acasto
Apprentice
Joined: 06 Feb 2004
Posts: 236
Location: Durka-Durka-Stan
|
 Posted: Fri Mar 18, 2005 2:31 pm Post subject: chattr & lcap in a production environment |
 |
|
I was looking into the topic of using chattr and lcap to protect things such as log files, but however I had some questions regarding it use in a production envrionment. Particularly on web and mail servers. Is the extra security (accountability) even worth the hassle of log management? Is there any other way to secure the chattr command without using lcap? If not, what is the best way to manage logs with it?
I'm considering just setting up a master logging/backup server away from the DMZ which would just have large /home and /var directories mounted with the nodev, nosuid, and noexec options and all log files set to 'chattr +a' without anything like logrotate installed. Then I could just set a period, perhaps every 6 months, where I would boot to a livecd, tar/compress the partition, and start fresh.
Any ideas? suggestions?
- Adam
_________________
Leerrroooooyyyyyyyy JENKINS!!!!1111...................
"You know the Nazi's had pieces of flare.. that they made the Jews wear." |
|
Networking & Security
