bug in Solaris 2.6 security logging

From: Ruth Milner [VLA] (rmilnerat_private)
Date: Mon Jan 12 1998 - 06:38:24 PST

Next message: KSR[T]: "KSR[T] Advisory #6: deliver"

Previous message: Riku Meskanen: "Again: perl version of that tin opener (IOS decrypt.c)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

A heads-up for anyone monitoring login failures under Solaris:

Under Solaris 2.x, login failure information is not all logged
in one place. The tty and remote source host, if any, are written
to /var/adm/messages, while the account name that was attempted,
along with the tty but *not* the source host, is logged in
/var/adm/loginlog *if it exists*. /var/adm/loginlog is not created
by default when the OS is installed; it has to be touched and
should be mode 600.

Solaris 2.6 does not write anything in /var/adm/loginlog even if
it does exist. This has been assigned bug ID 4096961.

I also spoke to Sun about the fact that from the standpoint of
monitoring security at a large site, complete information needs to
be in one file; it is difficult to automate cross-referencing of
multiple files, especially when /var/adm/messages summarizes
repeated failures while /var/adm/loginlog does not. This has been
assigned bug ID 4101839.
----
Ruth Milner                            NRAO                  Socorro NM
Manager of Computing Systems    rmilnerat_private

Next message: KSR[T]: "KSR[T] Advisory #6: deliver"
Previous message: Riku Meskanen: "Again: perl version of that tin opener (IOS decrypt.c)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 13:38:39 PDT