From owner-freebsd-current@FreeBSD.ORG Wed May 7 23:24:00 2008 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 821591065676 for ; Wed, 7 May 2008 23:24:00 +0000 (UTC) (envelope-from rwatson@FreeBSD.org) Received: from cyrus.watson.org (cyrus.watson.org [209.31.154.42]) by mx1.freebsd.org (Postfix) with ESMTP id 508C38FC16 for ; Wed, 7 May 2008 23:24:00 +0000 (UTC) (envelope-from rwatson@FreeBSD.org) Received: from fledge.watson.org (fledge.watson.org [209.31.154.41]) by cyrus.watson.org (Postfix) with ESMTP id 3E15546B06; Wed, 7 May 2008 19:23:59 -0400 (EDT) Date: Thu, 8 May 2008 00:23:59 +0100 (BST) From: Robert Watson X-X-Sender: robert@fledge.watson.org To: Jonathan Bond-Caron In-Reply-To: <000601c8b044$a4616490$ed242db0$@com> Message-ID: <20080508001926.A37487@fledge.watson.org> References: <000601c8b044$a4616490$ed242db0$@com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Cc: freebsd-current@freebsd.org Subject: Re: Freebsd auditing in 7.0? X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 May 2008 23:24:00 -0000 On Wed, 7 May 2008, Jonathan Bond-Caron wrote: > I recently read this paper: > http://www.trustedbsd.org/20060303-ukuug2006lisa-audit.pdf > > I'm wondering if there are any new features in 7.0 for auditing freebsd and > if audit is included in the base? Changes between audit as shipped in 6.2 and 7.0 are largely incremental -- support for printing audit records as XML, better support for emulation environments such as 32-bit binaryes on 64-bit systems, Linux-emulated binaries, improved IPv6 support, etc. > I've been using syslog-ng on 6.2 for some time but audit looks more rigorous > to track system events & changes. Are there auditing options in 7.0 that > allow sending logs to a central server over SSL? Or any recommendations > other then syslog-ng? > > The goal is track more system events & centralize the log files at a central > server. Last year we had a GSoC project looking at distributed auditing, but I'm not sure there was a usable end result (perhaps someone else can point us at it if so). I'm aware of one on-going project looking at SSL-enabled distributed log parts, but I'm not sure if the author is willing to turn himself in as-yet. Perhaps soon :-). I would certainly anticipate that this is a feature we will ship in the future, but any dates would be hand-waving at this point, unfortunately. Robert N M Watson Computer Laboratory University of Cambridge