Re: IPFW uid logging...

2008-09-09 Thread Daan Vreeken
On Tuesday 09 September 2008 06:50:37 Dan Nelson wrote: In the last episode (Sep 09), Daan Vreeken said: On Monday 08 September 2008 22:03:29 Dan Mahoney, System Admin wrote: On Mon, 8 Sep 2008, Dan Nelson wrote: In the last episode (Sep 08), Dan Mahoney, System Admin said: I have

Re: IPFW uid logging...

2008-09-09 Thread Robert Watson
On Tue, 9 Sep 2008, Daan Vreeken wrote: Which is to say, they don't include the UID -- and I have several hundred sites, each with its own UID. Yes, I could go ahead and set up a thousand deny rules, one for each UID -- but being able to log this info (since it IS being checked) would be

IPFW uid logging...

2008-09-08 Thread Dan Mahoney, System Admin
Hey all, I have the following rule set up in ipfw to limit the exposure of bad php scripts and trojans that try to send mail directly. allow tcp from any to any dst-port 25 uid root deny log tcp from any to any dst-port 25 out However, the log messages I get look like this: Sep 8 13:21:11

Re: IPFW uid logging...

2008-09-08 Thread Dan Nelson
In the last episode (Sep 08), Dan Mahoney, System Admin said: I have the following rule set up in ipfw to limit the exposure of bad php scripts and trojans that try to send mail directly. allow tcp from any to any dst-port 25 uid root deny log tcp from any to any dst-port 25 out However,

Re: IPFW uid logging...

2008-09-08 Thread Dan Mahoney, System Admin
On Mon, 8 Sep 2008, Dan Nelson wrote: In the last episode (Sep 08), Dan Mahoney, System Admin said: I have the following rule set up in ipfw to limit the exposure of bad php scripts and trojans that try to send mail directly. allow tcp from any to any dst-port 25 uid root deny log tcp from

Re: IPFW uid logging...

2008-09-08 Thread Jeremy Chadwick
On Mon, Sep 08, 2008 at 04:03:29PM -0400, Dan Mahoney, System Admin wrote: On Mon, 8 Sep 2008, Dan Nelson wrote: In the last episode (Sep 08), Dan Mahoney, System Admin said: I have the following rule set up in ipfw to limit the exposure of bad php scripts and trojans that try to send mail

Re: IPFW uid logging...

2008-09-08 Thread Daan Vreeken
Hi Dan, Dan and the list, On Monday 08 September 2008 22:03:29 Dan Mahoney, System Admin wrote: On Mon, 8 Sep 2008, Dan Nelson wrote: In the last episode (Sep 08), Dan Mahoney, System Admin said: I have the following rule set up in ipfw to limit the exposure of bad php scripts and trojans

Re: IPFW uid logging...

2008-09-08 Thread Dan Nelson
In the last episode (Sep 09), Daan Vreeken said: On Monday 08 September 2008 22:03:29 Dan Mahoney, System Admin wrote: On Mon, 8 Sep 2008, Dan Nelson wrote: In the last episode (Sep 08), Dan Mahoney, System Admin said: I have the following rule set up in ipfw to limit the exposure of