linux security - Jun 1998 - Re: syslogd communication

Hi, 

There have been several replies on the syslogd question. All 2 to 4
lines long. I therefore gathered them here.

				Roger.

-----------------------------------------------------------------
From: Paul Kenyon <pkenyon@loctech.com>
Date: Wed, 24 Jun 1998 11:37:01 -0500

I believe it is possible to pipe anything through SSH.  I''ll find the
URL to
the info and post it.  I haven''t tried it myself, since my linux stuff
is
isolated, and the only thing I get on with it a windows box (which I have to
re-install once a week for obvious reasons. ;-)

Paul


From: "sasha e." <sage@3Sheep.COM>
Date: Wed, 24 Jun 1998 09:56:38 -0400 (EDT)

There''s a "secure syslogd" project that includes encryption,
etc, being
worked on at www.core-sdi.com..  I haven''t explored it much yet, so I
can''t vouch for its efficacy, but it certainly looks interesting.

-s


From: Paul Boehm <paul@boehm.org>
Date: Wed, 24 Jun 1998 11:52:57 +0200

there''s a secure syslogd on http://www.core-sdi.com/ (i think)
if you don''t find it there: search on http://freshmeat.net/

bye,
    paul


From: Andi Kleen <ak@muc.de>
Date: 24 Jun 1998 11:32:56 +0200

When the system has IPSec or another authentification/encryption on socket 
level (e.g. SSL) then the old syslogd should just work fine with minor
changes.


-Andi

-- 
Actor asks a collegue: "To what do you owe your success in acting?"
Answer: "Honesty. Once you''ve learned how to fake that,
you''ve got it made."
-------- Custom Linux device drivers for sale! Call for a quote. ----------
Email: R.E.Wolff@BitWizard.nl || Tel: +31-15-2137555 || FAX: +31-15-2138217

Rogier Wolff wrote:
> There have been several replies on the syslogd question. All 2 to 4
> lines long. I therefore gathered them here.
> 
> 				Roger.
Thank you for summerizing them!

One note though: AFAIK, all syslogs use UDP to transmit their messages
to another syslog (port 514 if I''m not mistaken). Although this is
efficient, it also means that delivery of this message is not
ensured. So your remotely gathered syslogs might miss entries (especially
when an attacker uses some network intensive attack).

Although no perfect solution, numbering (and preferbly authenticating)
the messages would allow you to at least detect missing messages.
Of course, use of serial lines or other dedicated networks helps,
as well as using ssh to set up a tunnel.

With kind regards,
Wouter Slegers