RE: [SAtalk] spamd and Solaris syslog

2002-03-13 Thread Geoff Gibbs
Ed Henderson asks: > There is a Unix::Syslog module that supposedly is more secure according to > the docs. But I don't have a clue as to how to use it instead of > Sys::Syslog. Any suggestions? Yes, I asked my Perl module/Solaris expert about Sys:: and Unix:: He told me that he thought that S

RE: [SAtalk] spamd and Solaris syslog

2002-03-12 Thread Craig R Hughes
Ok, you got me. I guess I don't. Stupid sendmail. Still, the other 2 should be good enough. C CertaintyTech - Ed Henderson wrote: > How do you get it to bind only to 127.0.0.1? I don't see an option in > syslogd or syslog.conf for that. > > > 1. Only bind to 127.0.0.1 > > 2. Firewall the

RE: [SAtalk] spamd and Solaris syslog

2002-03-12 Thread CertaintyTech - Ed Henderson
How do you get it to bind only to 127.0.0.1? I don't see an option in syslogd or syslog.conf for that. > > Personally, I don't care if syslogd allows "network" logging through UDP, > because I: > > 1. Only bind to 127.0.0.1 > 2. Firewall the syslog port on the local machine for TCP and UDP > 3.

RE: [SAtalk] spamd and Solaris syslog

2002-03-12 Thread Craig R Hughes
CertaintyTech - Ed Henderson wrote: > > > Somebody else mentioned another perl program that looked like it was > > > perhaps using the /dev/log syslog interface - you might > > investigate that. > > > If you don't need remote logging enabled, it's best to disable it. > > > > > > -- > > > Charlie

RE: [SAtalk] spamd and Solaris syslog

2002-03-12 Thread CertaintyTech - Ed Henderson
> > Somebody else mentioned another perl program that looked like it was > > perhaps using the /dev/log syslog interface - you might > investigate that. > > If you don't need remote logging enabled, it's best to disable it. > > > > -- > > Charlie Watts > The question that I have is "why does Spa

RE: [SAtalk] spamd and Solaris syslog

2002-03-12 Thread CertaintyTech - Ed Henderson
> > There's an absurdly simple DoS attack against remotely-logging syslog. > > You just log like crazy. > > Fill up the attackee's disks. > > Somebody else mentioned another perl program that looked like it was > perhaps using the /dev/log syslog interface - you might investigate that. > If you do

RE: [SAtalk] spamd and Solaris syslog

2002-03-12 Thread Charlie Watts
On Tue, 12 Mar 2002, CertaintyTech - Ed Henderson wrote: > > It works for me. I think I'd be looking at syslog. Perhaps your Perl > > syslog interface? > > > > #!/usr/bin/perl -w > > > > use strict; > > use Sys::Syslog qw(:DEFAULT setlogsock); > > > > my $log_facility = 'mail'; > > openlog('test_

RE: [SAtalk] spamd and Solaris syslog

2002-03-12 Thread CertaintyTech - Ed Henderson
> It works for me. I think I'd be looking at syslog. Perhaps your Perl > syslog interface? > > #!/usr/bin/perl -w > > use strict; > use Sys::Syslog qw(:DEFAULT setlogsock); > > my $log_facility = 'mail'; > openlog('test_logger','foo,bar',$log_facility); > syslog('info',"Test log entry"); > > -- >

Re: [SAtalk] spamd and Solaris syslog

2002-03-12 Thread Geoff Gibbs
Ed Henderson wrote: > I have been unable to get spamd to log any messages to syslog "mail" > facility. I have even switched it to "local0" and still no luck. You seem to have got further than me. I have tested spamd 2.01 and 2.11 under Solaris 7 and 9 and get :- # spamd Your vendor has not def

Re: [SAtalk] spamd and Solaris syslog

2002-03-11 Thread Charlie Watts
On Mon, 11 Mar 2002, CertaintyTech - Ed Henderson wrote: > I have been unable to get spamd to log any messages to syslog "mail" > facility. I have even switched it to "local0" and still no luck. The > odd thing is that spamd does send all syslog messages to the console. > Here is the line that