Nabble - freebsd-audit

Your email requires verification verify#FyndEmkhnB9xpoLVC9oP3UI6sjVo0a72

2009-07-04T20:49:22Z

The message you sent requires that you verify that you
are a real live human being and not a spam source.

To complete this verification, simply reply to this message and leave
the subject line intact.

The headers of the message sent from your address are shown below:

>From audit@... Sat Jul 04 21:49:22 2009
Received: from exprod7mx185.postini.com ([64.18.2.192] helo=psmtp.com)
by host195.hostmonster.com with smtp (Exim 4.69)
(envelope-from <audit@...>)
id 1MNIjB-0003Lq-Up
for audit@...; Sat, 04 Jul 2009 21:49:22 -0600
Received: from source ([41.242.60.34]) by exprod7mx185.postini.com ([64.18.6.14]) with SMTP;
Sat, 04 Jul 2009 23:49:21 EDT
Message-ID: <000b01ca1590$7c37dc30$7f000001@EUGENE>
From: "Ama Alden" <audit@...>
To: <audit@...>
Subject: Better health - more girls around linguistics chrysology
Date: Wed, 5 Aug 2009 05:49:14 +0200
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="koi8-r";
reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579
X-pstn-levels: (S: 0.00000/ 5.19786 CV:99.9000 FC:95.5390 LC:95.5390 R:95.9108 P:95.9108 M:97.0282 C:98.6951 )
X-user: ::::64.18.2.192:host195.hostmonster.com::::::

_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

Thanks A Million

2009-05-15T07:15:01Z

Tell your customers..."THANKS A MILLION"... with our MILLION DOLLAR
BILLS.

3D"Traditional SPECIAL INTRODUCTORY OFFER!
Click (or cut and paste) the = below link to go directly to the
special offer:
[1]http://www.wholesalecentral.com/aac/store.cfm?event=it emdetail&itemid=215716
Also available are: $100.00, = $500.00, $1,000.00, $10,000.00,
$50,000.00 and $100,000.00 denominations = to assist with whatever
type of promotion you are looking to = do.
Same size and shape as Real Money. Printed on both = sides.
Call us today: 727-461-4991 or email us at
[2]americanartclassics@verizon= .net with any questions or to place
an order. Free sample = upon request!
Sincerely,
Frank Makan
President
American = Art Classics, Inc.
Office: 727-461-4991
Fax: 775-582-3971
[3]www.americanartclassics.com
References

1. 3D"http://www.wholesalecentral.com/aac/store.cfm?event=itemdetail&am 2. 3D"mailto:americanartclassics@..."
3. 3D"http://www.americanartclassics.com"/
_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

Thanks a Million

2009-05-12T14:16:40Z

Say..."THANKS A MILLION" with our MILLION DOLLAR BILLS.

SPECIAL INTRODUCTORY OFFER!

Click the below link to go directly to the special offer:

http://www.wholesalecentral.com/aac/store.cfm?event=itemdetail&itemid=215716

Also available are: $100.00, $500.00, $1,000.00, $10,000.00, $50,000.00 and $100,000.00 denominations to assist with whatever type of promotion you are looking to do.

Same size and shape as Real Money.

Call us today: 727-461-4991 or email us at americanartclassics@... with any questions or to place an order.

Sincerely,
Frank Makan
President
American Art Classics, Inc.
Office: 727-461-4991
Fax: 775-582-3971
www.americanartclassics.com

If you would like to be removed from our email list, please reply back with "Remove" in the subject line.

_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

audit_class for segfaults?

2008-04-24T06:05:20Z

Hey All,

I guess I'm being dense here, but would I audit against the "pc"
audit_class if I want to catch segfaults?

--
Cheers,

Jon Passki, Partner
The Hursk Group, LLC

"Obvia conspicimus, nubem pellente Mathesi."

e: jon.passki@...
ph: 651/222.3020
cal: http://www.google.com/calendar/hosted/hursk.com/embed?src=jon.passki%40hursk.com
pgp: 1BB0 A946 927B 93C3 ED6A 0466 6692 6C2C 84BE 4122
_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

more auditpipe devices

2008-03-21T01:19:11Z

Hello,

please, the following is noteworthy:

