From owner-freebsd-security Mon Jan 24 6:33: 6 2000 Delivered-To: freebsd-security@freebsd.org Received: from galatea.neptune.on.ca (galatea.neptune.on.ca [205.233.176.3]) by hub.freebsd.org (Postfix) with ESMTP id 79DF314FA7 for ; Mon, 24 Jan 2000 06:33:03 -0800 (PST) (envelope-from steve@neptune.on.ca) Received: from triton.neptune.on.ca (IDENT:steve@triton.neptune.on.ca [205.233.176.2]) by galatea.neptune.on.ca (8.9.3/8.9.3) with SMTP id JAA07697; Mon, 24 Jan 2000 09:32:52 -0500 Date: Mon, 24 Jan 2000 09:32:53 -0500 (EST) From: Steve Mickeler To: "mr. t" Cc: security@FreeBSD.ORG Subject: Re: attack notification via email In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Fri, 21 Jan 2000, mr. t wrote: > > Regarding stream, DOS Smurf, trash packet bombing and sybounce... Be nice > to have the OS send an email. I realize this is what syslog is for but > since this might be a once in awhile sort of a thing and its very > important, if you are going to go to the trouble of making the OS smart > enough to recognize these - make option to email the sysadmin too with an > alert message. That's a little more in-your-face than syslog and might be > appropriate for this once in a lifetime event. At least the option would > be really great and give alot of piece of mind - no alerts, nothing > happened while out to lunch. Not all sysadmins know who to write a utility > to scan the logs and email an alert. Besides that's kludgy. > > Just a thought... Theres a couple of great utils that can do this. The first is PortSentry which is designed to detect and respond to port scans against a target host in real-time. The second is LogCheck which is designed to help in the processing of UNIX system logfiles. Both are free and come with source code and can be found at. http://www.psionic.com/ -- Steve Todays root password is brought to you by /dev/random To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message