From owner-freebsd-security Thu Dec 17 19:24:23 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id TAA04706 for freebsd-security-outgoing; Thu, 17 Dec 1998 19:24:23 -0800 (PST) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from schizo.cdsnet.net (schizo.cdsnet.net [204.118.244.32]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id TAA04701 for ; Thu, 17 Dec 1998 19:24:22 -0800 (PST) (envelope-from mrcpu@internetcds.com) Received: from localhost (mrcpu@localhost) by schizo.cdsnet.net (8.8.8/8.7.3) with ESMTP id TAA27751; Thu, 17 Dec 1998 19:20:19 -0800 (PST) Date: Thu, 17 Dec 1998 19:20:19 -0800 (PST) From: Jaye Mathisen X-Sender: mrcpu@schizo.cdsnet.net To: Fernando Schapachnik cc: James Wyatt , reese@chem.duke.edu, freebsd-security@FreeBSD.ORG Subject: Re: tripwire was Re: append-only devices for logging In-Reply-To: <199812111214.JAA25395@ns1.sminter.com.ar> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Transfer-Encoding: 8BIT Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Hmmm, I get permission denied trying to access this URL... Any other ways to get at it? On Fri, 11 Dec 1998, Fernando Schapachnik wrote: > En un mensaje anterior, James Wyatt escribió: > > On Thu, 10 Dec 1998, Charles Reese wrote: > > > Can tripwire be modified to compare two databases rather then one data base > > > and the current files? I ask because I monitor some systems remotely and I > > > would like to be able to automatically generate a tripwire database on the > > > remote system, ftp it to my local site and compare it with a previously > > > created database that I have stored here on read-only media. It is not > > > possible for me to use read-only media on the remote machine. > > > > This is a *great* idea! I had set the BIOS to boot w/o floppy and written > > the DB to a floppy I changed to R/O by hand. This has a limit of 1.44MB > > or 2.88 MB, depending on how much you spend for a floppy drive. I guess a > > zip disk would work too, but I was given a parallel zip which seems to be > > unsupported on FreeBSD. 8{( > > Also, you can use ssyslog to send (encripted) your logs to a "safe > machine". This is usefull if you are planning to protect logs from more > than one box. > > ssyslog can be found on http://www.core-sdi.com/ssyslog > > > Regards! > > Fernando P. Schapachnik > Administracion de la red > S&M International SA > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message