oddprob_securelogs

This is part of The Pile, a partial archive of some open source mailing lists and newsgroups.



Subject: Re: console messages
From: Ramon Gandia <rfg@nook.net>
Date: Fri, 11 Jun 1999 09:57:47 -0800


Hal Burgiss wrote:
> 
> On Fri, Jun 11, 1999 at 08:35:32AM -0400, Trevor Jennings wrote:
> >  I was just wondering if anyone knew whether it was possible to direct
> > the console messages to a log file? Reason being is that our server is
> > co-located in a different building and I want to keep tabs on error
> > messages that are appearing on the console...for example kernel errors.
> 
> Check man syslogd and man klogd. Pretty sure there are options for
> increasing what goes into logs.
> 

Two basic ways you can proceed.

Method 1:  Like the man says, read syslog and klogd man pages. 
You can redirect your logging output to a remote machine;
for instance, instead of having it go to
/var/log/messages     it can go instead to
somewhere.some.com:/var/log/your.messages

Method 2:  The problem with the above is that its not hack
proof.  Someone gets into your machine, they can read the
syslog.conf and go to the other machine.  Not likely, but
possible.  Depends on the hacker and how much time he spends
studying your system.  So.....

In /etc/inittab you change one of the getty lines so the
output of a vc is redirected to a serial port.  uugetty is
good for this as mingetty will not work.  You then connect
an old pc, or a printer, to this serial port.  This is a 
perfect use for one of those ibm pc (or XT) that are laying
around.  The PC does not need to network, merely to record
what comes in on the serial port to its hard drive.  That
creates a record of what goes no in the main machine and is
hackproof. 

It helps if the old PC has a 16550A serial port.

===


the rest of The Pile (a partial mailing list archive)

doom@kzsu.stanford.edu