Subject: RE: why nonsuppressible syslog calls on successful actions?

From: Roger Hanke <[email-masked]>
Date: Mon, 8 Mar 1999 10:07:27 -0500

Sounds like a great solution as usual. 
	Thanx,
	Roger Hanke

-----Original Message-----
From: Gregory A Lundberg [mailto:[email-masked]]
Sent: Sunday, March 07, 1999 10:44 PM
To: Roger Hanke
Cc: 'WUFTPD List'; 'Bernhard Rosenkraenzer'
Subject: RE: why nonsuppressible syslog calls on successful actions?

On Sun, 7 Mar 1999, Roger Hanke wrote:

>  With regards to the snippet below, I would like to make a request
> that these type of messages are bracketed by the log security flag so
> that they are suppressed by default but activated whenever someone is
> looking for all possible security problems. They seem in the same
> class as other security messages that only come out when security
> logging is active. By the way what was the complete set of messages
> you felt were in this category?

> >[* rah *] For messages like these (there's several more), mainly
> >because nobody's ever _asked_ to have them suppressed.  In fact, in
> >the past, there were requests for MORE such messages, which VR has
> >added.

I'll have to dig through the code to find all the messages.  What I've
been thinking of since you first email is some breakdown for logging
verbosity.  Something along the lines of:

- none
- connection/disconnection
- failed/refused connections
- file/directory operations (creation/deletion/renaming/chmod/...)
- failed/refused file/directory operations
- program execution (SITE EXEC, ftpconversions)
- failed/refused program execution
- ???

The log security feature added a number of failed/refused messages.

I'm thinking something along the lines of a severity-level be assigned
to
each such message and the log security option be enhanced to select the
level with a default for no 'log security' specified and another for
'log
security' with no level specified.

Another approach would be to name each class and have an optional name
list on the 'log security' clause to select which classes you want to
appear in the syslog.  Again, with appropriate defaults.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Roger Hanke <[email-masked]>
Date: Mon, 8 Mar 1999 13:55:17 -0500

Gregory,
 In looking for the other syslog calls that were not
suppressible just found a few in ftpd.c out of
the 100 some LOG_NOTICE calls there that were not
already bracketed by the log_security flag.
 So I just added the log_security flag around the 
LOG_NOTICE statements when a directory is created,
when a file is renamed, when a file is deleted, and
when a directory is deleted. 
 Now a guest account can create a subdir, put a
file to it, rename that file, delete that file,
then delete the subdir, and no NOTICEs show up 
in the syslog. Only if errors occur on these 
operations does anything get logged. Or if turn 
on log security then all of these operations 
get logged.
 So just wanted to mention this in case you would
be interested in the quick fix vs the revamping 
of the logging into levels as you described. 
	Roger

-----Original Message-----
From: Gregory A Lundberg [mailto:[email-masked]]
Sent: Sunday, March 07, 1999 10:44 PM
To: Roger Hanke
Cc: 'WUFTPD List'; 'Bernhard Rosenkraenzer'
Subject: RE: why nonsuppressible syslog calls on successful actions?

- none

--