Date: Thu, 8 May 2008 00:23:59 +0100 (BST) From: Robert Watson <rwatson@FreeBSD.org> To: Jonathan Bond-Caron <jbondc@openmv.com> Cc: freebsd-current@freebsd.org Subject: Re: Freebsd auditing in 7.0? Message-ID: <20080508001926.A37487@fledge.watson.org> In-Reply-To: <000601c8b044$a4616490$ed242db0$@com> References: <000601c8b044$a4616490$ed242db0$@com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, 7 May 2008, Jonathan Bond-Caron wrote: > I recently read this paper: > http://www.trustedbsd.org/20060303-ukuug2006lisa-audit.pdf > > I'm wondering if there are any new features in 7.0 for auditing freebsd and > if audit is included in the base? Changes between audit as shipped in 6.2 and 7.0 are largely incremental -- support for printing audit records as XML, better support for emulation environments such as 32-bit binaryes on 64-bit systems, Linux-emulated binaries, improved IPv6 support, etc. > I've been using syslog-ng on 6.2 for some time but audit looks more rigorous > to track system events & changes. Are there auditing options in 7.0 that > allow sending logs to a central server over SSL? Or any recommendations > other then syslog-ng? > > The goal is track more system events & centralize the log files at a central > server. Last year we had a GSoC project looking at distributed auditing, but I'm not sure there was a usable end result (perhaps someone else can point us at it if so). I'm aware of one on-going project looking at SSL-enabled distributed log parts, but I'm not sure if the author is willing to turn himself in as-yet. Perhaps soon :-). I would certainly anticipate that this is a feature we will ship in the future, but any dates would be hand-waving at this point, unfortunately. Robert N M Watson Computer Laboratory University of Cambridge
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20080508001926.A37487>