tailieunhanh - Practical UNIX & Internet Security phần 9

Lặp đi lặp lại thất bại ĐĂNG NHẬP VỀ Ai đó đã cố gắng để đăng nhập như là cung cấp một xấu [từ] mật khẩu nhiều hơn năm lần. Simpo PDF Merge và Chia Chưa đăng ký - khởi động lại khởi động lại bằng cách khởi động lại hệ thống với lệnh / etc / | Chapter 10 The UNIX System Log syslog Facility login REPEATED LOGIN FAILURES ON tty Somebody tried to log in as user and supplied a bad Simpc PDFMerge and SplitrUnregistered Version - http reboot rebooted by user user rebooted the system with the etc reboot command. su BAD SU user on tty Somebody tried to su to the superuser and did not supply the correct password. shutdown reboot halt or shutdown by user on tty user used the etc shutdown command to reboot halt or shut down the system. Other critical conditions that might be present might include messages about full filesystems device failures or network problems. Table Typical Info Messages Program Message Meaning date date set by user user changed the system date. login ROOT LOGIN tty FROM hostname root logged in. su user on tty user used the su command to become the superuser. getty tty bin getty was unable to open tty . NOTE For security reasons some information should never be logged. For example although you should log failed password attempts you should not log the password that was used in the failed attempt. Users frequently mistype their own passwords and logging these mistyped passwords would help a computer cracker break into a user s account. Some system administrators believe that the account name should also not be logged on failed login attempts - especially when the account typed by the user is nonexistent. The reason is that users occasionally type their passwords when they are prompted for their usernames. If invalid accounts are logged then it might be possible for an attacker to use those logs to infer people s passwords. You may want to insert syslog calls into your own programs to record information of importance. Third-party software also often has a capability to send log messages into the syslog if configured correctly. For example Xyplex terminal servers and Cisco routers both can log information to a network syslog daemon Usenet news and POP mail servers