From owner-freebsd-security Sun Feb 18 13:51:18 2001 Delivered-To: freebsd-security@freebsd.org Received: from mile.nevermind.kiev.ua (ppp-134.nbi.com.ua [194.153.87.134]) by hub.freebsd.org (Postfix) with ESMTP id 798EA37B491 for ; Sun, 18 Feb 2001 13:51:11 -0800 (PST) Received: (from never@localhost) by mile.nevermind.kiev.ua (8.11.2/8.11.2) id f1IJOhN68356; Sun, 18 Feb 2001 21:24:43 +0200 (EET) (envelope-from never) Date: Sun, 18 Feb 2001 21:24:42 +0200 From: Nevermind To: Carroll Kong Cc: Brian Reichert , freebsd-security@FreeBSD.ORG Subject: Re: Remote logging Message-ID: <20010218212442.A68304@nevermind.kiev.ua> References: <20010218132255.L91352@numachi.com> <4.2.2.20010218133626.00c04f00@netmail.home.com> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-md5; protocol="application/pgp-signature"; boundary="ReaqsoxgOBHFXBhH" Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <4.2.2.20010218133626.00c04f00@netmail.home.com>; from damascus@home.com on Sun, Feb 18, 2001 at 01:40:21PM -0500 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org --ReaqsoxgOBHFXBhH Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hello, Carroll Kong! On Sun, Feb 18, 2001 at 01:40:21PM -0500, you wrote: > That is a good idea, however, what is to stop the enemy from killing=20 > syslogd as his first option? I do not think syslogd logs when it gets=20 > killed? So, despite the secure log host, he might not get the valuable= =20 > info he needs. I suppose you could then start speculating a break in if= =20 > there are no more MARKs since syslogd is dead. Even that could be=20 > fabricated I suppose. Ugh. Security sure is tough to implement=20 > fully. Not trying to say you are wrong, just that I am curious how does= =20 > one stop this possible problem? Have you found a way to avoid it? I sometimes think about some flag on process so that once launched it canno= t be killed without specifying password... I don't know if it will be correct to existing process model... What are you thinking about that? --=20 NEVE-RIPE The instructions said to install Windows 98 or better, so I installed FreeBSD. --ReaqsoxgOBHFXBhH Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.4 (FreeBSD) Comment: For info see http://www.gnupg.org iD8DBQE6kCF5pCk6epJSQlIRAqlMAJ4/1oBMG2Nq/CcTY8hXjflGYdhVSACgoBHQ Rjq2gGD0t+FJ8LnmwNaySVw= =9Lhm -----END PGP SIGNATURE----- --ReaqsoxgOBHFXBhH-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message