From: Steve Grubb <sgrubb@redhat.com>
To: Loredan Stancu <loredan.stancu@myclar.ro>
Cc: linux-audit@redhat.com
Subject: Re: audisp-prelude problems
Date: Thu, 4 Dec 2008 10:33:24 -0500 [thread overview]
Message-ID: <200812041033.24734.sgrubb@redhat.com> (raw)
In-Reply-To: <57942.193.230.245.33.1228402674.squirrel@secure.myclar.ro>
On Thursday 04 December 2008 09:57:54 Loredan Stancu wrote:
> Now I'll have to user audisp-remote plugin to centralize events.
One further refinement to what I said yesterday about remote logging. You
probably want to set the local_port value to something < 1024 in the remote
configuration files. Then in the aggregating auditd, set the tcp_client_ports to
the same thing.
This is a security feature to prevent random user space apps from trying audit
log injection attacks. For experimenting or casual use you don't need to set
these up, but for production use you must.
If you use kerberos authentication, then you have even more protection. But
setting up kerberos for this is a little more than I want to explain.
-Steve
next prev parent reply other threads:[~2008-12-04 15:33 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-12-04 14:57 audisp-prelude problems Loredan Stancu
2008-12-04 15:33 ` Steve Grubb [this message]
-- strict thread matches above, loose matches on Subject: below --
2008-12-04 15:38 Loredan Stancu
2008-12-04 15:56 ` Steve Grubb
2008-12-04 13:10 Loredan Stancu
2008-12-04 13:41 ` Steve Grubb
2008-12-03 17:58 Loredan Stancu
2008-12-03 20:22 ` Steve Grubb
2008-12-03 16:53 Loredan Stancu
2008-12-03 17:02 ` Steve Grubb
2008-12-03 17:17 ` LC Bruzenak
2008-12-03 17:34 ` Steve Grubb
2008-12-03 16:38 LC Bruzenak
2008-12-03 15:28 Loredan Stancu
2008-12-03 16:33 ` Steve Grubb
2008-12-03 10:23 Loredan Stancu
2008-12-03 13:46 ` Steve Grubb
2008-12-03 15:17 ` LC Bruzenak
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200812041033.24734.sgrubb@redhat.com \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
--cc=loredan.stancu@myclar.ro \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox