Re: [Security-Discuss] msec strange messages

On Wednesday 25 August 2004 19:03, Mason Schmitt wrote:
> **Configure msec to send, at the very least, diff emails.**

For an out-of-the-box, normal desktop computer, this might be the first time 
and only reason you anticipate to recieve locally delivered mail. Have a look 
at /etc/postfix/main.cf and /etc/postfix aliases to make sure you actually 
get those mails.

> It's a tool that I think has a lot of promise for an "ease of use" distro
> like Mandrake.

Well, it's ease of use for you and me, but to be honest, it's not very easy 
for the newbie. There's too much information that could be classified as 
false alarms, that the average user wouldn't notice even if both al-qaeda and 
bush had set camp in their /tmp/. To be more newbie friendly, there should be 
a mechanism to accept some changes (like, i edited this configuration file, 
so it's ok that it has changed) so that I would only see new changes which I 
know I haven't made. Then of course there is the problem that if this is 
possible, it's also possible for the cracker to mark his changes as accepted, 
which kind of defeats the whole purpose of running those checks. 

So the database to store all this info should be received on another machine 
than the one being checked. For instance, a mandrake server would send the 
same msec messages it does now, but on the desktop machine where I recieve 
those mails, I should have a program that filters out all messages I think 
are ok. This should include the logic that if I have edited http.conf once, 
but then later it changes again, I should start getting warnings again. I 
mention this just to state, that the current msec messages are not sufficient 
for this, they should include a date or some kind of hash, or both.

For those people with only one computer (mail is read on the same machine 
being checked) this "second machine" could be a service of the mandrake club. 
(Or possibly this is what you have madrake online for, I don't know.) Msec 
would send it's reports to my club account, where they get filtered and sent 
back to me. If I want to OK some changes, I could do that on my club page.

henrik
-- 
Email: [email protected]
tel:   + 358-50-5259415
www:   www.cafe-seed.net/~hingo
pgp:   www.cafe-seed.net/~hingo/PGP.txt

____________________________________________________
Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com
Join the Club : http://www.mandrakeclub.com
____________________________________________________