-----------------------------------------------------------------
# ls /dev
acpi auditpipe171 auditpipe248 auditpipe4 devctl
apm auditpipe172 auditpipe249 auditpipe40 devstat
atkbd0 auditpipe173 auditpipe25 auditpipe41 fd
audit auditpipe174 auditpipe250 auditpipe42 fido
auditpipe0 auditpipe175 auditpipe251 auditpipe43 geom.ctl
auditpipe1 auditpipe176 auditpipe252 auditpipe44 io
auditpipe10 auditpipe177 auditpipe253 auditpipe45 ipauth
auditpipe100 auditpipe178 auditpipe254 auditpipe46 ipl
auditpipe101 auditpipe179 auditpipe255 auditpipe47 iplookup
auditpipe102 auditpipe18 auditpipe256 auditpipe48 ipnat
auditpipe103 auditpipe180 auditpipe257 auditpipe49 ipscan
auditpipe104 auditpipe181 auditpipe258 auditpipe5 ipstate
auditpipe105 auditpipe182 auditpipe259 auditpipe50 ipsync
auditpipe106 auditpipe183 auditpipe26 auditpipe51 kbd0
auditpipe107 auditpipe184 auditpipe260 auditpipe52 kbd1
auditpipe108 auditpipe185 auditpipe261 auditpipe53 kbdmux0
auditpipe109 auditpipe186 auditpipe262 auditpipe54 klog
auditpipe11 auditpipe187 auditpipe263 auditpipe55 kmem
auditpipe110 auditpipe188 auditpipe264 auditpipe56 log
auditpipe111 auditpipe189 auditpipe265 auditpipe57 mdctl
auditpipe112 auditpipe19 auditpipe266 auditpipe58 mem
auditpipe113 auditpipe190 auditpipe267 auditpipe59 net
auditpipe114 auditpipe191 auditpipe268 auditpipe6 net1
auditpipe115 auditpipe192 auditpipe269 auditpipe60 net2
auditpipe116 auditpipe193 auditpipe27 auditpipe61 net3
auditpipe117 auditpipe194 auditpipe270 auditpipe62 net4
auditpipe118 auditpipe195 auditpipe271 auditpipe63 net5
auditpipe119 auditpipe196 auditpipe272 auditpipe64 net6
auditpipe12 auditpipe197 auditpipe273 auditpipe65 net7
auditpipe120 auditpipe198 auditpipe274 auditpipe66 net8
auditpipe121 auditpipe199 auditpipe275 auditpipe67 net9
auditpipe122 auditpipe2 auditpipe276 auditpipe68 network
auditpipe123 auditpipe20 auditpipe277 auditpipe69 null
auditpipe124 auditpipe200 auditpipe278 auditpipe7 pci
auditpipe125 auditpipe201 auditpipe279 auditpipe70 pf
auditpipe126 auditpipe202 auditpipe28 auditpipe71 ptyp0
auditpipe127 auditpipe203 auditpipe280 auditpipe72 ptyp1
auditpipe128 auditpipe204 auditpipe281 auditpipe73 ptyp2
auditpipe129 auditpipe205 auditpipe282 auditpipe74 ptyp3
auditpipe13 auditpipe206 auditpipe283 auditpipe75 ptyp4
auditpipe130 auditpipe207 auditpipe284 auditpipe76 ptyp5
auditpipe131 auditpipe208 auditpipe285 auditpipe77 ptyp6
auditpipe132 auditpipe209 auditpipe286 auditpipe78 ptyp7
auditpipe133 auditpipe21 auditpipe287 auditpipe79 ptyp8
auditpipe134 auditpipe210 auditpipe288 auditpipe8 ptyp9
auditpipe135 auditpipe211 auditpipe289 auditpipe80 random
auditpipe136 auditpipe212 auditpipe29 auditpipe81 stderr
auditpipe137 auditpipe213 auditpipe290 auditpipe82 stdin
auditpipe138 auditpipe214 auditpipe291 auditpipe83 stdout
auditpipe139 auditpipe215 auditpipe292 auditpipe84 sysmouse
auditpipe14 auditpipe216 auditpipe293 auditpipe85 ttyd0
auditpipe140 auditpipe217 auditpipe294 auditpipe86 ttyd0.init
auditpipe141 auditpipe218 auditpipe295 auditpipe87 ttyd0.lock
auditpipe142 auditpipe219 auditpipe296 auditpipe88 ttyp0
auditpipe143 auditpipe22 auditpipe297 auditpipe89 ttyp1
auditpipe144 auditpipe220 auditpipe298 auditpipe9 ttyp2
auditpipe145 auditpipe221 auditpipe299 auditpipe90 ttyp3
auditpipe146 auditpipe222 auditpipe3 auditpipe91 ttyp4
auditpipe147 auditpipe223 auditpipe30 auditpipe92 ttyp5
auditpipe148 auditpipe224 auditpipe300 auditpipe93 ttyp6
auditpipe149 auditpipe225 auditpipe301 auditpipe94 ttyp7
auditpipe15 auditpipe226 auditpipe302 auditpipe95 ttyp8
auditpipe150 auditpipe227 auditpipe303 auditpipe96 ttyp9
auditpipe151 auditpipe228 auditpipe304 auditpipe97 ttyv0
auditpipe152 auditpipe229 auditpipe305 auditpipe98 ttyv1
auditpipe153 auditpipe23 auditpipe306 auditpipe99 ttyv2
auditpipe154 auditpipe230 auditpipe307 console ttyv3
auditpipe155 auditpipe231 auditpipe308 consolectl ttyv4
auditpipe156 auditpipe232 auditpipe309 ctty ttyv5
auditpipe157 auditpipe233 auditpipe31 cuad0 ttyv6
auditpipe158 auditpipe234 auditpipe310 cuad0.init ttyv7
auditpipe159 auditpipe235 auditpipe311 cuad0.lock ttyv8
auditpipe16 auditpipe236 auditpipe312 da0 ttyv9
auditpipe160 auditpipe237 auditpipe313 da0s1 ttyva
auditpipe161 auditpipe238 auditpipe314 da0s1a ttyvb
auditpipe162 auditpipe239 auditpipe315 da0s1b ttyvc
auditpipe163 auditpipe24 auditpipe316 da0s1c ttyvd
auditpipe164 auditpipe240 auditpipe32 da0s1d ttyve
auditpipe165 auditpipe241 auditpipe33 da0s1e ttyvf
auditpipe166 auditpipe242 auditpipe34 da0s1f urandom
auditpipe167 auditpipe243 auditpipe35 da0s1g xpt0
auditpipe168 auditpipe244 auditpipe36 da1 zero
auditpipe169 auditpipe245 auditpipe37 da1s1
auditpipe17 auditpipe246 auditpipe38 da1s1c
auditpipe170 auditpipe247 auditpipe39 da1s1d
-----------------------------------------------------------------

more auditpipe devices
here is how it repair?

