: http://people.freebsd.org/~csjp/setaudit.c patpro --Apple-Mail-57--873102646 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIINTTCCBjQw ggQcoAMCAQICAR4wDQYJKoZIhvcNAQEFBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxKTAn BgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA3MTAyNDIxMDE1NVoX DTE3MTAyNDIxMDE1NVowgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSsw KQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFy dENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQTCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAMcJg8zOLdgasSmkLhOrlr6KMoOMpohBllVHrdRvEg/q6r8jR+EK 75xCGhR8ToREoqe7zM9/UnC6TS2y9UKTpT1v7RSMzR0t6ndl0TWBuUr/UXBhPk+Kmy7bI4yW4urC +y7P3/1/X7U8ocb8VpH/Clt+4iq7nirMcNh6qJR+xjOhV+VHzQMALuGYn5KZmc1NbJQYclsGkDxD z2UbFqE2+6vIZoL+jb9x4Pa5gNf1TwSDkOkikZB1xtB4ZqtXThaABSONdfmv/Z1pua3FYxnCFmdr /+N2JLKutIxMYqQOJebr/f/h5t95m4JgrM3Y/w7YX9d7YAL9jvN4SydHsU6n65cCAwEAAaOCAa0w ggGpMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRTcu2SnODaywFc fH6WNU7y1LhRgjAfBgNVHSMEGDAWgBROC+8apEBbpRdphzDKNGhD0EGu8jBmBggrBgEFBQcBAQRa MFgwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9jYTAtBggrBgEFBQcwAoYh aHR0cDovL3d3dy5zdGFydHNzbC5jb20vc2ZzY2EuY3J0MFsGA1UdHwRUMFIwJ6AloCOGIWh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2NhLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5j b20vc2ZzY2EuY3JsMIGABgNVHSAEeTB3MHUGCysGAQQBgbU3AQIBMGYwLgYIKwYBBQUHAgEWImh0 dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUHAgEWKGh0dHA6Ly93d3cu c3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwDQYJKoZIhvcNAQEFBQADggIBAAqDCH14qywG XLhjjF6uHLkjd02hcdh9hrw+VUsv+q1eeQWB21jWj3kJ96AUlPCoEGZ/ynJNScWy6QMVQjbbMXlt UfO4n4bGGdKo3awPWp61tjAFgraLJgDk+DsSvUD6EowjMTNx25GQgyYJ5RPIzKKR9tQW8gGK+2+R HxkUCTbYFnL6kl8Ch507rUdPPipJ9CgJFws3kDS3gOS5WFMxcjO5DwKfKSETEPrHh7p5shuuNktv sv6hxHTLhiMKX893gxdT3XLS9OKmCv87vkINQcNEcIIoFWbP9HORz9v3vQwR4e3ksLc2JZOAFK+s sS5XMEoznzpihEP0PLc4dCBYjbvSD7kxgDwZ+Aj8Q9PkbvE9sIPP7ON0fz095HdThKjiVJe6vofq +n6b1NBc8XdrQvBmunwxD5nvtTW4vtN6VY7mUCmxsCieuoBJ9OlqmsVWQvifIYf40dJPZkk9YgGT zWLpXDSfLSplbY2LL9C9U0ptvjcDjefLTvqSFc7tw1sEhF0n/qpA2r0GpvkLRDmcSwVyPvmjFBGq Up/pNy8ZuPGQmHwFi2/14+xeSUDG2bwnsYJQG2EdJCB6luQ57GEnTA/yKZSTKI8dDQa8Sd3zfXb1 9mOgSF0bBdXbuKhEpuP9wirslFe6fQ1t5j5R0xi72MZ8ikMu1RQZKCyDbMwazlHiMIIHETCCBfmg AwIBAgIDBQpEMA0GCSqGSIb3DQEBBQUAMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYG A1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwHhcN MTIxMDA0MDQzOTI4WhcNMTMxMDA0MTg0MzA2WjBZMRkwFwYDVQQNExB6bTg4dll2aWZKejR0SWo5 MRowGAYDVQQDDBFwYXRwcm9AcGF0cHJvLm5ldDEgMB4GCSqGSIb3DQEJARYRcGF0cHJvQHBhdHBy by5uZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDPnjSHKomiN/ouGyfzNJwkkB3K aZGRWv+DkP+X29YKei9/uIoMJ5dPqebvpQe3Xjt45a/QC30xFmF/WLhIkconC4+1xjFEMkP5VKuU 1SkrFmQW9ZEF9wYGBBtJG7q9jKBqSJdz3DJyd3gIfHwbuTa7eK0G5GztU9jkEac/JJ0DqakQ0nZ1 IdwrULAN5RQQHPD5+6uzNOI8xJk2QIJG+6hBoR1hl0Y6v8tYrTqo2sRGMFjBZoORFc58gIR9DeP1 VT/7Nu5OLAGYqZkprAU3+ZGP1PZO4c6XlDyUAAhLos7tuHD79owAM33uYJxqrWuB6Oq/KC0MN3Bn NrWL3DLepPeVAgMBAAGjggOsMIIDqDAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAU BggrBgEFBQcDAgYIKwYBBQUHAwQwHQYDVR0OBBYEFLXTKAc1MLwuaL4NGpy86bc7H0qbMB8GA1Ud IwQYMBaAFFNy7ZKc4NrLAVx8fpY1TvLUuFGCMBwGA1UdEQQVMBOBEXBhdHByb0BwYXRwcm8ubmV0 MIICIQYDVR0gBIICGDCCAhQwggIQBgsrBgEEAYG1NwECAjCCAf8wLgYIKwYBBQUHAgEWImh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUHAgEWKGh0dHA6Ly93d3cuc3Rh cnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgfcGCCsGAQUFBwICMIHqMCcWIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5MAMCAQEagb5UaGlzIGNlcnRpZmljYXRlIHdhcyBpc3N1ZWQg YWNjb3JkaW5nIHRvIHRoZSBDbGFzcyAxIFZhbGlkYXRpb24gcmVxdWlyZW1lbnRzIG9mIHRoZSBT dGFydENvbSBDQSBwb2xpY3ksIHJlbGlhbmNlIG9ubHkgZm9yIHRoZSBpbnRlbmRlZCBwdXJwb3Nl IGluIGNvbXBsaWFuY2Ugb2YgdGhlIHJlbHlpbmcgcGFydHkgb2JsaWdhdGlvbnMuMIGcBggrBgEF BQcCAjCBjzAnFiBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTADAgECGmRMaWFiaWxp dHkgYW5kIHdhcnJhbnRpZXMgYXJlIGxpbWl0ZWQhIFNlZSBzZWN0aW9uICJMZWdhbCBhbmQgTGlt aXRhdGlvbnMiIG9mIHRoZSBTdGFydENvbSBDQSBwb2xpY3kuMDYGA1UdHwQvMC0wK6ApoCeGJWh0 dHA6Ly9jcmwuc3RhcnRzc2wuY29tL2NydHUxLWNybC5jcmwwgY4GCCsGAQUFBwEBBIGBMH8wOQYI KwYBBQUHMAGGLWh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9zdWIvY2xhc3MxL2NsaWVudC9jYTBC BggrBgEFBQcwAoY2aHR0cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvc3ViLmNsYXNzMS5jbGll bnQuY2EuY3J0MCMGA1UdEgQcMBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzANBgkqhkiG9w0B AQUFAAOCAQEAM2FDWTDUfusK/57vjVYFjCRXOqjCvkK+ESP2qYOm/jXYS+Q1jLFhdT0OaUkajM4H 5VHcLmq0S3bvYu/rYHi19dE9+f0uRSVVqHpPL0GpNK7E2MWjwH306me7UMCnK6M+gFuYKZX487AT