From owner-freebsd-security@FreeBSD.ORG Fri Oct 24 05:45:33 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id DB10916A4B3 for ; Fri, 24 Oct 2003 05:45:33 -0700 (PDT) Received: from otter3.centtech.com (moat3.centtech.com [207.200.51.50]) by mx1.FreeBSD.org (Postfix) with ESMTP id E948543F85 for ; Fri, 24 Oct 2003 05:45:32 -0700 (PDT) (envelope-from anderson@centtech.com) Received: from centtech.com (neutrino.centtech.com [204.177.173.28]) by otter3.centtech.com (8.12.3/8.12.3) with ESMTP id h9OCjW6T078666; Fri, 24 Oct 2003 07:45:32 -0500 (CDT) (envelope-from anderson@centtech.com) Message-ID: <3F991EDB.6080706@centtech.com> Date: Fri, 24 Oct 2003 07:45:15 -0500 From: Eric Anderson User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Brett Glass References: <6.0.0.22.2.20031023162326.04c1e008@localhost> <6.0.0.22.2.20031023183427.04e18d10@localhost> In-Reply-To: <6.0.0.22.2.20031023183427.04e18d10@localhost> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit cc: security@freebsd.org Subject: Re: /var partition overflow (due to spyware?) in FreeBSD default install X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Oct 2003 12:45:34 -0000 Brett Glass wrote: >>Just how large is /var on the >>machine where you're seeing this problem? >> >> > >On the machine from which I took those messages, it's 256M. > Personally, on all the machines I build, I have the luxury of having decent sized hard drives in them, and I never have a /var partition that small. 256M can be swallowed by all sorts of crazy things that spam to /var/log/messages. I typically make my /var partition at least 1gb, but never smaller. Making the /var partition larger doesn't *fix* the problem, but it gives you more time to be aware of a problem and react to it. Eric -- ------------------------------------------------------------------ Eric Anderson Systems Administrator Centaur Technology All generalizations are false, including this one. ------------------------------------------------------------------