Slashdot Mirror
EFF's Logfinder
clonebarkins writes "EFF has just released a new software tool called "logfinder" to help server admins find (and delete) unnecessary log files on their boxen. "By finding unwanted log files, logfinder informs system administrators when their servers are collecting personal data and gives them the opportunity to turn logging off if it isn't gathering information necessary for administering the system.""
locate log
it also gives intruders/managers/employees/anyone with something to hide the ability to search and remove incriminating logs. Thanks EFF!
-Teiresias
Now the question is, can this tool be used for evil? As in finding all the logs on the system and sending them to some script-kiddie?
---
Programming is like sex... Make one mistake and support it the rest of your life.
A competent admin will know that his/her boxen are collecting personal data. An ethical admin will get rid of any unneeded data.
LK
"Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano
Is the point of this that law enforcement can't subpoena records that don't exist?
500GB of disk, 5TB of transfer, $5.95/mo
I would seriously hope that:
a) the sysadmins are competent enough to handle this themselves. I would think that a sysadmin would know how to use some sort of local file search.
b) the EFF understands that it's not always up to the sysadmins to determine the amount of time to keep logs that might be used against an individual.
Most administrators already have effective methods of managing their logs. They crontab the hell out of it.
I think that partition which fills up due to logs getting out of hand is one of the primary causes for the system to start malfunctioning. It is funny, but it used to be better when file size was limited to 2 Gigs, so the log stopped growing when it hit that limit. This is not longer the case on more modern systems.
"You mortals are so obtuse." -Q
God forbid professional sysadmins should be expected to understand how their services are configured and what files are being written. If I were a user on one of their systems, sendmail log files would be the least of my concern.
What I'm listening to now on Pandora...
Can I have a tool to locate and delete people who use the word 'boxen'? GPL preferably.
Am I behind the times in cool admin speak or was this simply boxes mispelled? In any case I could definitely see this being used for both good and bad.
News Reporters Make Tasty Polar Bear Treats!
DIR /S /A: HSA *.log
Wow -- amazing.
rather than letting the admin delete the logs, it instead automatically sent logs to the management.
I'm sorry, but this might just be the dumbest move yet they have made...
lots are crucial for many reasons:
1. Hacking attacks (how else do you track them, and prevent them)?
2. Abuse problems (spammers, credit card fraud)
3. aggregate statistics (what percentage of my customers are based in Europe?)
I can't see why someone would shoot themselves in the foot and use this.
Like log files are really intrusive anyway.
Interesting.. I run a small ISP, and this is something I never even considered. Gonna try it out right now. If there IS any personal data in a log file on my servers, I would consider the safety equal to the trust of me and my few fellow admins, however I can help but think... ROOT KIT!
The last time I checked out redhat (about version 8 I rekon) they inluded this nice little utility called "logviewer". And, I though, wow a text viewer how novel, Linux doesnt have many text viewers.
So not only is this a text viewer, but it also finds all those logs hidden in /var/log/*, it must be hard to find anything in /var/log/* ...
This is just EFF's way of reminding sysadmins to be vigilent about their log files, it's not meant to replace good administration habits.
The article said, "unneccessary log files". It gives you the option of keeping ones you deem necessary. So 1-3 really are necessary log files.
Keep in mind, it also let's website owners that own less than honorable websites (porn!) to keep the users' privacy intact, so that the Patriot Act nazis don't needlessly go after private citizens.
My first thought was the main purpose of this would be to identify and eliminate "wasted" disk space. There are a bunch of logs that, without management, really just end up being wasted bits on your disk. Generally, that may be a useful utility, at least to me.
I was suprised to see the EFF seems to have a totally different motivation. It seems their real motivation is that the government can't demand logs that don't exists, or more specifically you can't get in trouble for not providing what you don't actually have.
Not sure what I think of that...
Soccer Goal Plans
boxen as the plural of box is worth mentioning again.
Don't forget the tapes.
Actually, it uses lsof and a few other niceties to locate open files that change over time, then scans them for presence of time/date stamps, mailaddress or other "log" activity.
/var/log" either, but a bit more complex.
So, no, its not just "locate log" that somone suggested, nor is it "find
As for the comment about competent site-admin. This is a bit more than that too, its also about users and active software, peoples IRC logs, various ftp clients that clobber up and log passwords along with everything else in their config dir. And so on and so forth.
I didn't do this, now did I?
Around here, we call that "logrotate."
"No problem. I have the capacity to do infinite work so long as you don't mind that my quality approaches zero."-Dilbert
to take regular backups, then they shouldn't need the EFFs tool to wipe logs.
are you saying you don't stream your logs across the network/frame relay to another site where they are permanently stored and monitored by unrelated personnel? If you have seperate admin teams, make them in charge of other people's logs (and vice-versa). It's like a checks and balances system.