v8w9rATqr4omdwZAzlVytxJkKdacc4jq36tAlaFlYw2j45sgTSR2qjfufoiUX3+OKo02JfLp3rlt o6g+i8v9VF4/2NVgrfbd2fqAEODCgdjmqe0zjXy52n/ncxpnL6XjcS+LtzQ8KH5eKl/hJ1BmAFIO PQ7e9aT5a/AT1/cCLwRbfyxkuvSavp/la9wrCqEsXXbZHKdtsjGCA28wggNrAgEBMIGUMIGMMQsw CQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0 YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5 IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAwUKRDAJBgUrDgMCGgUAoIIBrzAYBgkqhkiG9w0BCQMx CwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xMzAxMDcwNjA1MDNaMCMGCSqGSIb3DQEJBDEW BBQnOofC4Bj0akMVZbhMgwzGBdoVdzCBpQYJKwYBBAGCNxAEMYGXMIGUMIGMMQswCQYDVQQGEwJJ TDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlm aWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVk aWF0ZSBDbGllbnQgQ0ECAwUKRDCBpwYLKoZIhvcNAQkQAgsxgZeggZQwgYwxCzAJBgNVBAYTAklM MRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZp Y2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJtZWRp YXRlIENsaWVudCBDQQIDBQpEMA0GCSqGSIb3DQEBAQUABIIBAKaDaKRxpGBgxpyq8/GELUvvNxg8 aSyx3TOOYfbKTJuoV+OXLHWsYpurhy5TEpiGMhiA02g44j6FC/HEjwd0M6foV+yG4cJ31P9g0nWx yAoc8ynX9o01jyabw448AXPzlqJmSWn3HpbbivD/AUdp4YhkjgLKJKiW5Ak4kaJzjBosVj2STZWd cjSiaINM552oEUsZPbnwqrsehUy+epd+v4ZLVJslMbdchX224n3g4pTTDkMLtk9xf00bcbiOAzVR b5HAF5FIJyv1gX99/mXxQua/QdFm0RI4/MK0sU3VdOCwW5qC9DDQ50taRHxKwUSkK8nX9ozq0T7k ebJtqCy3HRAAAAAAAAA= --Apple-Mail-57--873102646-- From owner-freebsd-security@FreeBSD.ORG Mon Jan 7 06:48:20 2013 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id E4FC1BCB for ; Mon, 7 Jan 2013 06:48:20 +0000 (UTC) (envelope-from patpro@patpro.net) Received: from rack.patpro.net (rack.patpro.net [193.30.227.216]) by mx1.freebsd.org (Postfix) with ESMTP id 94025CE3 for ; Mon, 7 Jan 2013 06:48:20 +0000 (UTC) Received: from rack.patpro.net (localhost [127.0.0.1]) by rack.patpro.net (Postfix) with ESMTP id C56021CC020; Mon, 7 Jan 2013 07:48:18 +0100 (CET) X-Virus-Scanned: amavisd-new at patpro.net Received: from amavis-at-patpro.net ([127.0.0.1]) by rack.patpro.net (rack.patpro.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Rn3ndnUkwAiA; Mon, 7 Jan 2013 07:48:17 +0100 (CET) Received: from [127.0.0.1] (localhost [127.0.0.1]) by rack.patpro.net (Postfix) with ESMTP; Mon, 7 Jan 2013 07:48:17 +0100 (CET) Subject: Re: audit events confusion Mime-Version: 1.0 (Apple Message framework v1085) Content-Type: multipart/signed; boundary=Apple-Mail-58--870509224; protocol="application/pkcs7-signature"; micalg=sha1 From: Patrick Proniewski In-Reply-To: <50E9FEE2.7030106@sentex.net> Date: Mon, 7 Jan 2013 07:48:16 +0100 Message-Id: References: <50E9F6A8.5050502@sentex.net> <27758D4F-14E0-4BEB-AF89-E78D75FD89D7@patpro.net> <50E9FEE2.7030106@sentex.net> To: Mike Tancsa X-Mailer: Apple Mail (2.1085) Cc: "freebsd-security@freebsd.org" X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Jan 2013 06:48:21 -0000 --Apple-Mail-58--870509224 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii On 06 janv. 2013, at 23:46, Mike Tancsa wrote: > Hi, > Thanks for the reply! Where can I find setaudit ? you might find some useful info here too: http://forums.freebsd.org/showthread.php?t=23716 patpro --Apple-Mail-58--870509224 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIINTTCCBjQw ggQcoAMCAQICAR4wDQYJKoZIhvcNAQEFBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxKTAn BgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA3MTAyNDIxMDE1NVoX DTE3MTAyNDIxMDE1NVowgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSsw KQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFy dENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQTCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAMcJg8zOLdgasSmkLhOrlr6KMoOMpohBllVHrdRvEg/q6r8jR+EK 75xCGhR8ToREoqe7zM9/UnC6TS2y9UKTpT1v7RSMzR0t6ndl0TWBuUr/UXBhPk+Kmy7bI4yW4urC +y7P3/1/X7U8ocb8VpH/Clt+4iq7nirMcNh6qJR+xjOhV+VHzQMALuGYn5KZmc1NbJQYclsGkDxD z2UbFqE2+6vIZoL+jb9x4Pa5gNf1TwSDkOkikZB1xtB4ZqtXThaABSONdfmv/Z1pua3FYxnCFmdr /+N2JLKutIxMYqQOJebr/f/h5t95m4JgrM3Y/w7YX9d7YAL9jvN4SydHsU6n65cCAwEAAaOCAa0w ggGpMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRTcu2SnODaywFc fH6WNU7y1LhRgjAfBgNVHSMEGDAWgBROC+8apEBbpRdphzDKNGhD0EGu8jBmBggrBgEFBQcBAQRa MFgwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9jYTAtBggrBgEFBQcwAoYh aHR0cDovL3d3dy5zdGFydHNzbC5jb20vc2ZzY2EuY3J0MFsGA1UdHwRUMFIwJ6AloCOGIWh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2NhLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5j b20vc2ZzY2EuY3JsMIGABgNVHSAEeTB3MHUGCysGAQQBgbU3AQIBMGYwLgYIKwYBBQUHAgEWImh0 dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUHAgEWKGh0dHA6Ly93d3cu