From owner-freebsd-security Thu Mar 8 20:37:41 2001 Delivered-To: freebsd-security@freebsd.org Received: from mailhost01.reflexnet.net (mailhost01.reflexnet.net [64.6.192.82]) by hub.freebsd.org (Postfix) with ESMTP id 95BB237B71A for ; Thu, 8 Mar 2001 20:37:39 -0800 (PST) (envelope-from cjc@rfx-216-196-73-168.users.reflexcom.com) Received: from rfx-216-196-73-168.users.reflexcom.com ([216.196.73.168]) by mailhost01.reflexnet.net with Microsoft SMTPSVC(5.5.1877.197.19); Thu, 8 Mar 2001 20:35:33 -0800 Received: (from cjc@localhost) by rfx-216-196-73-168.users.reflexcom.com (8.11.1/8.11.1) id f294arm41257; Thu, 8 Mar 2001 20:36:53 -0800 (PST) (envelope-from cjc) Date: Thu, 8 Mar 2001 20:36:32 -0800 From: "Crist J. Clark" To: Mike Tancsa Cc: freebsd-security@FreeBSD.ORG Subject: Re: "write only" fs/files ? Message-ID: <20010308203632.Q1367@cjc-desktop.users.reflexcom.com> Reply-To: cjclark@alum.mit.edu References: <5.0.2.1.0.20010308130831.03074aa0@marble.sentex.ca> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <5.0.2.1.0.20010308130831.03074aa0@marble.sentex.ca>; from mike@sentex.net on Thu, Mar 08, 2001 at 01:21:01PM -0500 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Thu, Mar 08, 2001 at 01:21:01PM -0500, Mike Tancsa wrote: [snip] > One additional feature that would be nice to have would be to provide one > way backups somehow. i.e. the client machine dumps its data to the backup > server either into a dump file or tar file or sync'd file system via > rsync. But, for security purposes, it would be nice to somehow mark that > data once uploaded as being inaccessible to the client machine. This way > if their box gets compromised after the backup, they dont have access to > the data before it gets offloaded to tape. Figure out how to have the files created with the uappnd flag set or set uchg immediately after they finish a dump. Run the backup server at elevated securelevel. -- Crist J. Clark cjclark@alum.mit.edu To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message