Date: Wed, 21 Oct 1998 08:07:57 -0500 From: "Jeffrey J. Mountin" <jeff-ml@mountin.net> To: "N. N.M" <madrapour@hotmail.com> Cc: freebsd-security@FreeBSD.ORG Subject: Re: Again logging! Message-ID: <3.0.3.32.19981021080757.010c7324@207.227.119.2> In-Reply-To: <19981021080010.12544.qmail@hotmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
At 01:00 AM 10/21/98 PDT, N. N.M wrote: >I'm sure about it. You know, all of these discussions on TABS and SPACES >in this mailing list, started when I had some problems with my >syslogd.conf (you see, I've had some problems with logging for a long >time!!!) and sent a mail there. Then someone kindly noticed me about the >difference between spaces and tabs! vi syslog.conf /<space> pattern not found? Surely you are certain. ;) Looking back on the thread you make no mention of what version or any other details, maybe that will help. Maybe a long shot, but compare the /usr/sbin/syslogd to the one on the 2nd CD. Is it possible the system was compromized? Not likely, but twice I have been paniced and not taking it for granted did an audit. To my relief and chagrin, both time were pilot error. Still I've done enough audits to not make light of the possiblity. Or something corrupted, do you have other servers setup in a similar fashion? >>Can you "logger -p lpr.info message" and get a message in >/var/log/messages? >>(Just verifying that syslogd is working.) > >Yes, it works. I also used the syslogd with switch -d (debug mode), as >it (syslogd -d) works, it mentions whenever it logs something, it >doesn't log anything realted to TELNET or FTP to "inetd.log" (the files >is supposed to log the inetd-related matters). You tried 'logger -p (telnet|ftp).info' too? Distribution ftpd? You inetd.conf has entries like: ftp stream tcp nowait root /usr/local/libexec/tcpd /usr/libexec/ftpd -l telnet stream tcp nowait root /usr/local/libexec/tcpd /usr/libexec/telnetd -h The /usr/local/etc/hosts.(allow|deny) has: ftpd: <rules> telnetd: <rules> Have you tried the following in inetd.conf: auth.*<tab>/path/to/inetd.log And inetd.log is at least mode 600 owned by root. If all this checks out, my preference would be wipe the system and start over again. This may not be an option, but is worth considering. luck! Jeff Mountin - Unix Systems TCP/IP networking jeff@mountin.net To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3.0.3.32.19981021080757.010c7324>