c3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwDQYJKoZIhvcNAQEFBQADggIBAAqDCH14qywG XLhjjF6uHLkjd02hcdh9hrw+VUsv+q1eeQWB21jWj3kJ96AUlPCoEGZ/ynJNScWy6QMVQjbbMXlt UfO4n4bGGdKo3awPWp61tjAFgraLJgDk+DsSvUD6EowjMTNx25GQgyYJ5RPIzKKR9tQW8gGK+2+R HxkUCTbYFnL6kl8Ch507rUdPPipJ9CgJFws3kDS3gOS5WFMxcjO5DwKfKSETEPrHh7p5shuuNktv sv6hxHTLhiMKX893gxdT3XLS9OKmCv87vkINQcNEcIIoFWbP9HORz9v3vQwR4e3ksLc2JZOAFK+s sS5XMEoznzpihEP0PLc4dCBYjbvSD7kxgDwZ+Aj8Q9PkbvE9sIPP7ON0fz095HdThKjiVJe6vofq +n6b1NBc8XdrQvBmunwxD5nvtTW4vtN6VY7mUCmxsCieuoBJ9OlqmsVWQvifIYf40dJPZkk9YgGT zWLpXDSfLSplbY2LL9C9U0ptvjcDjefLTvqSFc7tw1sEhF0n/qpA2r0GpvkLRDmcSwVyPvmjFBGq Up/pNy8ZuPGQmHwFi2/14+xeSUDG2bwnsYJQG2EdJCB6luQ57GEnTA/yKZSTKI8dDQa8Sd3zfXb1 9mOgSF0bBdXbuKhEpuP9wirslFe6fQ1t5j5R0xi72MZ8ikMu1RQZKCyDbMwazlHiMIIHETCCBfmg AwIBAgIDBQpEMA0GCSqGSIb3DQEBBQUAMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYG A1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwHhcN MTIxMDA0MDQzOTI4WhcNMTMxMDA0MTg0MzA2WjBZMRkwFwYDVQQNExB6bTg4dll2aWZKejR0SWo5 MRowGAYDVQQDDBFwYXRwcm9AcGF0cHJvLm5ldDEgMB4GCSqGSIb3DQEJARYRcGF0cHJvQHBhdHBy by5uZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDPnjSHKomiN/ouGyfzNJwkkB3K aZGRWv+DkP+X29YKei9/uIoMJ5dPqebvpQe3Xjt45a/QC30xFmF/WLhIkconC4+1xjFEMkP5VKuU 1SkrFmQW9ZEF9wYGBBtJG7q9jKBqSJdz3DJyd3gIfHwbuTa7eK0G5GztU9jkEac/JJ0DqakQ0nZ1 IdwrULAN5RQQHPD5+6uzNOI8xJk2QIJG+6hBoR1hl0Y6v8tYrTqo2sRGMFjBZoORFc58gIR9DeP1 VT/7Nu5OLAGYqZkprAU3+ZGP1PZO4c6XlDyUAAhLos7tuHD79owAM33uYJxqrWuB6Oq/KC0MN3Bn NrWL3DLepPeVAgMBAAGjggOsMIIDqDAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAU BggrBgEFBQcDAgYIKwYBBQUHAwQwHQYDVR0OBBYEFLXTKAc1MLwuaL4NGpy86bc7H0qbMB8GA1Ud IwQYMBaAFFNy7ZKc4NrLAVx8fpY1TvLUuFGCMBwGA1UdEQQVMBOBEXBhdHByb0BwYXRwcm8ubmV0 MIICIQYDVR0gBIICGDCCAhQwggIQBgsrBgEEAYG1NwECAjCCAf8wLgYIKwYBBQUHAgEWImh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUHAgEWKGh0dHA6Ly93d3cuc3Rh cnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgfcGCCsGAQUFBwICMIHqMCcWIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5MAMCAQEagb5UaGlzIGNlcnRpZmljYXRlIHdhcyBpc3N1ZWQg YWNjb3JkaW5nIHRvIHRoZSBDbGFzcyAxIFZhbGlkYXRpb24gcmVxdWlyZW1lbnRzIG9mIHRoZSBT dGFydENvbSBDQSBwb2xpY3ksIHJlbGlhbmNlIG9ubHkgZm9yIHRoZSBpbnRlbmRlZCBwdXJwb3Nl IGluIGNvbXBsaWFuY2Ugb2YgdGhlIHJlbHlpbmcgcGFydHkgb2JsaWdhdGlvbnMuMIGcBggrBgEF BQcCAjCBjzAnFiBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTADAgECGmRMaWFiaWxp dHkgYW5kIHdhcnJhbnRpZXMgYXJlIGxpbWl0ZWQhIFNlZSBzZWN0aW9uICJMZWdhbCBhbmQgTGlt aXRhdGlvbnMiIG9mIHRoZSBTdGFydENvbSBDQSBwb2xpY3kuMDYGA1UdHwQvMC0wK6ApoCeGJWh0 dHA6Ly9jcmwuc3RhcnRzc2wuY29tL2NydHUxLWNybC5jcmwwgY4GCCsGAQUFBwEBBIGBMH8wOQYI KwYBBQUHMAGGLWh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9zdWIvY2xhc3MxL2NsaWVudC9jYTBC BggrBgEFBQcwAoY2aHR0cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvc3ViLmNsYXNzMS5jbGll bnQuY2EuY3J0MCMGA1UdEgQcMBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzANBgkqhkiG9w0B AQUFAAOCAQEAM2FDWTDUfusK/57vjVYFjCRXOqjCvkK+ESP2qYOm/jXYS+Q1jLFhdT0OaUkajM4H 5VHcLmq0S3bvYu/rYHi19dE9+f0uRSVVqHpPL0GpNK7E2MWjwH306me7UMCnK6M+gFuYKZX487AT v8w9rATqr4omdwZAzlVytxJkKdacc4jq36tAlaFlYw2j45sgTSR2qjfufoiUX3+OKo02JfLp3rlt o6g+i8v9VF4/2NVgrfbd2fqAEODCgdjmqe0zjXy52n/ncxpnL6XjcS+LtzQ8KH5eKl/hJ1BmAFIO PQ7e9aT5a/AT1/cCLwRbfyxkuvSavp/la9wrCqEsXXbZHKdtsjGCA28wggNrAgEBMIGUMIGMMQsw CQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0 YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5 IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAwUKRDAJBgUrDgMCGgUAoIIBrzAYBgkqhkiG9w0BCQMx CwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xMzAxMDcwNjQ4MTZaMCMGCSqGSIb3DQEJBDEW BBQc4w1hu0+hx3P5m6wnmQJ4xBruKDCBpQYJKwYBBAGCNxAEMYGXMIGUMIGMMQswCQYDVQQGEwJJ TDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlm aWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVk aWF0ZSBDbGllbnQgQ0ECAwUKRDCBpwYLKoZIhvcNAQkQAgsxgZeggZQwgYwxCzAJBgNVBAYTAklM MRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZp Y2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJtZWRp YXRlIENsaWVudCBDQQIDBQpEMA0GCSqGSIb3DQEBAQUABIIBAA0iaA1Tx1iIsbRAmiaoj44v6gFh m+tne2oy41MMrrfOlfKma7yWys+Z2aFCQ3ngxwr8A+xgi+ixyu+Ocv79Wo2nOVvwEf+GTy0yXgIv cPPuoYu2TtmpXrnTFmPAaSKIoCA2KYBhO48HLRhHuNWcUMCQgncRJOmDg5l7nY79WqmNxDAYo/GA EpkMhAfFNmelfX9i5mHnNlUGSJZD0U8aWGEoE906g7doazU0ExkcxsAc9LXJolz3q15sUly8PbR6 VFKvl3NiDGrZViI4fsPNPUJGFtWjO5XQ5TJ3PtPNgq4XOb//3iJ3Dbh/WZyGKZEiqBEBWwvIYOqc aJssqMaCuJEAAAAAAAA= --Apple-Mail-58--870509224-- From owner-freebsd-security@FreeBSD.ORG Mon Jan 7 12:54:06 2013 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.FreeBSD.org [8.8.178.115]) by hub.freebsd.org (Postfix) with ESMTP id 78051235 for ; Mon, 7 Jan 2013 12:54:06 +0000 (UTC) (envelope-from patpro@patpro.net) Received: from rack.patpro.net (rack.patpro.net [193.30.227.216]) by mx1.freebsd.org (Postfix) with ESMTP id 1D9ED833 for ; Mon, 7 Jan 2013 12:54:05 +0000 (UTC) Received: from rack.patpro.net (localhost [127.0.0.1]) by rack.patpro.net (Postfix) with ESMTP id 537641CC020 for ; Mon, 7 Jan 2013 13:54:03 +0100 (CET) X-Virus-Scanned: amavisd-new at patpro.net Received: from amavis-at-patpro.net ([127.0.0.1]) by rack.patpro.net (rack.patpro.