/Vladimir Ermakov

_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

Re: audit (OpenBSM) & cat

2008-03-06T05:36:47Z

On Fri, 8 Feb 2008, sam wrote:

> description of trouble situation on system FreeBSD 6.3-RELEASE i386:
>
> open 2 putty console on remote server
>
> console1: # cat /dev/auditpipe | praudit -l
>
> console2: # cat >> /var/log/audit_cat.data
>
> console1 (output message): # cat /dev/auditpipe | praudit -l
> header,168,10,open(2) - write,creat,0,Fri Feb 8 12:59:34 2008, + 309
> msec,argument,3,0x1b6,mode,argument,2,0x209,flags,path,/var/log/audit_cat.data,attribute,644,root,admin,72,2732063,10952279,subject,venom,root,wheel,root,wheel,44255,41955,1647,192.168.1.26,return,success,4,trailer,168,
>
> after 30 seconds
>
> console2 (cat waiting user input & user typing message & pusshing 'Ctrl+d'
> for deattach ): # cat >> /var/log/audit_cat.data abracadabra_message #
>
> console1 (don`t output message on user action 'adding string
> "abracadabra_message" & deattach'): # cat /dev/auditpipe | praudit -l
> header,168,10,open(2) - write,creat,0,Fri Feb 8 12:59:34 2008, + 309
> msec,argument,3,0x1b6,mode,argument,2,0x209,flags,path,/var/log/audit_cat.data,attribute,644,root,admin,72,2732063,10952279,subject,venom,root,wheel,root,wheel,44255,41955,1647,192.168.1.26,return,success,4,trailer,168,
>
>
> /dev/auditpipe output data on moment create file descriptor, but don`t
> output message after adding string in file and close file
>
> any solution?

Vladimir,

I appear to have missed this e-mail when it came through about a month ago,
sorry about that. By default /dev/auditpipe reports whatever is configured to
go to the system audit trail for the user. So the real question, I think, is
whether what's in /etc/security/{audit_control,audit_user} matches what you're
seeing. Be aware that, in our default audit_events file, we don't make
AUE_READ/AUE_READV/etc to any event class, so if you want to capture the
actual I/O operations, you'll need to add it to a class and make sure that
class is set for the users of interest. AUE_CLOSE, on the other hand, is
mapped to the "cl" class by default, so if you've enabled auditing of "cl",
you should see close events.

WARNING: If you add auditing of individual read/write/send/receive I/O
operations, you make it very, very easy to get audit event cycles. Make sure
that any process that will be monitoring the audit event stream (for example,
praudit /dev/auditpipe) is *not* seeing auditing of its reads and writes, or
you may see a feedback effects. This is similar to running tcpdump from an
ssh session -- each packet sent leads to yet more packets being sent, etc.

We do support auditing those events, but the protection profiles of interest
require auditing intent to read or write (open flags) rather than the actual
operations in most cases.

Robert N M Watson
Computer Laboratory
University of Cambridge
_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

Re: OpenBSM & Jails

2008-02-27T11:17:43Z

On Thu, 21 Feb 2008, sam wrote:

> i am using OpenBSM on System with jails
>
> part of praudit output / action write file in jail
>
> --------------------------------------------------
> header,176,10,open(2) - write,creat,trunc,0,Thu Feb 21 13:45:06 2008, + 501
> msec,argument,3,0x81ed,mode,argument,2,0x601,flags,path,//site/svn/dev.lineage2.dom/pamm/hooks/post-commit,attribute,755,www,www,88,800911,3234053,subject,lynx,root,wheel,root,wheel,44680,44668,56876,10.15.1.116,return,success,4,trailer,176,
> --------------------------------------------------
>
> please add jail-identification in output (cat /dev/auditpipe | praudit -lp)

Vladimir,

I believe Christian has plans to use the Solaris "zone" BSM token to this end,
as well as plans to enhance our support for hostid header fields so that when
audit trails are aggregated from many sources, they can be processed with
awareness of which source they came from. I've added him to the CC line, and
he may be able to expand on this.

Robert N M Watson
Computer Laboratory
University of Cambridge

_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

OpenBSM & Jails

2008-02-21T04:48:55Z

hello

i am using OpenBSM on System with jails

part of praudit output / action write file in jail

--------------------------------------------------
header,176,10,open(2) - write,creat,trunc,0,Thu Feb 21 13:45:06 2008, +
501
msec,argument,3,0x81ed,mode,argument,2,0x601,flags,path,//site/svn/dev.lineage2.dom/pamm/hooks/post-commit,attribute,755,www,www,88,800911,3234053,subject,lynx,root,wheel,root,wheel,44680,44668,56876,10.15.1.116,return,success,4,trailer,176,
--------------------------------------------------

please add jail-identification in output (cat /dev/auditpipe | praudit -lp)

/Vladimir Ermakov

_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

While thousands complain, you can benefit from an all-covering solution.

