At 22:27 29/04/01 -0400, Paul D. Robertson wrote:
>[snip]
> > How come when I have them as permission 644 it fails?
>
>Without knowing the user and group entries, knowing the permissions
>doesn't help much.
Mine are 644 since the installation of solaris, and it all goes well...
>[snip]
>
>Make sure that whatever user syslogd is running as is the owner of the
>syslog files. Don't forget that the files have to exist before syslogd
>will write to them, so if you're using a log rotation program, ensure that
>it sets the permissions and ownership appropriately, or runs as the logging
>user.
Under normal circumstances, syslogd is running as root. so either the guy
changed this
and he is guilty and should never change things unless he knows, or he is using
another solaris than the one I know!
>Personally, I prefer log files to be 600 and owned by the logging process'
>PID. No use in giving a non-priv. user access to the logs on a system for
>no good reason.
hmmm' I know this is the linux way, but it has mostly sucked me on all the
linux machines
I approached. I like being able to tail -f the logs without doing a su
root. There are things to hide,
but there are things that are considered part of the service to users. I
only hide what should be hidden.
security isn't incompatible with availability.
>If it's a default install, you'll want to install the cluster patches,
>there were some SIGHUP issues and I think a large file issue with syslogd
>on Solaris 7.
It seems there'll always be an issue with syslogd on solaris!
more generally, given that many parts of solaris have been written by AT&T and
MicroSoft (yes, MicroSoft!), I don't see them getting out of the storm soon.
> There were some patchadd patches too- if you haven't done
>them, then doing the recommended security patches and whatever else you'll
>end up needing could be difficult.
I'm still surprised how keeping at a correct level is far easier with open
source
systems than with commercial ones! and they then talk about support...
>You'd probably get better and more detailed help someplace like
>sun-managers.
that's probably the right place.
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