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F5SWsL7s2_eO for ; Mon, 7 Jan 2013 13:54:01 +0100 (CET) Received: from [127.0.0.1] (localhost [127.0.0.1]) by rack.patpro.net (Postfix) with ESMTP for ; Mon, 7 Jan 2013 13:54:01 +0100 (CET) From: Patrick Proniewski Content-Type: multipart/signed; boundary=Apple-Mail-9--848564343; protocol="application/pkcs7-signature"; micalg=sha1 Subject: ZFS / Antivirus Date: Mon, 7 Jan 2013 13:54:01 +0100 Message-Id: To: Liste FreeBSD-security Mime-Version: 1.0 (Apple Message framework v1085) X-Mailer: Apple Mail (2.1085) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Jan 2013 12:54:06 -0000 --Apple-Mail-9--848564343 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hi all, As I understand it, ZFS includes a feature allowing to trigger an = antivirus scan when a file system write is issued. The proper hook seems = to exist only on Solaris. Is there any plan to activate this feature on = FreeBSD ? thanks, and happy new year ;) patpro= --Apple-Mail-9--848564343 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIINTTCCBjQw ggQcoAMCAQICAR4wDQYJKoZIhvcNAQEFBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxKTAn BgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA3MTAyNDIxMDE1NVoX DTE3MTAyNDIxMDE1NVowgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSsw KQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFy dENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQTCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAMcJg8zOLdgasSmkLhOrlr6KMoOMpohBllVHrdRvEg/q6r8jR+EK 75xCGhR8ToREoqe7zM9/UnC6TS2y9UKTpT1v7RSMzR0t6ndl0TWBuUr/UXBhPk+Kmy7bI4yW4urC +y7P3/1/X7U8ocb8VpH/Clt+4iq7nirMcNh6qJR+xjOhV+VHzQMALuGYn5KZmc1NbJQYclsGkDxD z2UbFqE2+6vIZoL+jb9x4Pa5gNf1TwSDkOkikZB1xtB4ZqtXThaABSONdfmv/Z1pua3FYxnCFmdr /+N2JLKutIxMYqQOJebr/f/h5t95m4JgrM3Y/w7YX9d7YAL9jvN4SydHsU6n65cCAwEAAaOCAa0w ggGpMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRTcu2SnODaywFc fH6WNU7y1LhRgjAfBgNVHSMEGDAWgBROC+8apEBbpRdphzDKNGhD0EGu8jBmBggrBgEFBQcBAQRa MFgwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9jYTAtBggrBgEFBQcwAoYh aHR0cDovL3d3dy5zdGFydHNzbC5jb20vc2ZzY2EuY3J0MFsGA1UdHwRUMFIwJ6AloCOGIWh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2NhLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5j b20vc2ZzY2EuY3JsMIGABgNVHSAEeTB3MHUGCysGAQQBgbU3AQIBMGYwLgYIKwYBBQUHAgEWImh0 dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUHAgEWKGh0dHA6Ly93d3cu c3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwDQYJKoZIhvcNAQEFBQADggIBAAqDCH14qywG XLhjjF6uHLkjd02hcdh9hrw+VUsv+q1eeQWB21jWj3kJ96AUlPCoEGZ/ynJNScWy6QMVQjbbMXlt UfO4n4bGGdKo3awPWp61tjAFgraLJgDk+DsSvUD6EowjMTNx25GQgyYJ5RPIzKKR9tQW8gGK+2+R HxkUCTbYFnL6kl8Ch507rUdPPipJ9CgJFws3kDS3gOS5WFMxcjO5DwKfKSETEPrHh7p5shuuNktv sv6hxHTLhiMKX893gxdT3XLS9OKmCv87vkINQcNEcIIoFWbP9HORz9v3vQwR4e3ksLc2JZOAFK+s sS5XMEoznzpihEP0PLc4dCBYjbvSD7kxgDwZ+Aj8Q9PkbvE9sIPP7ON0fz095HdThKjiVJe6vofq +n6b1NBc8XdrQvBmunwxD5nvtTW4vtN6VY7mUCmxsCieuoBJ9OlqmsVWQvifIYf40dJPZkk9YgGT zWLpXDSfLSplbY2LL9C9U0ptvjcDjefLTvqSFc7tw1sEhF0n/qpA2r0GpvkLRDmcSwVyPvmjFBGq Up/pNy8ZuPGQmHwFi2/14+xeSUDG2bwnsYJQG2EdJCB6luQ57GEnTA/yKZSTKI8dDQa8Sd3zfXb1 9mOgSF0bBdXbuKhEpuP9wirslFe6fQ1t5j5R0xi72MZ8ikMu1RQZKCyDbMwazlHiMIIHETCCBfmg AwIBAgIDBQpEMA0GCSqGSIb3DQEBBQUAMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYG A1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwHhcN MTIxMDA0MDQzOTI4WhcNMTMxMDA0MTg0MzA2WjBZMRkwFwYDVQQNExB6bTg4dll2aWZKejR0SWo5 MRowGAYDVQQDDBFwYXRwcm9AcGF0cHJvLm5ldDEgMB4GCSqGSIb3DQEJARYRcGF0cHJvQHBhdHBy by5uZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDPnjSHKomiN/ouGyfzNJwkkB3K aZGRWv+DkP+X29YKei9/uIoMJ5dPqebvpQe3Xjt45a/QC30xFmF/WLhIkconC4+1xjFEMkP5VKuU 1SkrFmQW9ZEF9wYGBBtJG7q9jKBqSJdz3DJyd3gIfHwbuTa7eK0G5GztU9jkEac/JJ0DqakQ0nZ1 IdwrULAN5RQQHPD5+6uzNOI8xJk2QIJG+6hBoR1hl0Y6v8tYrTqo2sRGMFjBZoORFc58gIR9DeP1 VT/7Nu5OLAGYqZkprAU3+ZGP1PZO4c6XlDyUAAhLos7tuHD79owAM33uYJxqrWuB6Oq/KC0MN3Bn NrWL3DLepPeVAgMBAAGjggOsMIIDqDAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAU BggrBgEFBQcDAgYIKwYBBQUHAwQwHQYDVR0OBBYEFLXTKAc1MLwuaL4NGpy86bc7H0qbMB8GA1Ud