Re: #124169: snort: Lack of logging to /var/log/secure in default setup & log permissions

2002-02-05 Thread Vineet Kumar
* Andrew Lau ([EMAIL PROTECTED]) [020202 00:34]: > Hi everyone, > It's been over a month since I submitted bug report #124169 to > the BTS and snort's maintainer, Robert van der Meulen > , has not yet replied to me. This bug report is > effectively holding me back from releasing a fully opera

Re: #124169: snort: Lack of logging to /var/log/secure in defaultsetup & log permissions

2002-02-05 Thread Vineet Kumar
--WhfpMioaduB5tiZL Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable * Andrew Lau ([EMAIL PROTECTED]) [020202 00:34]: > Hi everyone, > It's been over a month since I submitted bug report #124169 to > the BTS and snort's maint

#124169: snort: Lack of logging to /var/log/secure in default setup & log permissions

2002-02-02 Thread Andrew Lau
Hi everyone, It's been over a month since I submitted bug report #124169 to the BTS and snort's maintainer, Robert van der Meulen , has not yet replied to me. This bug report is effectively holding me back from releasing a fully operational razorback (ITP #115609) package to accompany Debia

#124169: snort: Lack of logging to /var/log/secure in default setup & log permissions

2002-02-02 Thread Andrew Lau
Hi everyone, It's been over a month since I submitted bug report #124169 to the BTS and snort's maintainer, Robert van der Meulen , has not yet replied to me. This bug report is effectively holding me back from releasing a fully operational razorback (ITP #115609) package to accompany Debi

Re: log permissions

2000-11-05 Thread Ian Zimmerman
> "Christian" == Christian Kurz <[EMAIL PROTECTED]> writes: >> -rw-r--r--1 root root10152 Nov 3 14:49 wdm.log Christian> Also I don't know what this file contains, but as the name suggest, it Christian> has been created by wdm. So it may contain information about who has Chr

Re: log permissions

2000-11-05 Thread Ian Zimmerman
> "Christian" == Christian Kurz <[EMAIL PROTECTED]> writes: >> -rw-r--r--1 root root10152 Nov 3 14:49 wdm.log Christian> Also I don't know what this file contains, but as the name suggest, it Christian> has been created by wdm. So it may contain information about who has Chr

Re: log permissions

2000-11-03 Thread Chester Hosey
I just purged and reinstalled ppp, and created a connection using pppconfig. box:/etc/ppp# cat options | grep -v "^\$" | grep -v "^#" asyncmap 0 auth crtscts lock hide-password modem proxyarp lcp-echo-interval 30 lcp-echo-failure 4 noipx box:/etc/ppp# cat pap-secrets | grep -v "^\$" | grep -v "^#"

Re: log permissions

2000-11-03 Thread Christian Hammers
On Fri, Nov 03, 2000 at 05:22:03PM +0100, Christian Kurz wrote: > > -rw-r--r--1 root root0 Nov 3 06:26 mysql.err > Well, as the name suggest, this file will contain error messages of > mysql but it's empty and so no risk. Well at least there is really no reason to let it be wor

Re: log permissions

2000-11-03 Thread Christian Kurz
On 00-11-03 Ian wrote: > There are too many to list, but here are some: > -rw-r--r--1 root root 8232348 Nov 3 06:43 tripwire Maybe some logfile of tripwire? I don't know it's content so I can't make a judgement about it's security risk. > -rw-r--r--1 root root10152 N

Re: log permissions

2000-11-03 Thread Chester Hosey
I just purged and reinstalled ppp, and created a connection using pppconfig. box:/etc/ppp# cat options | grep -v "^\$" | grep -v "^#" asyncmap 0 auth crtscts lock hide-password modem proxyarp lcp-echo-interval 30 lcp-echo-failure 4 noipx box:/etc/ppp# cat pap-secrets | grep -v "^\$" | grep -v "^#

Re: log permissions

2000-11-03 Thread Christian Hammers
On Fri, Nov 03, 2000 at 05:22:03PM +0100, Christian Kurz wrote: > > -rw-r--r--1 root root0 Nov 3 06:26 mysql.err > Well, as the name suggest, this file will contain error messages of > mysql but it's empty and so no risk. Well at least there is really no reason to let it be wo

