Just to clarify, since it seems like people are getting a little confused here--Robert was originally suggesting having the loghost send the email reports directly to the admin workstations, rather than having it store them locally and require admins to log in to the machine in some way to view them, so as to remove the need for whatever login service would be used by those admins (which would, presumably be another potential point of compromise), and Jeff was responding that he didn't think that it made sense to require an SMTP server on every machine. Note that, in the scenario being described, something listening on port 25 of every workstation _is_ necessary; that's the entire point of the suggestion. So, getting back to the original discussion, and away from discussions of which MTA is better and whether or not various MTAs can be run in local-delivery-only mode: I, personally, would probably opt for a single login mechanism on a secure server, rather than a push mechanism to get the files to the admin workstations. It's much easier to keep track of a single such install than multiple ones; an admin workstation to which all of this data was being pushed would, moreover, be a far more valuable prize for a hacker, since it would probably also have lots of other useful things like PGP private keys on it, and should thus, ideally, be serving as few network services as possible. A well-designed push mechanism--perhaps a lean, well-understood process on each workstation that could only read data from a serial line connected to the loghost, and write that data out to a file--could change that picture; any in-band listener, however, and especially an in-band SMTP listener, would (IMHO) be more risk than it was worth. -- Sweth. -- Sweth Chandramouli ; <svcat_private> President, Idiopathic Systems Consulting --------------------------------------------------------------------- To unsubscribe, e-mail: loganalysis-unsubscribeat_private For additional commands, e-mail: loganalysis-helpat_private
This archive was generated by hypermail 2b30 : Wed Oct 17 2001 - 14:27:26 PDT