IwQYMBaAFFNy7ZKc4NrLAVx8fpY1TvLUuFGCMBwGA1UdEQQVMBOBEXBhdHByb0BwYXRwcm8ubmV0 MIICIQYDVR0gBIICGDCCAhQwggIQBgsrBgEEAYG1NwECAjCCAf8wLgYIKwYBBQUHAgEWImh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUHAgEWKGh0dHA6Ly93d3cuc3Rh cnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgfcGCCsGAQUFBwICMIHqMCcWIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5MAMCAQEagb5UaGlzIGNlcnRpZmljYXRlIHdhcyBpc3N1ZWQg YWNjb3JkaW5nIHRvIHRoZSBDbGFzcyAxIFZhbGlkYXRpb24gcmVxdWlyZW1lbnRzIG9mIHRoZSBT dGFydENvbSBDQSBwb2xpY3ksIHJlbGlhbmNlIG9ubHkgZm9yIHRoZSBpbnRlbmRlZCBwdXJwb3Nl IGluIGNvbXBsaWFuY2Ugb2YgdGhlIHJlbHlpbmcgcGFydHkgb2JsaWdhdGlvbnMuMIGcBggrBgEF BQcCAjCBjzAnFiBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTADAgECGmRMaWFiaWxp dHkgYW5kIHdhcnJhbnRpZXMgYXJlIGxpbWl0ZWQhIFNlZSBzZWN0aW9uICJMZWdhbCBhbmQgTGlt aXRhdGlvbnMiIG9mIHRoZSBTdGFydENvbSBDQSBwb2xpY3kuMDYGA1UdHwQvMC0wK6ApoCeGJWh0 dHA6Ly9jcmwuc3RhcnRzc2wuY29tL2NydHUxLWNybC5jcmwwgY4GCCsGAQUFBwEBBIGBMH8wOQYI KwYBBQUHMAGGLWh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9zdWIvY2xhc3MxL2NsaWVudC9jYTBC BggrBgEFBQcwAoY2aHR0cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvc3ViLmNsYXNzMS5jbGll bnQuY2EuY3J0MCMGA1UdEgQcMBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzANBgkqhkiG9w0B AQUFAAOCAQEAM2FDWTDUfusK/57vjVYFjCRXOqjCvkK+ESP2qYOm/jXYS+Q1jLFhdT0OaUkajM4H 5VHcLmq0S3bvYu/rYHi19dE9+f0uRSVVqHpPL0GpNK7E2MWjwH306me7UMCnK6M+gFuYKZX487AT v8w9rATqr4omdwZAzlVytxJkKdacc4jq36tAlaFlYw2j45sgTSR2qjfufoiUX3+OKo02JfLp3rlt o6g+i8v9VF4/2NVgrfbd2fqAEODCgdjmqe0zjXy52n/ncxpnL6XjcS+LtzQ8KH5eKl/hJ1BmAFIO PQ7e9aT5a/AT1/cCLwRbfyxkuvSavp/la9wrCqEsXXbZHKdtsjGCA28wggNrAgEBMIGUMIGMMQsw CQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0 YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5 IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAwUKRDAJBgUrDgMCGgUAoIIBrzAYBgkqhkiG9w0BCQMx CwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xMzAxMDcxMjU0MDFaMCMGCSqGSIb3DQEJBDEW BBSr9khPZ3SB017wwD/lefHVleIcyDCBpQYJKwYBBAGCNxAEMYGXMIGUMIGMMQswCQYDVQQGEwJJ TDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlm aWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVk aWF0ZSBDbGllbnQgQ0ECAwUKRDCBpwYLKoZIhvcNAQkQAgsxgZeggZQwgYwxCzAJBgNVBAYTAklM MRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZp Y2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJtZWRp YXRlIENsaWVudCBDQQIDBQpEMA0GCSqGSIb3DQEBAQUABIIBAIJBlbr0mt0K8SytuD9ykhiRespY mrS7zob7yidrTKBG+8yLvKm+MtFd4KAWV1aKWCu/1R6FAo407gdyShkVU6bJflnOSZOYAm8kQMbL UlwxGF//5bd2BVL/V9jriPK13/USDisWK6lVowDl8TUYb/yDmpDH7WqLlBe44gEgb+5yxzW03JOG auRworS+DAtUp18cHpJDSxqpinaP4KdxNWVgIcSJOKkv/g4IHebICwS8CPe8x4molcP6GsEgsD6Z MUGfzZhVnqpClrZob8OShWthEr8uQWEYqKaSKEHqa5qgp5jKbBjPrXaOZ7vrFH4uobchyMgS2TYY pgw3r+lPND0AAAAAAAA= --Apple-Mail-9--848564343-- From owner-freebsd-security@FreeBSD.ORG Mon Jan 7 14:55:28 2013 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.FreeBSD.org [8.8.178.115]) by hub.freebsd.org (Postfix) with ESMTP id 3C275F9A for ; Mon, 7 Jan 2013 14:55:28 +0000 (UTC) (envelope-from mike@sentex.net) Received: from smarthost1.sentex.ca (smarthost1-6.sentex.ca [IPv6:2607:f3e0:0:1::12]) by mx1.freebsd.org (Postfix) with ESMTP id 037DFE99 for ; Mon, 7 Jan 2013 14:55:27 +0000 (UTC) Received: from [192.168.43.26] (pyroxene.sentex.ca [199.212.134.18]) by smarthost1.sentex.ca (8.14.5/8.14.5) with ESMTP id r07EtQ39066001; Mon, 7 Jan 2013 09:55:26 -0500 (EST) (envelope-from mike@sentex.net) Message-ID: <50EAE1D3.4040803@sentex.net> Date: Mon, 07 Jan 2013 09:55:15 -0500 From: Mike Tancsa Organization: Sentex Communications User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 MIME-Version: 1.0 To: Patrick Proniewski Subject: Re: audit events confusion References: <50E9F6A8.5050502@sentex.net> <27758D4F-14E0-4BEB-AF89-E78D75FD89D7@patpro.net> <50E9FEE2.7030106@sentex.net> In-Reply-To: X-Enigmail-Version: 1.4.2 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Scanned-By: MIMEDefang 2.72 on 64.7.153.18 Cc: "freebsd-security@freebsd.org" X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Jan 2013 14:55:28 -0000 On 1/7/2013 1:48 AM, Patrick Proniewski wrote: > On 06 janv. 2013, at 23:46, Mike Tancsa wrote: > >> Hi, >> Thanks for the reply! Where can I find setaudit ? > > you might find some useful info here too: > > http://forums.freebsd.org/showthread.php?t=23716 Thanks very much! I now see some audit logs generated. Next step is to reduce it down to a more manageable level. Given the above thread, I can see how this was dejavu all over again for you :) If you or anyone else can point me to