Subject: RE: why nonsuppressible syslog calls on successful actions?

From: Roger Hanke <[email-masked]>
Date: Sun, 7 Mar 1999 20:29:06 -0500

Gregory,
 With regards to the snippet below, I would like to make a
request that these type of messages are bracketed by
the log security flag so that they are suppressed by default
but activated whenever someone is looking for all possible 
security problems. They seem in the same class as other
security messages that only come out when security 
logging is active. By the way what was the complete set
of messages you felt were in this category? 
	IMHO,
	Roger Hanke

>-----Original Message-----
>From:	Gregory A Lundberg [SMTP:[email-masked]]
>Sent:	Friday, March 05, 1999 4:41 PM
>To:	Roger Hanke
>Cc:	'WUFTPD List'; 'Bernhard Rosenkraenzer'
>Subject:	Re: why nonsuppressible syslog calls on successful actions?
>
>[* rah *]  For messages like these (there's several more), mainly because
>nobody's
>ever _asked_ to have them suppressed.  In fact, in the past, there were
>requests for MORE such messages, which VR has added.
>
>Personally, I think it's a good idea to know when someone's done something
>special on the machine, but I can see the desire to supress them if you
>really don't think such things may indicate security problems.
>

---

From: Gregory A Lundberg <[email-masked]>
Date: Sun, 7 Mar 1999 22:43:35 -0500 (EST)

On Sun, 7 Mar 1999, Roger Hanke wrote:

>  With regards to the snippet below, I would like to make a request
> that these type of messages are bracketed by the log security flag so
> that they are suppressed by default but activated whenever someone is
> looking for all possible security problems. They seem in the same
> class as other security messages that only come out when security
> logging is active. By the way what was the complete set of messages
> you felt were in this category?

> >[* rah *] For messages like these (there's several more), mainly
> >because nobody's ever _asked_ to have them suppressed.  In fact, in
> >the past, there were requests for MORE such messages, which VR has
> >added.

I'll have to dig through the code to find all the messages.  What I've
been thinking of since you first email is some breakdown for logging
verbosity.  Something along the lines of:

- none
- connection/disconnection
- failed/refused connections
- file/directory operations (creation/deletion/renaming/chmod/...)
- failed/refused file/directory operations
- program execution (SITE EXEC, ftpconversions)
- failed/refused program execution
- ???

The log security feature added a number of failed/refused messages.

I'm thinking something along the lines of a severity-level be assigned to
each such message and the log security option be enhanced to select the
level with a default for no 'log security' specified and another for 'log
security' with no level specified.

Another approach would be to name each class and have an optional name
list on the 'log security' clause to select which classes you want to
appear in the syslog.  Again, with appropriate defaults.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195