From owner-freebsd-security@FreeBSD.ORG  Tue Jan  6 13:14:41 2004
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id AD9FA16A4CE
	for <freebsd-security@freebsd.org>;
	Tue,  6 Jan 2004 13:14:41 -0800 (PST)
Received: from web60402.mail.yahoo.com (web60402.mail.yahoo.com
	[216.109.118.185])
	by mx1.FreeBSD.org (Postfix) with SMTP id A918443D53
	for <freebsd-security@freebsd.org>;
	Tue,  6 Jan 2004 13:14:40 -0800 (PST)
	(envelope-from twigles@yahoo.com)
Message-ID: <20040106211439.56099.qmail@web60402.mail.yahoo.com>
Received: from [68.5.51.136] by web60402.mail.yahoo.com via HTTP;
	Tue, 06 Jan 2004 13:14:39 PST
Date: Tue, 6 Jan 2004 13:14:39 -0800 (PST)
From: twig les <twigles@yahoo.com>
To: Richard Bejtlich <richard_bejtlich@yahoo.com>,
	freebsd-security@freebsd.org
In-Reply-To: <20040106210430.28516.qmail@web60806.mail.yahoo.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Subject: Re: Logging user activities
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 06 Jan 2004 21:14:41 -0000


--- Richard Bejtlich <richard_bejtlich@yahoo.com> wrote:
> 
> My goal is to "watch the watchers," i.e. watch for
> abuse of power by SOC people with the ability to view
> traffic captured by sniffers.
> 

Have you considered snooping ttys (man watch, man snp)?  It
doesn't seem to be scalable, but I've only tinkered.

=====
-----------------------------------------------------------
Only fools have all the answers.   
-----------------------------------------------------------

__________________________________
Do you Yahoo!?
Yahoo! Hotjobs: Enter the "Signing Bonus" Sweepstakes
http://hotjobs.sweepstakes.yahoo.com/signingbonus