any other interesting resources about the world of audit, I would love to see it. I guess some interesting stuff is going in the 10 branch as well. ---Mike -- ------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike@sentex.net Providing Internet services since 1994 www.sentex.net Cambridge, Ontario Canada http://www.tancsa.com/ From owner-freebsd-security@FreeBSD.ORG Mon Jan 7 15:13:54 2013 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id 274D33FD for ; Mon, 7 Jan 2013 15:13:54 +0000 (UTC) (envelope-from patpro@patpro.net) Received: from rack.patpro.net (rack.patpro.net [193.30.227.216]) by mx1.freebsd.org (Postfix) with ESMTP id B969DF89 for ; Mon, 7 Jan 2013 15:13:53 +0000 (UTC) Received: from rack.patpro.net (localhost [127.0.0.1]) by rack.patpro.net (Postfix) with ESMTP id E02AA1CC020; Mon, 7 Jan 2013 16:13:50 +0100 (CET) X-Virus-Scanned: amavisd-new at patpro.net Received: from amavis-at-patpro.net ([127.0.0.1]) by rack.patpro.net (rack.patpro.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H2g3yOu7p12U; Mon, 7 Jan 2013 16:13:49 +0100 (CET) Received: from [127.0.0.1] (localhost [127.0.0.1]) by rack.patpro.net (Postfix) with ESMTP; Mon, 7 Jan 2013 16:13:49 +0100 (CET) Subject: Re: audit events confusion Mime-Version: 1.0 (Apple Message framework v1085) Content-Type: multipart/signed; boundary=Apple-Mail-18--840177176; protocol="application/pkcs7-signature"; micalg=sha1 From: Patrick Proniewski In-Reply-To: <50EAE1D3.4040803@sentex.net> Date: Mon, 7 Jan 2013 16:13:48 +0100 Message-Id: <279A6EC3-222F-4096-B0E3-BDBB927BE481@patpro.net> References: <50E9F6A8.5050502@sentex.net> <27758D4F-14E0-4BEB-AF89-E78D75FD89D7@patpro.net> <50E9FEE2.7030106@sentex.net> <50EAE1D3.4040803@sentex.net> To: Mike Tancsa X-Mailer: Apple Mail (2.1085) Cc: "freebsd-security@freebsd.org" X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Jan 2013 15:13:54 -0000 --Apple-Mail-18--840177176 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On 7 janv. 2013, at 15:55, Mike Tancsa wrote: > If you or anyone else can point me to any other interesting resources > about the world of audit, I would love to see it. I guess some > interesting stuff is going in the 10 branch as well. You might want to subscribe to it's a = very low traffic ML hosting specialists of the audit system. patpro= --Apple-Mail-18--840177176 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIINTTCCBjQw ggQcoAMCAQICAR4wDQYJKoZIhvcNAQEFBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxKTAn BgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA3MTAyNDIxMDE1NVoX DTE3MTAyNDIxMDE1NVowgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSsw KQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFy dENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQTCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAMcJg8zOLdgasSmkLhOrlr6KMoOMpohBllVHrdRvEg/q6r8jR+EK 75xCGhR8ToREoqe7zM9/UnC6TS2y9UKTpT1v7RSMzR0t6ndl0TWBuUr/UXBhPk+Kmy7bI4yW4urC +y7P3/1/X7U8ocb8VpH/Clt+4iq7nirMcNh6qJR+xjOhV+VHzQMALuGYn5KZmc1NbJQYclsGkDxD z2UbFqE2+6vIZoL+jb9x4Pa5gNf1TwSDkOkikZB1xtB4ZqtXThaABSONdfmv/Z1pua3FYxnCFmdr /+N2JLKutIxMYqQOJebr/f/h5t95m4JgrM3Y/w7YX9d7YAL9jvN4SydHsU6n65cCAwEAAaOCAa0w ggGpMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRTcu2SnODaywFc fH6WNU7y1LhRgjAfBgNVHSMEGDAWgBROC+8apEBbpRdphzDKNGhD0EGu8jBmBggrBgEFBQcBAQRa MFgwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9jYTAtBggrBgEFBQcwAoYh aHR0cDovL3d3dy5zdGFydHNzbC5jb20vc2ZzY2EuY3J0MFsGA1UdHwRUMFIwJ6AloCOGIWh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2NhLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5j b20vc2ZzY2EuY3JsMIGABgNVHSAEeTB3MHUGCysGAQQBgbU3AQIBMGYwLgYIKwYBBQUHAgEWImh0 dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUHAgEWKGh0dHA6Ly93d3cu c3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwDQYJKoZIhvcNAQEFBQADggIBAAqDCH14qywG XLhjjF6uHLkjd02hcdh9hrw+VUsv+q1eeQWB21jWj3kJ96AUlPCoEGZ/ynJNScWy6QMVQjbbMXlt UfO4n4bGGdKo3awPWp61tjAFgraLJgDk+DsSvUD6EowjMTNx25GQgyYJ5RPIzKKR9tQW8gGK+2+R HxkUCTbYFnL6kl8Ch507rUdPPipJ9CgJFws3kDS3gOS5WFMxcjO5DwKfKSETEPrHh7p5shuuNktv sv6hxHTLhiMKX893gxdT3XLS9OKmCv87vkINQcNEcIIoFWbP9HORz9v3vQwR4e3ksLc2JZOAFK+s sS5XMEoznzpihEP0PLc4dCBYjbvSD7kxgDwZ+Aj8Q9PkbvE9sIPP7ON0fz095HdThKjiVJe6vofq +n6b1NBc8XdrQvBmunwxD5nvtTW4vtN6VY7mUCmxsCieuoBJ9OlqmsVWQvifIYf40dJPZkk9YgGT zWLpXDSfLSplbY2LL9C9U0ptvjcDjefLTvqSFc7tw1sEhF0n/qpA2r0GpvkLRDmcSwVyPvmjFBGq Up/pNy8ZuPGQmHwFi2/14+xeSUDG2bwnsYJQG2EdJCB6luQ57GEnTA/yKZSTKI8dDQa8Sd3zfXb1 9mOgSF0bBdXbuKhEpuP9wirslFe6fQ1t5j5R0xi72MZ8ikMu1RQZKCyDbMwazlHiMIIHETCCBfmg