From owner-freebsd-security Mon Oct 15 3:13: 7 2001 Delivered-To: freebsd-security@freebsd.org Received: from falcon.mail.pas.earthlink.net (falcon.mail.pas.earthlink.net [207.217.120.74]) by hub.freebsd.org (Postfix) with ESMTP id 50E9B37B61A; Mon, 15 Oct 2001 03:12:44 -0700 (PDT) Received: from blossom.cjclark.org (dialup-209.245.129.93.Dial1.SanJose1.Level3.net [209.245.129.93]) by falcon.mail.pas.earthlink.net (8.11.5/8.9.3) with ESMTP id f9FACY425003; Mon, 15 Oct 2001 03:12:34 -0700 (PDT) Received: (from cjc@localhost) by blossom.cjclark.org (8.11.6/8.11.3) id f9F9xtW03033; Mon, 15 Oct 2001 02:59:55 -0700 (PDT) (envelope-from cjc) Date: Mon, 15 Oct 2001 02:59:55 -0700 From: "Crist J. Clark" To: "Ilmar S. Habibulin" Cc: Kris Kennaway , Maxim Sobolev , kris@FreeBSD.ORG, security@FreeBSD.ORG Subject: Re: Recent major changes in the NetBSD audit system Message-ID: <20011015025955.O309@blossom.cjclark.org> Reply-To: cjclark@alum.mit.edu References: <20011013151002.B74378@xor.obsecurity.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: ; from ilmar@watson.org on Mon, Oct 15, 2001 at 04:19:59AM -0400 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Mon, Oct 15, 2001 at 04:19:59AM -0400, Ilmar S. Habibulin wrote: > > > On Sat, 13 Oct 2001, Kris Kennaway wrote: > > > > FYI: http://www.netbsd.org/Changes/#audit-011013 > > Looks cool. Anyone want to port it over? > I think it should be review as part of TrustedBSD audit subsystem. It's not _that_ kind of audit system. From reading the commit messages, it looks like this NetBSD "audit" mechanism is just about making something like the present FreeBSD /etc/security script except much more configurable. It watches for changes in specific files and mails you a diff when it notices a change. (That's what I glean from the commit message.) It's not "auditing" in the sense that most security people use it. BTW, what ever happened to breaking up /etc/security into something like a periodic(8) format? Is someone still working on that? Maybe this NetBSD thingie can be imported as part of/in spite of that. -- Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message