Your message dated Thu, 30 Sep 2010 09:45:35 +0200
with message-id <20100930074535.gh31...@fishbowl.rw.madduck.net>
and subject line Re: Bug#598550: Perms on /etc/logcheck/*
has caused the Debian Bug report #598550,
regarding Perms on /etc/logcheck/*
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
598550: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598550
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: logcheck
Version: 1.2.69
Severity: wishlist

Hi.  Thanks for your efforts.

   --------------------------------
drwxr-s--- 2 root logcheck 1024 2009-11-17 11:32 cracking.d/
drwxr-s--- 2 root logcheck 1024 2009-11-17 11:32 cracking.ignore.d/
-rw-r--r-- 1 root logcheck  188 2008-12-09 02:37 header.txt
drwxr-s--- 2 root logcheck 1024 2010-06-23 12:21 ignore.d.paranoid/
drwxr-s--- 2 root logcheck 3072 2010-06-23 12:21 ignore.d.server/
drwxr-s--- 2 root logcheck 1024 2010-06-23 12:21 ignore.d.workstation/
-rw-r----- 1 root logcheck 2580 2010-07-01 22:08 logcheck.conf
-rw-r----- 1 root root     2581 2009-11-22 08:02 logcheck.conf~
-rw-r----- 1 root logcheck  131 2009-02-11 04:57 logcheck.logfiles
drwxr-s--- 2 root logcheck 1024 2009-11-17 11:32 violations.d/
drwxr-s--- 2 root logcheck 2048 2009-11-17 11:32 violations.ignore.d/
   --------------------------------

I'm primary user on this box:

   --------------------------------
(0) infidel /home/keeling_ id
uid=1000(keeling) gid=1000(keeling)
groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),44(video),46(plugdev),50(staff),108(netdev),1000(keeling)
   --------------------------------

As member of adm, I can read /etc/log/messages, et al.  However, I'm not
allowed to view /etc/logcheck/logcheck.conf, yet I'm the one logcheck is
sending reports to.  Uh, ...  Should I add keeling to group logcheck?
What's the downside?

Again, thanks.


-- System Information:
Debian Release: 5.0.6
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: i386 (x86_64)

Kernel: Linux 2.6.32-bpo.5-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_CA.UTF-8, LC_CTYPE=en_CA.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages logcheck depends on:
ii  adduser            3.110                 add and remove users and groups
ii  bsd-mailx [mailx]  8.1.2-0.20071201cvs-3 A simple mail user agent
ii  cron               3.0pl1-105            management of regular background p
ii  lockfile-progs     0.1.11-0.1            Programs for locking and unlocking
ii  logtail            1.2.69                Print log file lines that have not
ii  mailx              1:20071201-3          Transitional package for mailx ren
ii  postfix [mail-tran 2.5.5-1.1             High-performance mail transport ag
ii  rsyslog [system-lo 3.18.6-4              enhanced multi-threaded syslogd

Versions of packages logcheck recommends:
ii  logcheck-database             1.2.69     database of system log rules for t

Versions of packages logcheck suggests:
pn  syslog-summary                <none>     (no description available)

-- no debconf information



--- End Message ---
--- Begin Message ---
also sprach s. keeling <keel...@nucleus.com> [2010.09.30.0253 +0200]:
> As member of adm, I can read /etc/log/messages, et al.  However,
> I'm not allowed to view /etc/logcheck/logcheck.conf, yet I'm the
> one logcheck is sending reports to.  Uh, ...  Should I add keeling
> to group logcheck?

Yes, if you trust the user (yourself).

> What's the downside?

None, if you trust the user. If you don't trust the user, s/he could
probably manipulate the files in /var/lib/logcheck and hide log
messages that way.

But logcheck is not supposed to be used as a security tool anyway,
as it's way too unreliable for that.

-- 
 .''`.   martin f. krafft <madd...@d.o>      Related projects:
: :'  :  proud Debian developer               http://debiansystem.info
`. `'`   http://people.debian.org/~madduck    http://vcs-pkg.org
  `-  Debian - when you have better things to do than fixing systems



--- End Message ---
_______________________________________________
Logcheck-devel mailing list
Logcheck-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/mailman/listinfo/logcheck-devel

Reply via email to