AwIBAgIDBQpEMA0GCSqGSIb3DQEBBQUAMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYG A1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwHhcN MTIxMDA0MDQzOTI4WhcNMTMxMDA0MTg0MzA2WjBZMRkwFwYDVQQNExB6bTg4dll2aWZKejR0SWo5 MRowGAYDVQQDDBFwYXRwcm9AcGF0cHJvLm5ldDEgMB4GCSqGSIb3DQEJARYRcGF0cHJvQHBhdHBy by5uZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDPnjSHKomiN/ouGyfzNJwkkB3K aZGRWv+DkP+X29YKei9/uIoMJ5dPqebvpQe3Xjt45a/QC30xFmF/WLhIkconC4+1xjFEMkP5VKuU 1SkrFmQW9ZEF9wYGBBtJG7q9jKBqSJdz3DJyd3gIfHwbuTa7eK0G5GztU9jkEac/JJ0DqakQ0nZ1 IdwrULAN5RQQHPD5+6uzNOI8xJk2QIJG+6hBoR1hl0Y6v8tYrTqo2sRGMFjBZoORFc58gIR9DeP1 VT/7Nu5OLAGYqZkprAU3+ZGP1PZO4c6XlDyUAAhLos7tuHD79owAM33uYJxqrWuB6Oq/KC0MN3Bn NrWL3DLepPeVAgMBAAGjggOsMIIDqDAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAU BggrBgEFBQcDAgYIKwYBBQUHAwQwHQYDVR0OBBYEFLXTKAc1MLwuaL4NGpy86bc7H0qbMB8GA1Ud IwQYMBaAFFNy7ZKc4NrLAVx8fpY1TvLUuFGCMBwGA1UdEQQVMBOBEXBhdHByb0BwYXRwcm8ubmV0 MIICIQYDVR0gBIICGDCCAhQwggIQBgsrBgEEAYG1NwECAjCCAf8wLgYIKwYBBQUHAgEWImh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUHAgEWKGh0dHA6Ly93d3cuc3Rh cnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgfcGCCsGAQUFBwICMIHqMCcWIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5MAMCAQEagb5UaGlzIGNlcnRpZmljYXRlIHdhcyBpc3N1ZWQg YWNjb3JkaW5nIHRvIHRoZSBDbGFzcyAxIFZhbGlkYXRpb24gcmVxdWlyZW1lbnRzIG9mIHRoZSBT dGFydENvbSBDQSBwb2xpY3ksIHJlbGlhbmNlIG9ubHkgZm9yIHRoZSBpbnRlbmRlZCBwdXJwb3Nl IGluIGNvbXBsaWFuY2Ugb2YgdGhlIHJlbHlpbmcgcGFydHkgb2JsaWdhdGlvbnMuMIGcBggrBgEF BQcCAjCBjzAnFiBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTADAgECGmRMaWFiaWxp dHkgYW5kIHdhcnJhbnRpZXMgYXJlIGxpbWl0ZWQhIFNlZSBzZWN0aW9uICJMZWdhbCBhbmQgTGlt aXRhdGlvbnMiIG9mIHRoZSBTdGFydENvbSBDQSBwb2xpY3kuMDYGA1UdHwQvMC0wK6ApoCeGJWh0 dHA6Ly9jcmwuc3RhcnRzc2wuY29tL2NydHUxLWNybC5jcmwwgY4GCCsGAQUFBwEBBIGBMH8wOQYI KwYBBQUHMAGGLWh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9zdWIvY2xhc3MxL2NsaWVudC9jYTBC BggrBgEFBQcwAoY2aHR0cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvc3ViLmNsYXNzMS5jbGll bnQuY2EuY3J0MCMGA1UdEgQcMBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzANBgkqhkiG9w0B AQUFAAOCAQEAM2FDWTDUfusK/57vjVYFjCRXOqjCvkK+ESP2qYOm/jXYS+Q1jLFhdT0OaUkajM4H 5VHcLmq0S3bvYu/rYHi19dE9+f0uRSVVqHpPL0GpNK7E2MWjwH306me7UMCnK6M+gFuYKZX487AT v8w9rATqr4omdwZAzlVytxJkKdacc4jq36tAlaFlYw2j45sgTSR2qjfufoiUX3+OKo02JfLp3rlt o6g+i8v9VF4/2NVgrfbd2fqAEODCgdjmqe0zjXy52n/ncxpnL6XjcS+LtzQ8KH5eKl/hJ1BmAFIO PQ7e9aT5a/AT1/cCLwRbfyxkuvSavp/la9wrCqEsXXbZHKdtsjGCA28wggNrAgEBMIGUMIGMMQsw CQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0 YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5 IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAwUKRDAJBgUrDgMCGgUAoIIBrzAYBgkqhkiG9w0BCQMx CwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xMzAxMDcxNTEzNDhaMCMGCSqGSIb3DQEJBDEW BBRY2rtOE9C0s6uI+Uz6fwcyYr/RbzCBpQYJKwYBBAGCNxAEMYGXMIGUMIGMMQswCQYDVQQGEwJJ TDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlm aWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVk aWF0ZSBDbGllbnQgQ0ECAwUKRDCBpwYLKoZIhvcNAQkQAgsxgZeggZQwgYwxCzAJBgNVBAYTAklM MRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZp Y2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJtZWRp YXRlIENsaWVudCBDQQIDBQpEMA0GCSqGSIb3DQEBAQUABIIBAFA9GVil0XQ9M+xd3sKJugFcDy9L q+UbgBGa5ytvxGNw6l0vwi4ThyU+mHY2dNgmB9K6fJaOMiUxZ2n4+APQF2yjDREbxaC7JaN+z+li RtW3xejlblKBzIk4QqqMXBYJtJSJdWAC3DGRW/J7xkVfl9gK4BlpcQsnob6eKDvc+fhaeQHIjoOA RcHhrUSBnPc8gH7fJ7oCUYdoh9ehgg1tU0vBwfBxZfSIDwAfibwbRkMzPM4CzdwFRvGxKnQdvAD+ PQhhpNhYpoZnbQMjG2Dbe2bHrBxIbsFRAPM7uSQcqBe5jVBdzX/b7NkfBmEp5kgHiJ/RT1bczUWk lL5ib0U0l0YAAAAAAAA= --Apple-Mail-18--840177176-- From owner-freebsd-security@FreeBSD.ORG Tue Jan 8 12:12:30 2013 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id 5ECECA07 for ; Tue, 8 Jan 2013 12:12:30 +0000 (UTC) (envelope-from victor@bsdes.net) Received: from equilibrium.bsdes.net (244.Red-217-126-240.staticIP.rima-tde.net [217.126.240.244]) by mx1.freebsd.org (Postfix) with ESMTP id 0F113D23 for ; Tue, 8 Jan 2013 12:12:29 +0000 (UTC) Received: by equilibrium.bsdes.net (Postfix, from userid 1001) id F201039845; Tue, 8 Jan 2013 13:04:32 +0100 (CET) Date: Tue, 8 Jan 2013 13:04:32 +0100 From: Victor Balada Diaz To: freebsd-security@freebsd.org Subject: Missing information about RELENG_9_1 support Message-ID: <20130108120432.GD81318@equilibrium.bsdes.net> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit User-Agent: Mutt/1.5.21 (2010-09-15) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Jan 2013 12:12:30 -0000 Hello, Seems security team forgot to update http://www.freebsd.org/security/ with