Slashdot Mirror

← Back to Stories (view on slashdot.org)

Security Auditing for Linux

Posted by michael on from the whodunnit dept.

malibu_mex writes: "LinuxToday, ZDNet Australia, and NewsForge are all reporting on a loadable kernel module + GUI combination that implements an auditing subsystem on Linux (Like the NT event logger, or solaris BSM). This could be yet another reason for big business and government to migrate away from the costly commercial alternatives to Linux. First it was SAMBA, now it's SNARE. What have these Aussies got with 5 letter 'S' names? This topic has been discussed on Slashdot previously here."

2 of 112 comments (clear)

  1. Re:Been done by Birdie-PL · · Score: 5, Interesting

    No, it's not just a glorified facelift for the various /var/log parts.

    With SNARE you are able to monitor much, much more than what appears in /var/log. In example you can check who and when opened a particular file (like /etc/passwd) or run a particular process, and with what command-line options. Or which program bound to some port (great for detecting trojans 'calling home').

    I assume that you can also enhance it to monitor *all* system calls, if you are particulary interested or aware of some. Nothing comes to my mind right now, but for sure there some you wish to monitor, if not control.

    --
    e-mail: karol at tls-technologies.com
    www: http://www.tls-technologies.com
    sig: not found
  2. Knee Jerk Reaction by weave · · Score: 4, Interesting
    Event logging on NT/2000 sucks.

    • No central log host capability
    • Tools to search it are crap
    • Have to use a GUI interface to read it or dump it to a text file

    OK, yes, there are third-party tools you can purchase extra to provide better functionality or you have to write some vbscript on your own to get the info. My point is, crap like this should be part of the OS. I'd rather have useful tools than a flock()ing media player, web browser, and instant messenger as part of the OS. :(

    But to get back to the topic, yeah, having better auditing tools under Linux is needed. Just don't look up to Windows as the way to implement them! :)