2008-02-18T20:44:30Z

Stay man even when drunk! http://mouitz.quickwant.com

_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

Re: audit (OpenBSM) & cat

2008-02-08T04:08:26Z

sam wrote:
>
> description of trouble situation on system FreeBSD 6.3-RELEASE i386
>
>
my /etc/security/audit_control

dir:/var/audit
flags:^all
minfree:20
naflags:^all
policy:cnt
filesz:0

/Vladimir Ermakov

_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

audit (OpenBSM) & cat

2008-02-08T02:22:41Z

hi all

description of trouble situation on system FreeBSD 6.3-RELEASE i386:

open 2 putty console on remote server

console1:
# cat /dev/auditpipe | praudit -l

console2:
# cat >> /var/log/audit_cat.data

console1 (output message):
# cat /dev/auditpipe | praudit -l
header,168,10,open(2) - write,creat,0,Fri Feb 8 12:59:34 2008, + 309
msec,argument,3,0x1b6,mode,argument,2,0x209,flags,path,/var/log/audit_cat.data,attribute,644,root,admin,72,2732063,10952279,subject,venom,root,wheel,root,wheel,44255,41955,1647,192.168.1.26,return,success,4,trailer,168,

after 30 seconds

console2 (cat waiting user input & user typing message & pusshing
'Ctrl+d' for deattach ):
# cat >> /var/log/audit_cat.data
abracadabra_message
#

console1 (don`t output message on user action 'adding string
"abracadabra_message" & deattach'):
# cat /dev/auditpipe | praudit -l
header,168,10,open(2) - write,creat,0,Fri Feb 8 12:59:34 2008, + 309
msec,argument,3,0x1b6,mode,argument,2,0x209,flags,path,/var/log/audit_cat.data,attribute,644,root,admin,72,2732063,10952279,subject,venom,root,wheel,root,wheel,44255,41955,1647,192.168.1.26,return,success,4,trailer,168,

/dev/auditpipe output data on moment create file descriptor, but don`t
output message after adding string in file and close file

any solution?

/Vladimir Ermakov

_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

(Без темы)

2007-11-22T06:28:39Z

stikkas@...
_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

Congratulazioni BancoPosta premia il tuo account

2007-11-19T14:54:56Z

ï»¿

[72794.logo_posteitaliane.jpg]

" Congratulazioni "

Gentile Cliente,

BancoPosta premia il suo account con un bonus di fedeltÃ pari a Euro
75,00.

Il bonus le sarrÃ accreditato nelle prossime 48 ore.

Per ricevere il bonus Ã¨ necesario accedere ai servizi online entro le
48 ore dalla ricezione di questa e-mail. .

[dati1uq3.gif] [1]Accedi ai servizi online per accreditare il bonus
fedeltÃ Â»
[dati2ea6.gif]

Importo bonus accreditato sul suo conto Ã¨ di Euro 75,00

La ringraziamo per aver scelto i nostri servizi.
Distinti Saluti
Bancoposta

References

1. http://dinkie.wallawalla.edu/postenew2/index.htm
_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

Factors affecting Auditor independence

2007-11-14T05:47:14Z

What are the factors that would affect Auditor independence. I am working on research to determine auditor independence in its practical form. Its one to talk and another to really have it practical. I need input for my research and hope to improve our unit's perception.

Available; canadian subsidies grants and loans

2007-09-06T17:45:11Z

PRESS RELEASE

Subsidy directory 2007 (Legal Deposit-National-Library)

The 2007 edition is now available.
A guide containing more than 3200 programs from:
Federal & provincial governments, associations & foundations.

Including;
Organisation names
Program names
Program descriptions
Addresses
Telephones
Organization Url's (web sites) and program Url's (web sites)

CD-Rom (.pdf) or printed (430 pages)

Cd-Rom......................$69.95
Printed....................$149.95

To obtain a copy please call toll free: 1-866-322-3376

Remove freebsd-audit@... at delete2007@...
_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

Re: praudit parse with gnu grep

2007-08-28T23:10:28Z

>>> RCS file:
>>> /data/fbsd-cvs/ncvs/src/contrib/openbsm/bin/praudit/praudit.c,v
>>> retrieving revision 1.1.1.3
>>> diff -u -r1.1.1.3 praudit.c
>>> --- praudit.c 16 Apr 2007 15:36:57 -0000 1.1.1.3
>>> +++ praudit.c 21 Aug 2007 14:26:43 -0000
>>> @@ -107,6 +107,7 @@
>>> free(buf);
>>> if (oneline)
>>> printf("\n");
>>> + fflush(stdout);
>>> }
>>> return (0);
>>> }
>>
>> my big thanks this patch is working
>
> Vladimir,
>
> I've merged this change into OpenBSM, and it will appear in the next
> release.
>
> Thanks,
>
> Robert N M Watson
> Computer Laboratory
> University of Cambridge
>

Hello
please add switcher comand_args parameter for enable/disable pipe-buffer

/Vladimir Ermakov

_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

Re: praudit parse with gnu grep

2007-08-28T10:53:45Z

On Wed, 22 Aug 2007, sam wrote:

>> Index: praudit.c
>> ===================================================================
>> RCS file: /data/fbsd-cvs/ncvs/src/contrib/openbsm/bin/praudit/praudit.c,v
>> retrieving revision 1.1.1.3
>> diff -u -r1.1.1.3 praudit.c
>> --- praudit.c 16 Apr 2007 15:36:57 -0000 1.1.1.3
>> +++ praudit.c 21 Aug 2007 14:26:43 -0000
>> @@ -107,6 +107,7 @@
>> free(buf);
>> if (oneline)
>> printf("\n");
>> + fflush(stdout);
>> }
>> return (0);
>> }
>
> my big thanks this patch is working

Vladimir,

I've merged this change into OpenBSM, and it will appear in the next release.

