From owner-freebsd-security Thu Jan 27 8:51: 9 2000 Delivered-To: freebsd-security@freebsd.org Received: from pau-amma.whistle.com (pau-amma.whistle.com [207.76.205.64]) by hub.freebsd.org (Postfix) with ESMTP id 3359B15659 for ; Thu, 27 Jan 2000 08:51:08 -0800 (PST) (envelope-from dhw@whistle.com) Received: (from dhw@localhost) by pau-amma.whistle.com (8.9.2/8.9.2) id IAA23459 for freebsd-security@FreeBSD.ORG; Thu, 27 Jan 2000 08:51:07 -0800 (PST) Date: Thu, 27 Jan 2000 08:51:07 -0800 (PST) From: David Wolfskill Message-Id: <200001271651.IAA23459@pau-amma.whistle.com> To: freebsd-security@FreeBSD.ORG Subject: Re: Riddle me this In-Reply-To: <4.2.2.20000127084138.0454fba0@localhost> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org >Date: Thu, 27 Jan 2000 08:42:40 -0700 >From: Brett Glass >>At any rate, I like logging on most of my deny rules. You see all kinds of >>neat stuff even on a home DSL connection. [Public, this time -- dhw] Confirmed. Both at home and for my mother's firewall. Correlating the port scans is interesting in and of itself. (We're both using Pac*Bell/PBI, but she's in a community about 30 miles north of my place.) >Good idea! So long as logging is rate-limited, this might be fun. >Does one have to add anything to syslogd.conf to get the log messages from >ipfw to appear in /var/log/messages? I didn't. (My firewall box has no keyboard or monitor attached normally.) But I also sent all syslogging for the firewall "over the wall" to an internal box; were I slightly more paranoid, I'd try dealing with the serial console stuff, but that hasn't appeared to be necessary just yet. Cheers, david -- David Wolfskill dhw@whistle.com UNIX System Administrator voice: (650) 577-7158 pager: (888) 347-0197 FAX: (650) 372-5915 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message