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
You could be treading in some dangerous territory. Let's say, for instance, as a sysadmin, you know one of your users has been accessing some machine they should not access for whatever reason (immoral, illegal, etc...). Well, you run this tool and uncover evidence to support that theory, then discuss with JaneUser and, out of the goodness of your heart, decide to remove the logs in question. All is well.
Two months later, "they" subpoena your logs to find no trace of evidence. Suspecting log-alteration, they subpoena the upstream providers logs and find correlating evidence that is mysteriously missing from your logs. So, JaneUser ends up getting in trouble, and the kind-hearted sysadmin gets slapped with evidence tampering.
I think, if you're going to carry out any activity that needs covering up, then you need to be more in tune with the circumstances rather than dealing with these sort of things after the fact. Or you could just avoid illegal activity all together...
I'm sorry, this reminds me of another recent story. I think the EFF is doing a lot of good things, but releasing this kind of agenda-pushing software does seem a bit strange to me.
EagerEyes.org: Visualization and Visual Communication
I can see how useful logfinder could be/is. And how it along with relevant administration, can eleviate the possibility that your systems are harbouring evidence of criminal activity... Could they seize any systems they deem necessary? I certainly wouldn't want any of my systems seized because I don't have a log retention policy, and hence when they ask do you have logs for such and such @ such and such a date, a reply of I'm not sure wouldn't go down too well! In short and IMHO having a log retention policy is a good idea... think I might recommend one myself.
"Quoting famous computer scientists out of context is the root of all evil (or at least most of it) in programming." - K
why not boxii?
it's just as stupid and incorrect.
Moderators, what are you smoking?
Two months later, "they" subpoena your logs to find no trace of evidence. Suspecting log-alteration, they subpoena the upstream providers logs and find correlating evidence that is mysteriously missing from your logs. So, JaneUser ends up getting in trouble, and the kind-hearted sysadmin gets slapped with evidence tampering.
How would it be "evidence tampering" if you didn't even know about the existence of an investigation until 2 months after you edited the logs? For you to be tampering with "evidence", doesn't there have to be a case existing at the time - an wouldn't you have to know about it?
If you mod me down, I shall become less powerful than you could possibly imagine.
This tool could be moderately useful, especially in an environment where the administrator can't be expected to know all of the ins and outs of third-party add-ons.
I was once assigned to a dotcom that used a third-party component to allow for credit card transactions. What the admin didn't realize was the default configuration left the component in debug mode, placing all user-submitted credit card data in plain text files on the web server
We only found the log file accidentally while performing an unrelated search for files modified in the last 'n' days. The admin relied on the developers to configure the third-party component and the developers were relying on another set of consultants who didn't know or didn't care about the log files.
90% of everything is crap. Also, crap is relative.
This system is rock solid, in use for hours/day with the exact same mix of programs running constantly (evolution, mozilla, ssh/rxvt windows to external systems, etc.)
comments?
Been there, done that, paid for the T-shirt
and didn't get it
No offence to the fact that almost all the comments under this thread are mocking it.... But even as a professional admin whom has worked on hosting envrionment servers for years, sometimes I run into problems from a log file getting out of hand that hadnt been properly managed etc... It's hard to know and find them sometimes and, :O this does ;P
what's a boxen?
...for my new r00t kit! Now I can upload this onto a machine to easily find all the sensitive logs to swipe and wipe. I'm gunna be a l33t hax0r. Yay me! (Now I just need to wait for a story about a new vunerability. This'll be kewl.)
If somebody could find me a device that would hunt down annyoing people who complain about improper pluralization among tech nerds, then I'd definitely pay for that.
:-)
"Boxen" is fine. If the plural of ox is oxen, then pluralizing box as boxen seems perfectly acceptable to me. It also helps to understand that somebody is talking about a bunch of computers as opposed to a bunch of cardboard boxes.
But I swear that the next person who tells me (in person) that virii is not correct is getting a punch in the face. I mean it.
- Give a man a fire and he's warm for a day, but set him on fire and he's warm for the rest of his life.
See my above comment.
Did the EFF just beat Google to the punch on a "Server Search" app?
What language is that? I always thought boxes was the plural of box.
Mod up.
In reply to your sig ("What if Goat-boy and Tub-girl had offspring?"), the answer is "We'd be in deep shit.".
And yes, you are seriously behind the the times. The oldest copy of the Jargon File I have is from the early '90s and that contains the word boxen
Well, maybe he's so behind the actually he's ahead. I don't know anyone but lamer kiddies and old farts trying desperately to be hip that really use the phrase anymore. It's almost as if it's become a marketing buzz word, and if you know anyone who uses it frequently to refer to computers is probably reaching out for acceptance or hoping that you'll think they're clever. Over reaching.
When I hear someone use the word boxen, my first thought is "wannabee".
It's not offtopic, dumbass. It's orthogonal.