Ics0020-task2 - Redigeerimiste ajalugu

Risto – 4. detsember 2018, kell 00:42

2018-12-04T00:42:36Z

2018-12-04T00:38:25Z

Tühistati muudatus 7847, mille tegi Risto (arutelu)

2018-12-04T00:37:12Z

Tühistati muudatus 7848, mille tegi Risto (arutelu)

2018-12-04T00:25:05Z

2018-12-04T00:24:53Z

2018-11-28T12:54:53Z

2018-11-28T12:53:44Z

2018-11-27T13:34:25Z

2018-11-27T13:34:02Z

2018-11-05T11:19:37Z

@@ 8. rida: / 8. rida: @@
 After the warning e-mail has been sent, any further e-mails for the user X must be suppressed for 2 hours (potential future warning e-mails for other users must *not* be suppressed).
-) If after the initial failure the user X manages to change his ID to user Y within 10 seconds with the /bin/su command, write a message to syslog which contains usernames X and Y.
+) If after the initial failure the user X manages to change his ID to user Y within 10 seconds with the /bin/su command, write a message to syslog which contains usernames X and Y. If e-mail alerting has been disabled for user X, producing a syslog message is not mandatory.
 Note that the SEC rule should be written for events that appear in ''/var/log/secure'' log file.

@@ 5. rida: / 5. rida: @@
 ) Detect an event where user X fails to change his ID to some other user Y with the /bin/su command.
-) If after the initial failure the user X manages to change his ID to user Y within 10 seconds with the /bin/su command, write a message to syslog which contains usernames X and Y.
+) If after the initial failure the user X does not manage to successfully change his ID to user Y within 10 seconds with the /bin/su command, send a warning e-mail to root@localhost which contains usernames X and Y.
 After the warning e-mail has been sent, any further e-mails for the user X must be suppressed for 2 hours (potential future warning e-mails for other users must *not* be suppressed).
 Note that the SEC rule should be written for events that appear in ''/var/log/secure'' log file.

@@ 9. rida: / 9. rida: @@
 ) If after the initial failure the user X does not manage to successfully change his ID to user Y within 10 seconds with the /bin/su command, send a warning e-mail to root@localhost which contains usernames X and Y.
 After the warning e-mail has been sent, any further e-mails and syslog messages for the user X must be suppressed for 2 hours (potential future warning e-mails and syslog messages for other users must *not* be suppressed).
 Note that the SEC rule should be written for events that appear in ''/var/log/secure'' log file.

@@ 9. rida: / 9. rida: @@
 ) If after the initial failure the user X does not manage to successfully change his ID to user Y within 10 seconds with the /bin/su command, send a warning e-mail to root@localhost which contains usernames X and Y.
 After the warning e-mail has been sent, any further e-mails and syslog messages for the user X must be suppressed for 2 hours (potential future warning e-mails and syslog messages for other users must *not* be suppressed).
 Note that the SEC rule should be written for events that appear in ''/var/log/secure'' log file.

@@ 5. rida: / 5. rida: @@
 ) Detect an event where user X fails to change his ID to some other user Y with the /bin/su command.
-) If after the initial failure the user X does not manage to successfully change his ID to user Y within 10 seconds with the /bin/su command, send a warning e-mail to root@localhost which contains usernames X and Y.
+) If after the initial failure the user X manages to change his ID to user Y within 10 seconds with the /bin/su command, write a message to syslog which contains usernames X and Y.
 After the warning e-mail has been sent, any further e-mails for the user X must be suppressed for 2 hours (potential future warning e-mails for other users must *not* be suppressed).
 Note that the SEC rule should be written for events that appear in ''/var/log/secure'' log file.

@@ 39. rida: / 39. rida: @@
 * consider the PairWithWindow rule for addressing the assignment,
-* when using PairWithWindow rule, make sure that the 'desc' and 'pattern2' fields have been set properly (e.g., consider the use of match variables in 'pattern2' field),
+* when using PairWithWindow rule, make sure that the 'desc' and 'pattern2' fields have been set properly (e.g., consider the use of match variables in both 'desc' and 'pattern2' field),
 * consider creating a context for suppressing repeated warning e-mails for a user.
 Apart from studying the examples from the course slides, have a look at the SEC man page (installed at the virtual machines or found at http://simple-evcorr.github.io/man.html).

@@ 10. rida: / 10. rida: @@
 ) If after the initial failure the user X manages to change his ID to user Y within 10 seconds with the /bin/su command, write a message to syslog which contains usernames X and Y.
-Note that the SEC rule should be written for events that appear in /var/log/secure log file.
+Note that the SEC rule should be written for events that appear in ''/var/log/secure'' log file.
 For example, if the following events are observed, the user '''student''' has managed to change his ID to '''student2''' three seconds after the initial failure at 12:08:59:

←Vanem redaktsioon		Redaktsioon: 27. november 2018, kell 13:34
10. rida:		10. rida:
	3) If after the initial failure the user X manages to change his ID to user Y within 10 seconds with the /bin/su command, write a message to syslog which contains usernames X and Y.		3) If after the initial failure the user X manages to change his ID to user Y within 10 seconds with the /bin/su command, write a message to syslog which contains usernames X and Y.

		+	Note that the SEC rule should be written for events that appear in /var/log/secure log file.
	For example, if the following events are observed, the user '''student''' has managed to change his ID to '''student2''' three seconds after the initial failure at 12:08:59:		For example, if the following events are observed, the user '''student''' has managed to change his ID to '''student2''' three seconds after the initial failure at 12:08:59: