From owner-freebsd-current@FreeBSD.ORG Thu Feb 17 20:13:48 2005 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 6263C16A4CE; Thu, 17 Feb 2005 20:13:48 +0000 (GMT) Received: from postfix4-1.free.fr (postfix4-1.free.fr [213.228.0.62]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8CC8343D31; Thu, 17 Feb 2005 20:13:45 +0000 (GMT) (envelope-from tataz@tataz.chchile.org) Received: from tatooine.tataz.chchile.org (vol75-8-82-233-239-98.fbx.proxad.net [82.233.239.98]) by postfix4-1.free.fr (Postfix) with ESMTP id 2F99928C729; Thu, 17 Feb 2005 21:13:43 +0100 (CET) Received: by tatooine.tataz.chchile.org (Postfix, from userid 1000) id 74AB9407C; Thu, 17 Feb 2005 21:13:11 +0100 (CET) Date: Thu, 17 Feb 2005 21:13:11 +0100 From: Jeremie Le Hen To: Gleb Smirnoff Message-ID: <20050217201311.GN82324@obiwan.tataz.chchile.org> References: <20050217135609.GA97455@cell.sick.ru> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20050217135609.GA97455@cell.sick.ru> User-Agent: Mutt/1.5.7i cc: current@freebsd.org Subject: Re: changing debuglevel of kernel messaging going to console X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Feb 2005 20:13:48 -0000 Hi Gleb, > now all kernel messages are printed to system console by default: > > *.err;kern.debug;auth.notice;mail.crit /dev/console > > There is a problem that in case of a serial console, this printing > is very slow and heavily pessimizes box performance, when kernel > messages are printed at high speed. Moreover, several kernel messages > with LOG_DEBUG severity can be triggered remotely, for example > sending bogus ARP replies. So, sending bogus ARP packets to a > FreeBSD box with serial console may lead to a DoS like conditions. I don't want to be picky, you are right. I encountered this behaviour while working on a Linux firewall which was printing all NetFilter's log on the console (which in turn was a serial link). I have wondered for a few days why the hell making a nmap scan from a DSL connexion would come off having a ping of 20 seconds and 100% CPU usage whereas my tests through a 100Mbits link left it emotionless. But, although it is possible to trigger kernel message remotely sending fake ARP packets, I really do not want to have my FreeBSD box being silent by default when I am ARP spoofed. Furthermore, once the attacker is able to have local network access, there are numerous ways to make a DoS on the service the server provides anyway. Best regards, -- Jeremie Le Hen jeremie at le-hen dot org