Re: [Security-Discuss] 2006 su problem

* AAW <[email protected]> [2005-10-18 08:09:15 -0500]:

> > > What security level are you using?
> >
> > Standard, as I always have done before.  I've never tried higher levels
> > because people seem to get into all sorts of problems if they don't
> > know enough about configuring it.
> >
> > Anne
> 
> Level 3 (Higher) isn't bad. That's what I used before creating my own 
> level.local file. It's 4 and 5 that cause the problems. If you want to 
> know what each level entails look at /usr/share/msec/{level,perm}.[0-5] 
> plus man mseclib for details. The documentation 
> in /usr/share/doc/msec-<version>/ isn't always up to date.
> 
> Good Luck,
> Arn
> 
> PS - Let me know off-list if you'd like a copy of my level.local file. It 
> has all the mseclib comments and is more conveniently organized than the 
> man page.

Out of curiosity... what is it about msec that you actually like/need?
I find msec to be more trouble than it's worth.  Frankly, I like the
idea of the various reports it sends, but I really can't stand how it
monkeys with files behind your back (and changing configs is even
worse).  Do you actually find msec "fixing" things is reliable and worth
it?

I'm curious because I've been using an msec replacement I fudged
together over a year ago on my servers (haven't tried it on desktops
since I don't really care on the desktop).  If all you're interested in
is reports, maybe giving rsec a try would be worth it (rsec == msec's
baby brother who isn't prone to putting fingers in cookie jars that
don't belong to him).

-- 
"lynx -source http://linsec.ca/vdanen.asc | gpg --import"
{FEE30AD4 : 7F6C A60C 06C2 4811 FA1C  A2BC 2EBC 5E32 FEE3 0AD4}

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)

iD8DBQFDVTsILrxeMv7jCtQRAs7lAKC3CLA6/qGEkgTTTQbvoZ1YM/TacgCfVoRM
Xu9x+2IC2B3MNsZRDjsdJH4=
=uami
-----END PGP SIGNATURE-----