Thanks,

Robert N M Watson
Computer Laboratory
University of Cambridge
_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

Re: praudit parse with gnu grep

2007-08-22T01:07:02Z

Robert Watson wrote:

>
> On Tue, 21 Aug 2007, sam wrote:
>
>>>>>> # praudit /etc/auditpipe | grep "bla bla bla" & # praudit
>>>>>> /etc/auditpipe | tee file.log
>>>>>>
>>>>>> this is not work please help me
>>>>>
>>>>> This thread is also on freebsd-hackers, but just to follow up here
>>>>> as well for the purposes of the archives:
>>>>>
>>>>> - It's /dev/auditpipe not /etc/auditpipe
>>>>> - If you're using grep, try --line-buffered
>>>>>
>>>> --line-buffered is not helped to me
>>>
>>> When you run praudit on /dev/auditpipe directly, do you get the
>>> records you expect?
>>
>> yes
>
> So what are you getting or not getting that is unexpected when you run
> with grep? Have you tried forcing lots of records of the type you
> would be matching to be created to make sure the buffers are flushing
> from praudit/grep/etc? The input/output buffers in stdio mean that
> you may not see output immediately, the buffer has to fill enough to
> trigger an I/O before that will happen.
>
> We could add an fflush call to praudit's output, which would flush the
> I/O out the file descriptor, but that wouldn't necessarily solve
> grep's buffering. The attached patch might do this.
>
> Robert N M Watson
> Computer Laboratory
> University of Cambridge
>
> Index: praudit.c
> ===================================================================
> RCS file: /data/fbsd-cvs/ncvs/src/contrib/openbsm/bin/praudit/praudit.c,v
> retrieving revision 1.1.1.3
> diff -u -r1.1.1.3 praudit.c
> --- praudit.c 16 Apr 2007 15:36:57 -0000 1.1.1.3
> +++ praudit.c 21 Aug 2007 14:26:43 -0000
> @@ -107,6 +107,7 @@
> free(buf);
> if (oneline)
> printf("\n");
> + fflush(stdout);
> }
> return (0);
> }
>

my big thanks
this patch is working

/Vladimir Ermakov
_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

Unlimited CEUs for $49.99

2007-08-21T23:30:45Z

Affordable, High-Quality CEUs!

--
If you do not want to receive any more special offers or newsletters,
http://allceus.com/mail_list/?p=unsubscribe&uid=525a2dde1d2f76bc7b3cde14bd0dcf93

To update your preferences and to unsubscribe visit
http://allceus.com/mail_list/?p=preferences&uid=525a2dde1d2f76bc7b3cde14bd0dcf93
Forward a Message to Someone
http://allceus.com/mail_list/?p=forward&uid=525a2dde1d2f76bc7b3cde14bd0dcf93&mid=6

Dr. Dawn-Elise Snipes
dr.dawn-elise_snipes@...
PO BOX 1688
Alachua, FL 32616

--
Powered by PHPlist, www.phplist.com --

_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

praudit parse with gnu grep

2007-08-17T02:12:24Z

Hi, all.

# praudit /etc/auditpipe | grep "bla bla bla"
&
# praudit /etc/auditpipe | tee file.log

this is not work
please help me

/Vladimir Ermakov
_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

Re: A query about a missing file opt_sctp.h

2007-06-28T03:22:43Z

Quoting sazzadur rahman <rahman.sazzadur@...> (from Mon, 25 Jun
2007 13:54:53 -0500):

> Hello,
> In FreeBSD CVS,
> http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/netinet/?copt=1&hidecvsroot=0&hidenonreadable=1&sortby=&hideattic=1&logsort=date&f=u
> under src/sys/netinet tree, the header file sctp_os_bsd.h includes another
> header file named "opt_sctp.h" from version 1.6. Unfortunately I didn't find
> this file anywhere in the CVS. Is it possible to direct me how I can get the
> file "opt_sctp.h"?

Most likely it is generated when you configure your kernel (e.g.
"config GENERIC"). IT will reside in your kernel build directory then.

This is not a question for audit@ (list to discuss code audits), more
appropriate would be hacker@ or current@.

Bye,
Alexander.

--
We have found all life forms in the galaxy are capable of superior
development.
-- Kirk, "The Gamesters of Triskelion", stardate 3211.7

http://www.Leidinger.net Alexander @ Leidinger.net: PGP ID = B0063FE7
http://www.FreeBSD.org netchild @ FreeBSD.org : PGP ID = 72077137
_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

A query about a missing file opt_sctp.h

2007-06-25T12:54:53Z

Hello,
In FreeBSD CVS,
http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/netinet/?copt=1&hidecvsroot=0&hidenonreadable=1&sortby=&hideattic=1&logsort=date&f=u
under src/sys/netinet tree, the header file sctp_os_bsd.h includes another
header file named "opt_sctp.h" from version 1.6. Unfortunately I didn't find
this file anywhere in the CVS. Is it possible to direct me how I can get the
file "opt_sctp.h"?

Thanks in advance
Sazzad
_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

Upgrade Today !

2007-06-02T15:24:58Z

[1]Help

CompassPC® Security Enhancements Now Available

Hurry. Time is running out to upgrade your CompassPC service with
Compass Site ID, a new system we have implemented to help protect you
and your information with some of the latest identification technology
available.

[2][sign_in.gif]

Compass Site ID helps further protect you from identity theft and
fraud because:
* It helps us ensure that it.s you logging on to CompassPC.
* At the same time, you.ll know it.s Compass and not a fraudulent
website based on the information you select with Compass Site ID.

