From owner-freebsd-security@FreeBSD.ORG Wed Oct 22 11:41:28 2014 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id AC2B9645 for ; Wed, 22 Oct 2014 11:41:28 +0000 (UTC) Received: from eu1sys200aog106.obsmtp.com (eu1sys200aog106.obsmtp.com [207.126.144.121]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 06168684 for ; Wed, 22 Oct 2014 11:41:27 +0000 (UTC) Received: from mail-wi0-f172.google.com ([209.85.212.172]) (using TLSv1) by eu1sys200aob106.postini.com ([207.126.147.11]) with SMTP ID DSNKVEeX4FIH15EOnbBeNQ75UXL0vmSGdgmg@postini.com; Wed, 22 Oct 2014 11:41:28 UTC Received: by mail-wi0-f172.google.com with SMTP id bs8so1093825wib.11 for ; Wed, 22 Oct 2014 04:41:20 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:date:from:message-id:to:subject:reply-to; bh=d/pZG3VuYgUxsH5iM5ivu/Y+OMlVS0T7gvLfRuKh3Jw=; b=MkF4j3M5jo9LteL+Q/0y/2ICehHzxT54Tef7VeDZ9XP6RV+gYvK78/qeaFDJXggzmX lV+0ABt5PYDIDxJLNusPTIzv0hMQcQ80dT2GuhRGBIn8tgZhpBKjldG+zMFImMdI1Lj7 xTr9Gs08boXYockpvD3hCsvGG9szZ6Vy9tEQ2nIvTiAT+6y9/Z/a1wxnCgiZRzKwuDHF RzstZJ8mwR/O7y1Bb0Uklpp30Yxln1Vn9vXbDRDEGN7bay0V2D3qV752Tx5LMyN8w4au PBcdQDmEMSeFzsFELpQHhjU8QH/OB67fIl5OhSKPHxxAtwoxlyH9gcxTuk+8B5axUNuO +N5w== X-Gm-Message-State: ALoCoQmBtUiT3eh8MWLXvj+9YGD+5HMy/bFNGodtM9Rda5UYeZbv6o4Vv/LMeFA91Ez3e1L3Ij4FZnylRkChoPeuaU23NATHDBIDvlzYswS3QYqVzuwCMW3msT7ZsyPQEhlQNQNsHE+w7cWDQ73asdYHT4zyWRu62w== X-Received: by 10.194.122.231 with SMTP id lv7mr51206036wjb.27.1413978080479; Wed, 22 Oct 2014 04:41:20 -0700 (PDT) X-Received: by 10.194.122.231 with SMTP id lv7mr51205998wjb.27.1413978080226; Wed, 22 Oct 2014 04:41:20 -0700 (PDT) Received: from mech-as221.men.bris.ac.uk (mech-as221.men.bris.ac.uk. [137.222.187.221]) by mx.google.com with ESMTPSA id y5sm1640434wix.10.2014.10.22.04.41.19 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 22 Oct 2014 04:41:19 -0700 (PDT) Received: from mech-as221.men.bris.ac.uk (localhost [127.0.0.1]) by mech-as221.men.bris.ac.uk (8.14.9/8.14.9) with ESMTP id s9MBfILO027950 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Wed, 22 Oct 2014 12:41:18 +0100 (BST) (envelope-from mexas@mech-as221.men.bris.ac.uk) Received: (from mexas@localhost) by mech-as221.men.bris.ac.uk (8.14.9/8.14.9/Submit) id s9MBfIRS027949 for freebsd-security@freebsd.org; Wed, 22 Oct 2014 12:41:18 +0100 (BST) (envelope-from mexas) Date: Wed, 22 Oct 2014 12:41:18 +0100 (BST) From: Anton Shterenlikht Message-Id: <201410221141.s9MBfIRS027949@mech-as221.men.bris.ac.uk> To: freebsd-security@freebsd.org Subject: Re: system identification in utx database? Reply-To: mexas@bris.ac.uk X-Mailman-Approved-At: Wed, 22 Oct 2014 11:48:24 +0000 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Oct 2014 11:41:28 -0000 I asked in questions@ and got no reply, trying here. Thanks Anton >From mexas Mon Oct 20 10:37:52 2014 >To: freebsd-questions@freebsd.org >Subject: system identification in utx database? >Reply-To: mexas@bris.ac.uk > >Hello > >Is there any information in a utx(8) database (log) >that allows one to identify the system where >that database was recorded? I cannot find any. > >I need to preserve the utx access logs from several >FreeBSD boxes. If I copy the logs to another box, >or just print, I lose the information about the >system where these logs came from. >This is because this information does not >seem to be present in the logs themselves. >So I have to add some manual database identification, >which might cast doubt on the database authenticity >or integrity, if I even need to rely such databases, >e.g. in court. > >So, I wonder if there is some system identification >information written to utx database that I'm not >familiar with. > >I also have auditing enabled, but I'm still >learning it, and don't want to loose the >simplicity of utx. > >Shall I ask in securuty@ list? > >Thanks > >Anton