From owner-freebsd-security Mon Sep 20 8:42:19 1999 Delivered-To: freebsd-security@freebsd.org Received: from gndrsh.dnsmgr.net (GndRsh.dnsmgr.net [198.145.92.4]) by hub.freebsd.org (Postfix) with ESMTP id E44F415357 for ; Mon, 20 Sep 1999 08:42:06 -0700 (PDT) (envelope-from freebsd@gndrsh.dnsmgr.net) Received: (from freebsd@localhost) by gndrsh.dnsmgr.net (8.9.3/8.9.3) id IAA59140; Mon, 20 Sep 1999 08:41:15 -0700 (PDT) (envelope-from freebsd) From: "Rodney W. Grimes" Message-Id: <199909201541.IAA59140@gndrsh.dnsmgr.net> Subject: Re: Real-time alarms In-Reply-To: from Robert Watson at "Sep 20, 1999 11:33:57 am" To: robert+freebsd@cyrus.watson.org (Robert Watson) Date: Mon, 20 Sep 1999 08:41:14 -0700 (PDT) Cc: security@FreeBSD.ORG X-Mailer: ELM [version 2.4ME+ PL54 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org > > I'd advise against developing any more codebases for auditing--we already > have two :-). I have a /dev/audit, submission of records from a number of > syscalls, an auditd + IDS interface, and some log management code. Nate's > folk are working on a better kernel interface and implementation, as was > discussed on freebsd-security in July (please see archive for details). > My userland library currently supports most of the posix.1e audit > interface spec, and I have a set of posix.1e extensions for IDS modules. > My hope is to adapt my auditd to speak Nate's kernel improvements, but > continue to provide a standard interface and useful tools/etc. URL to source code please... and I already pointed out that we need to at least look at what is out there. -- Rod Grimes - KD7CAX - (RWG25) rgrimes@gndrsh.dnsmgr.net To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message