From owner-freebsd-security Wed Dec 9 16:28:46 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id QAA20718 for freebsd-security-outgoing; Wed, 9 Dec 1998 16:28:46 -0800 (PST) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from goliath.camtech.net.au (goliath.camtech.net.au [203.5.73.2]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id QAA20712 for ; Wed, 9 Dec 1998 16:28:44 -0800 (PST) (envelope-from newton@camtech.com.au) Received: from sebastion.sa.camtech.com.au (sebastion.sa.camtech.com.au [203.28.3.2]) by goliath.camtech.net.au (8.8.5/8.8.2) with ESMTP id KAA18688; Thu, 10 Dec 1998 10:57:42 +1030 (CST) Received: (from smtp@localhost) by sebastion.sa.camtech.com.au (8.8.5/8.8.7) id KAA26788; Thu, 10 Dec 1998 10:58:29 +1030 (CST) Received: from slingshot(192.168.1.2) by sebastion via smap (V2.0) id xma026785; Thu, 10 Dec 98 10:58:26 +1030 Received: from frenzy.ct (newton@frenzy.ct [192.168.4.65]) by slingshot.ct (8.9.1/8.9.1) with ESMTP id KAA28134; Thu, 10 Dec 1998 10:58:25 +1030 (CST) From: Mark Newton Received: (from newton@localhost) by frenzy.ct (8.8.8/8.8.8) id KAA21421; Thu, 10 Dec 1998 10:58:24 +1030 (CDT) Message-Id: <199812100028.KAA21421@frenzy.ct> Subject: Re: append-only devices for logging In-Reply-To: <3.0.5.32.19981209185323.0093dc90@pop-in.ncsu.edu> from Jim Yuill at "Dec 9, 98 06:53:23 pm" To: jjyuill@eos.ncsu.edu (Jim Yuill) Date: Thu, 10 Dec 1998 10:58:24 +1030 (CDT) Cc: FREEBSD-SECURITY@FreeBSD.ORG X-Mailer: ELM [version 2.4ME+ PL32 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Jim Yuill wrote: > I've been looking for an append-only device for logging, which a remote > hacker (with root access) can not erase or alter. Other than a > line-printer, are there any such devices that actually work with Unix? Files fit the bill on FreeBSD. Set your securelevel to 2 and apply the "sappnd" flag (using chflags) to any files you wish to set as "append-only". Not even root can remove the append-only flag unless first bringing the system to a lower security level, which requires physical access to the console for single user mode operation. See chflags(1). - mark --- Mark Newton Email: newton@camtech.com.au Systems Engineer and Senior Trainer Phone: +61-8-8303-3300 Camtech (SA), a member of the Fax: +61-8-8303-4403 CAMTECH group of companies WWW: http://www.camtech.com.au To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message