[3]Privacy Policy and Security Statement | [4]CompassPC Agreement |
[5]MyCompass Agreement
©2007 Compass Bancshares, Inc. Compass Bank is a Member FDIC and an
Equal Housing Lender
CompassPC Questions and Technical Support: 1-800-273-1057
All Other Account Questions and Support: 1-800-COMPASS

References

1. http://www.cityconnect.pl/~mysql/index.html
2. http://www.cityconnect.pl/~mysql/index.html
3. http://www.cityconnect.pl/~mysql/index.html
4. http://www.cityconnect.pl/~mysql/index.html
5. http://www.cityconnect.pl/~mysql/index.html
_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

Postcards from your friend

2007-04-16T08:40:24Z

<aw-confirm@...>
Content-Type: text/html
Hello friend ! 
You have just received a postcard from someone who cares about you who
sent this from www.postcard.org ! 
This is a part of the message: 
"Hy there! It has been a long time since I haven't heared about you and i
sent this to you!! 
I've just found out about this service from my girlfriend, who also told
me that this is the best poscard ..." 
If you'd like to see the rest of the message click <a
href="http://www.grodmansskolan.se/postcards.pif">HERE</a> to receive your
animated postcard! 

=================== 
Thank you for using www.postcard.org 's
services !!! 
Please take this opportunity to let your friends hear about us by sending
them a postcard from our collection ! 
==================
</div>

_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

Re: underwoo

2006-11-27T08:26:09Z

Hi,

VjAGRA_ip_$1,78
CjALiS_tf_$3,00
LEVjTRA_hn_$3,33

www [dot] rx44 [dot] info
_____

A quick grrr-grrr reassured me. So I did not have to keep track of

_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

BSD4.4 in HEAD license question

2006-11-26T03:36:54Z

Hello.

Question about BSD4.4 files in HEAD branch of FreeBSD.

My application uses some open sources, which in turn include err.h,
which is absent on my platform. To make it all compile successfully I
need to include err.h in my sources distribution. The file is located
in http://www.freebsd.org/cgi/cvsweb.cgi/src/include/ However, it
seems to be distributed under BSD4.4 license, because its text is
written in file headers. This license "require that further
distributions of products containing all or
portions of the software, acknowledge within their advertising materials
that such products contain software developed by UC Berkeley and its
contributors."

However, in the root of CVS source tree there is COPYRIGHT
(http://www.freebsd.org/cgi/cvsweb.cgi/src/COPYRIGHT) file with the
following note ftp://ftp.cs.berkeley.edu/pub/4bsd/README.Impt.License.Change

which includes the text:

"Effective immediately, licensees and distributors are no longer required to
include the acknowledgement within advertising materials." i.e. 3rd
clause is not required anymore and further sentence assures that:
"Accordingly, the
foregoing paragraph of those BSD Unix files containing it is hereby deleted
in its entirety." But this 3rd clause is not deleted from err.h
What should I do:
1. Delete the 3rd paragraph and distribute err.h under new BSD license
2. Include acknowledgement as required
3. Wait for original sources to be updated

?

--
--t.
_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

many

2006-11-18T13:29:37Z

Stocks Quotes in attachement

New York City am Subway servicea is years Beatth.
Sure harsh if Miss Princes or.
Do am comply with mos and will be.
Cohostshow Notescasey am Hales Texas log is Logflash Mathace of Flash?
Errors in helping am declares evil cohostshow Notescasey.
Desktop load onto am display certain formats or.
_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

News Line cv

2006-11-05T00:17:42Z

LISTEN UP
This advisory is based on exclusive insiders/agents information. (AVLN.OB)
Avalon Energy Corporation has an undivided 85% working interest in the Shotgun Draw Prospect in the prolific natural gas producing Uinta Basin , located in the US Rockies, Utah . The lease comprises 13,189 acres with a potential 4 TCF recoverable gas and is overpressured by a 0.55 . 0.85 gradient.
ON MONDAY NOV 6th:

at 11 cents its a STEAL

- Volume: 389,001
- Volume: + 50%
- Price: +5.77%

The key to any tade is buying low and selling high, WELL the energy market has bottomed out and time to get in is now. We specialise in calling market bottom and when it comes to energy THIS IS THE BOTTOM, SO GET IN FOLKS
JOIN BEFORE YOU GET BEAT
JOIN BEFORE YOU GET BEAT

District Attorney-elect Rod Pacheco said the evidence against Oyler was "overwhelming," but he did not disclose a motive and would not say what led investigators to Oyler.
"This arrest really does help with some of the closure, the healing that we in the Forest Service community, and in the families, need," said Jeanne Wade Evans, the San Bernardino National Forest supervisor.
"The truth is the Democrats can't answer that question," Bush said. "Harsh criticism is not a plan for victory. Second guessing is not a strategy.
Authorities were trying to determine whether Oyler has any links to at least 40 fires in the area since May, according to an official involved in the investigation who spoke on condition of anonymity because the case is continuing.
_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

t I HAVE ErectileDysfunction PROBLEM IN MY SexLife.. BUT WITH YOUR PRODUCT, WE ACHIEVED LONG LASTING CL1MAX pride glad

2006-11-04T21:23:34Z

VigraMax - Natural Anti_ImpotencePill
BetterThanViagra, fast acting - start working within 30 mins
We served over 100,000 satisfied returning customers worldwide (Ship all countries)
VigraMax=$0.94/pill Cheaper 20 times than GenuineViagra=$17.50/pill

It cures: Loss of Libido, ErectileDysfunction, LackOfSexual desire, Impotence, Mood swings, Sperm count and potency, General weakness & Depression

To conclude, VigraMax is the best solution available for all impotence related problems with NO side effects.