info about RELENG_9_1. I know from the announcement that it will be supported until 31 December of 2014, but would be great if security information page could be updated. Should i send a pr or is enough with this mail? Thanks a lot. Regards. Victor. -- La prueba más fehaciente de que existe vida inteligente en otros planetas, es que no han intentado contactar con nosotros. From owner-freebsd-security@FreeBSD.ORG Tue Jan 8 13:23:04 2013 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id B2EBD9B0 for ; Tue, 8 Jan 2013 13:23:04 +0000 (UTC) (envelope-from feld@feld.me) Received: from mail.feld.me (mail.feld.me [66.170.3.2]) by mx1.freebsd.org (Postfix) with ESMTP id 80E0F7F for ; Tue, 8 Jan 2013 13:23:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=feld.me; s=blargle; h=Content-Transfer-Encoding:Content-Type:Mime-Version:References:In-Reply-To:Message-Id:Subject:Cc:To:From:Date; bh=q1xXKGNKcZAjgmmZKn5J3r89d0ArR5Sl+kYWAp1mvgM=; b=oaOdkQxmjFp59jpWlYX6S/u1a0OXIFqomHknxnBuideXdmsqwT8+2cnQhrAox8qykwGoOd6Qs6WXhxdgew7PgsPCjXxlVpiJpzfIE0LszJHrC3sDPUUuyT1YTIa85bpC; Received: from localhost ([127.0.0.1] helo=mwi1.coffeenet.org) by mail.feld.me with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1TsZ8r-0008KD-9u; Tue, 08 Jan 2013 07:22:57 -0600 Received: from feld@feld.me by mwi1.coffeenet.org (Archiveopteryx 3.1.4) with esmtpsa id 1357651371-18775-18773/5/1; Tue, 8 Jan 2013 13:22:51 +0000 Date: Tue, 8 Jan 2013 07:22:49 -0600 From: Mark Felder To: Patrick Proniewski Subject: Re: ZFS / Antivirus Message-Id: <20130108072249.45a58edc@tech304.office.supranet.net> In-Reply-To: References: X-Mailer: Claws Mail 3.9.0 (GTK+ 2.24.6; amd64-portbld-freebsd9.0) Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: quoted-printable X-SA-Report: ALL_TRUSTED=-1, KHOP_THREADED=-0.5 X-SA-Score: -1.5 Cc: Liste FreeBSD-security X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Jan 2013 13:23:04 -0000 On Mon, 7 Jan 2013 13:54:01 +0100 Patrick Proniewski wrote: > As I understand it, ZFS includes a feature allowing to trigger an = antivirus scan when a file system write is issued. The proper hook seems = to exist only on Solaris. Is there any plan to activate this feature on = FreeBSD ? It would probably be more appropriate to ask the freebsd-fs@ team. From owner-freebsd-security@FreeBSD.ORG Tue Jan 8 15:02:32 2013 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id BD3BE39F for ; Tue, 8 Jan 2013 15:02:32 +0000 (UTC) (envelope-from hosting@syscare.sk) Received: from services.syscare.sk (services.syscare.sk [188.40.39.36]) by mx1.freebsd.org (Postfix) with ESMTP id 7D1D977E for ; Tue, 8 Jan 2013 15:02:32 +0000 (UTC) Received: from services.syscare.sk (services [188.40.39.36]) by services.syscare.sk (Postfix) with ESMTP id E37AB2082B7 for ; Tue, 8 Jan 2013 16:02:30 +0100 (CET) X-Virus-Scanned: amavisd-new at rulez.sk Received: from services.syscare.sk ([188.40.39.36]) by services.syscare.sk (services.rulez.sk [188.40.39.36]) (amavisd-new, port 10024) with ESMTP id xFZ45Q76GmnZ for ; Tue, 8 Jan 2013 16:02:29 +0100 (CET) Received: from hosting.syscare.sk (hosting [188.40.39.37]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by services.syscare.sk (Postfix) with ESMTPS id 073F12082A6 for ; Tue, 8 Jan 2013 16:02:29 +0100 (CET) Received: (from www@localhost) by hosting.syscare.sk (8.14.5/8.14.5/Submit) id r08F2SZm077206; Tue, 8 Jan 2013 16:02:28 +0100 (CET) (envelope-from hosting@syscare.sk) X-Authentication-Warning: hosting.syscare.sk: www set sender to hosting@syscare.sk using -f To: Subject: Re: Missing information about =?UTF-8?Q?RELENG=5F=39=5F=31=20supp?= =?UTF-8?Q?ort?= X-PHP-Originating-Script: 0:main.inc MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Date: Tue, 08 Jan 2013 16:02:28 +0100 From: Daniel Gerzo Organization: The FreeBSD Project In-Reply-To: <20130108120432.GD81318@equilibrium.bsdes.net> References: <20130108120432.GD81318@equilibrium.bsdes.net> Message-ID: X-Sender: danger@FreeBSD.org User-Agent: Roundcube Webmail/0.7.2 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Jan 2013 15:02:32 -0000 On 2013-01-08 13:04, Victor Balada Diaz wrote: > Hello, > > Seems security team forgot to update http://www.freebsd.org/security/ > with > info about RELENG_9_1. I know from the announcement that it will be > supported > until 31 December of 2014, but would be great if security information > page > could be updated. > > Should i send a pr or is enough with this mail? I have added 9.1 RELEASE support dates. This time email was enough ;) Thank you for your report. -- Kind regards Daniel