Firewall Wizards: Re: chroot useful?

[Adam Shostack <adam () homeport org>]

chuck yerkes wrote:

|   Using the PROTOCOLS of a GP/OS IS a good idea.  By this I mean
| that configuring via a file or a secure web server (or whatever)
| and logging via syslog is good.

        Logging via syslog is never good.
        
        Syslog throws away information intentionally (facility.level
is discarded).  Syslog throws information away accidentally, by using
UDP as its transport.  Syslog has limited support for fail over
logging if a log host dies.  Syslog has no sequence/acknowledgement at
the application level for reliably ensuring that the message got to
the loghost and was written to disk.  Syslog has no authentication or
integrity checks, but that was excusable at the time it was written.

        Syslog, by the fact that it exists, discourages people from
writing real logging tools for UNIX.  I won't even start on
monitoring.


Adam



-- 
"It is seldom that liberty of any kind is lost all at once."
                                                       -Hume