Re: log permissions

2000-11-03 Thread Christian Kurz
On 00-11-03 Ian wrote: > There are too many to list, but here are some: > -rw-r--r--1 root root 8232348 Nov 3 06:43 tripwire Maybe some logfile of tripwire? I don't know it's content so I can't make a judgement about it's security risk. > -rw-r--r--1 root root10152

Re: log permissions

2000-11-03 Thread Pedro Zorzenon Neto
Thanks for your help. Now the ppp.log is ok. But, I did't change anything in the default configuration of ppp. I just used 'pppconfig' to create my connection to ISP. Why was /var/log/ppp.log logging the password and also readable by everyone in the default configuration? I think that's a sec

Re: log permissions

2000-11-03 Thread Chester Hosey
The hide-password option in /etc/ppp/options should take care of that. Although I thought hide-password was default, make sure there is no show-password option specified. su to root, then try: cd /etc/ppp egrep -r "\-password" . to find any relevant settings. HTH. -chet -

Re: log permissions

2000-11-03 Thread Thor
> On Fri, Nov 03, 2000 at 04:50:27PM +1100, Ian wrote: > > Hi, > > > > I have a slink->potato->woody server, and I am a little concerned about the permissions some of the log files in /var/log have. > > > > There are too many to list, but here are some: > > -rw-r--r--1 root root 823234

Re: log permissions

2000-11-03 Thread Pedro Zorzenon Neto
Thanks for your help. Now the ppp.log is ok. But, I did't change anything in the default configuration of ppp. I just used 'pppconfig' to create my connection to ISP. Why was /var/log/ppp.log logging the password and also readable by everyone in the default configuration? I think that's a se

Re: log permissions

2000-11-03 Thread Chester Hosey
The hide-password option in /etc/ppp/options should take care of that. Although I thought hide-password was default, make sure there is no show-password option specified. su to root, then try: cd /etc/ppp egrep -r "\-password" . to find any relevant settings. HTH. -chet -

Re: log permissions

2000-11-03 Thread Pedro Zorzenon Neto
On Fri, Nov 03, 2000 at 04:50:27PM +1100, Ian wrote: > Hi, > > I have a slink->potato->woody server, and I am a little concerned about the > permissions some of the log files in /var/log have. > > There are too many to list, but here are some: > -rw-r--r--1 root root 8232348 Nov 3

Re: log permissions

2000-11-03 Thread Thor
> On Fri, Nov 03, 2000 at 04:50:27PM +1100, Ian wrote: > > Hi, > > > > I have a slink->potato->woody server, and I am a little concerned about the permissions some of the log files in /var/log have. > > > > There are too many to list, but here are some: > > -rw-r--r--1 root root 82323

Re: log permissions

2000-11-03 Thread Trek Star
On Fri, 3 Nov 2000, Ian wrote: > I have a slink->potato->woody server, and I am a little concerned about > the permissions some of the log files in /var/log have. > [] > why are these files read by all? I have "normal" users on my system, and > although I trust them, these kinds of permissio

Re: log permissions

2000-11-03 Thread Pedro Zorzenon Neto
On Fri, Nov 03, 2000 at 04:50:27PM +1100, Ian wrote: > Hi, > > I have a slink->potato->woody server, and I am a little concerned about the >permissions some of the log files in /var/log have. > > There are too many to list, but here are some: > -rw-r--r--1 root root 8232348 Nov 3

Re: log permissions

2000-11-03 Thread Trek Star
On Fri, 3 Nov 2000, Ian wrote: > I have a slink->potato->woody server, and I am a little concerned about > the permissions some of the log files in /var/log have. > [] > why are these files read by all? I have "normal" users on my system, and > although I trust them, these kinds of permissi

log permissions

2000-11-02 Thread Ian
Hi, I have a slink->potato->woody server, and I am a little concerned about the permissions some of the log files in /var/log have. There are too many to list, but here are some: -rw-r--r--1 root root 8232348 Nov 3 06:43 tripwire -rw-r--r--1 root root10152 Nov 3 14

log permissions

2000-11-02 Thread Ian
Hi, I have a slink->potato->woody server, and I am a little concerned about the permissions some of the log files in /var/log have. There are too many to list, but here are some: -rw-r--r--1 root root 8232348 Nov 3 06:43 tripwire -rw-r--r--1 root root10152 Nov 3 1