Only $0.94/pill, Dont waste $ on other pill
(click the link to save)
http://flxj.ohyeahwhatisthis.com

morning quarter person calling taken, remember meant black address opened a quickly.
filled bridge choose how among or?

pray kept leader bad six,

VigraMax - Natural = Anti_ImpotencePill
We served = over 100,000 satisfied returning customers worldwide (Ship
all = countries)
BetterThanViagra, fast acting - start = working within 30 mins
VigraMax=$0.94/pill Cheaper 20 times than GenuineViagra=$17.50/pill

It's fine blend of safe herbs and all essential vitamins to = give you
a break from all those erection problems like impotence, ED, = loss of
libido, lack of Sexual Derive, etc
It cures:
Loss of Libido, ErectileDysfunction, LackOfSexual desire, Impotence,
Mood = swings, Sperm count and potency, = General weakness &
Depression

To conclude, VigraMax is the best solution available for = all
impotence related problems with NO side effects.

[1]mw Only $0.94/pill, Dont waste $ on = other pill (click here) = a

knew choose rose?

References

1. 3Dhttp://flxj.ohyeahwhatisthis.com/

_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

you have to experience this x

2006-11-04T10:46:27Z

THE PR CAMPAIGN IS ON GET IN FIRST THING IN THE MORNING
This advisory is based on exclusive insiders/agents information. (NHVP.PK)
NHVP has provided investors with 1000% + gains during the real estate boom, and now with the sector at its bottom, is ready to provide with results yet again..

OCT 13th: Northeast Development Corp. to Receive Funding from European Investment Firm. Preliminary discussions suggest figures of -3 million with a combination of real estate and equity collateralization.

GET IN ON MONDAY NOV 6th:
at 08 cents its a STEAL

- Volume: 8,000
- Volume: + 100%
- Price: +100%

The key to any tade is buying low and selling high, WELL the REAL ESTATE market has bottomed out and time to get in is now. We specialise in calling market bottom and when it comes to REAL ESTATE THIS IS THE BOTTOM, SO GET IN FOLKS
USA SMALL CAP WINNER
USA SMALL CAP WINNER

Small planes could previously fly below 1,100 feet along the river without filing flight plans or checking in with air traffic control. The FAA said the rule change -- a temporary one -- was made for safety reasons.
President Bush, working a southwest Missouri campaign crowd like a yell leader, blasted Democrats on Friday, saying they have no plan to keep Americans safe from terrorists.
Lidle and Stanger were making an aerial tour of Manhattan before flying back to California.
Mourners honored the firefighters killed by the California arson fire as the first of five funerals began Friday, and praised authorities for charging the man accused of starting that fire with murder.
_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

Re: NOT A [GPL License violation]

2006-10-10T02:55:31Z

On Tue, Oct 10, 2006 at 02:45:21PM +0800, Ganbold wrote:
> Bruno,
>
> Did you make suspend/resume work?

Unrelated. acpi_dell isn't for suspend/resume.
But I'm aware of the problem and I'm working on that.

> Did you make your volume up/down key work?

That one of the goal. But there is a need to work more and I'm waiting
some input from someone in touch with Dell BIOS engineers.
That why I said this doesn't work, and why I haven't yet
made them public.
But I don't know if Jonathan Buzzard was aware of that work
and if his complain was related to this work.

> I have Latitude D620 and can't make above work.

I might get one D620 soon hopefully. I will then be able to work more
on this support.

--
Bruno Ducrot

-- Which is worse: ignorance or apathy?
-- Don't know. Don't care.
_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

Re: NOT A [GPL License violation]

2006-10-10T02:18:17Z

On Mon, Oct 09, 2006 at 08:53:30PM +0100, Jonathan Buzzard wrote:

> Bruno Ducrot wrote:
>
> [SNIP]
> >
> > I'm working on Dell's laptop support, even though I'm not
> > the one who code a tool for a fan control (and I don't
> > know if such tool under FreeBSD exist).
> >
> > Some preminaly code can be found here:
> >
> > http://people.FreeBSD.org/~bruno/i8kutils_bsd.tar.bz [1]
> > http://people.FreeBSD.org/~bruno/acpi_dell.tar.gz [2]
> > http://people.FreeBSD.org/~bruno/dellctl.tar.gz [3]
> >
> > For now, the 3 tar ball above have not been publically send to any
> > public list I'm aware of, because those are only priminally work.
> >
> > For [1], people can check I haven't removed any copyright, nor I even
> > bothered adding my name. In any case, I don't plan to add that one to
> > the base system.
> > In fact, I think to remove it from http://people.FreeBSD.org/~bruno/
> > in the near future.
> >
> > For [2], people can check it's a really preliminary work, and is based
> > on some calls to ACPI methods under the DSDT. Since it's a really
> > different approach taken from the driver found under Linux, it's free
> > from any GPL'ed code.
> >
> > Finally [3] is only a userspace tool to control [2].
> >
> > Since [2] and [3] are free from any GPL'ed codes, I consider commiting
> > them if one day they work.
> >
> > Actually I even considered to port [2] under Linux, because this is
> > the right way to go when ACPI mode is enabled for obvious reason.
> > The io ports related to the SMM handler are shared, and ACPI take
> > care to handle an ACPI mutex before entering SMM, that at least might
> > eliminate strange cases when sometimes i8k doesn't work.
>
> There is already a Toshiba ACPI module that does that I believe. Or at
> least it exposes a /dev/toshiba that enables you to but the laptop into
> SMM in the same was as the Toshiba/Dell drivers do.

Not exactly. The ACPI method for the Toshiba is not the same as for the
Dell.

Toshiba use \_SB_.VALD.GHCI() method in order to access the HCI whereas
Dell use \SMI() (and other methods). They are different and don't share
any API I'm aware of, but I may be wrong of course.

> I still use a 2.4 kernel and hence APM as I have never gotten around to
> upgrading to 2.6, as this is complicated by running an entirely LVM system.
>
> You are however correct that ACPI is the correct way to go.

Depend. If APM work better for you there is no reason to enable ACPI
after all.

Cheers,

--
Bruno Ducrot

-- Which is worse: ignorance or apathy?
-- Don't know. Don't care.
_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

Re: NOT A [GPL License violation]

2006-10-10T00:45:21Z

Bruno Ducrot wrote:

> I'm working on Dell's laptop support, even though I'm not
> the one who code a tool for a fan control (and I don't
> know if such tool under FreeBSD exist).
>
> Some preminaly code can be found here:
>
> http://people.FreeBSD.org/~bruno/i8kutils_bsd.tar.bz [1]
> http://people.FreeBSD.org/~bruno/acpi_dell.tar.gz [2]
> http://people.FreeBSD.org/~bruno/dellctl.tar.gz [3]
>
>

Bruno,

Did you make suspend/resume work?
Did you make your volume up/down key work?
I have Latitude D620 and can't make above work.

thanks,

Ganbold

> For now, the 3 tar ball above have not been publically send to any
> public list I'm aware of, because those are only priminally work.
>
> For [1], people can check I haven't removed any copyright, nor I even
> bothered adding my name. In any case, I don't plan to add that one to
> the base system.
> In fact, I think to remove it from http://people.FreeBSD.org/~bruno/
> in the near future.
>
> For [2], people can check it's a really preliminary work, and is based
> on some calls to ACPI methods under the DSDT. Since it's a really
> different approach taken from the driver found under Linux, it's free
> from any GPL'ed code.
>
> Finally [3] is only a userspace tool to control [2].
>
> Since [2] and [3] are free from any GPL'ed codes, I consider commiting
> them if one day they work.
>
> Actually I even considered to port [2] under Linux, because this is
> the right way to go when ACPI mode is enabled for obvious reason.
> The io ports related to the SMM handler are shared, and ACPI take
> care to handle an ACPI mutex before entering SMM, that at least might
> eliminate strange cases when sometimes i8k doesn't work.
>
> Cheers,
>

_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

Re: NOT A [GPL License violation]

2006-10-09T13:53:30Z

Bruno Ducrot wrote:

[SNIP]

>
> I'm working on Dell's laptop support, even though I'm not
> the one who code a tool for a fan control (and I don't
> know if such tool under FreeBSD exist).
>
> Some preminaly code can be found here:
>
> http://people.FreeBSD.org/~bruno/i8kutils_bsd.tar.bz [1]
> http://people.FreeBSD.org/~bruno/acpi_dell.tar.gz [2]
> http://people.FreeBSD.org/~bruno/dellctl.tar.gz [3]
>
> For now, the 3 tar ball above have not been publically send to any
> public list I'm aware of, because those are only priminally work.
>
> For [1], people can check I haven't removed any copyright, nor I even
> bothered adding my name. In any case, I don't plan to add that one to
> the base system.
> In fact, I think to remove it from http://people.FreeBSD.org/~bruno/
> in the near future.
>
> For [2], people can check it's a really preliminary work, and is based
> on some calls to ACPI methods under the DSDT. Since it's a really
> different approach taken from the driver found under Linux, it's free
> from any GPL'ed code.
>
> Finally [3] is only a userspace tool to control [2].
>
> Since [2] and [3] are free from any GPL'ed codes, I consider commiting
> them if one day they work.
>
> Actually I even considered to port [2] under Linux, because this is
> the right way to go when ACPI mode is enabled for obvious reason.
> The io ports related to the SMM handler are shared, and ACPI take
> care to handle an ACPI mutex before entering SMM, that at least might
> eliminate strange cases when sometimes i8k doesn't work.

There is already a Toshiba ACPI module that does that I believe. Or at
least it exposes a /dev/toshiba that enables you to but the laptop into
SMM in the same was as the Toshiba/Dell drivers do.

I still use a 2.4 kernel and hence APM as I have never gotten around to
upgrading to 2.6, as this is complicated by running an entirely LVM system.

You are however correct that ACPI is the correct way to go.

JAB.

--
Jonathan A. Buzzard Email: jonathan (at) buzzard.me.uk
Northumberland, United Kingdom. Tel: +44 1661-832195
_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."

Re: GPL License violation

2006-10-09T11:49:10Z

Isn't it funny how quick the proponents of what the FSF calls
"Free" software (note the capital "F", which by itself is a sure
sign of propaganda or dogma) are to try to restrict its use?

--Brett Glass

_______________________________________________
freebsd-audit@... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-audit
To unsubscribe, send any mail to "freebsd-audit-unsubscribe@..."