Section 16.6 Paging the SysAdmin: Cracking in Progress | Real World Linux Security Prentice Hall Ptr Open Source Technology Series

16.6 Paging the SysAdmin: Cracking in Progress!

Although the methods just discussed are very quick and easy to set up, a whole lot of damage can be done by the time you check your e-mail the next day or possibly not until after that Monday 9 A.M. meeting! You can combine some of syslogd's features that are available in the /etc/syslog.conf file for immediate warnings of problems. The simplest feature is specifying account names in the action field so that the warning message will be written to any window that the named people are logged in on.

Typically, the SysAdmins' personal accounts as well as root would be listed. This is coarse and does not allow adding any intelligent filtering or warnings. You can be even coarser and specify an action of "*", which will cause the warning message to be displayed on everyone's logged in screen, including the cracker's. Although this might be appropriate for warnings regarding running out of disk space, this generally is not done.

Under Linux you can write specified message types to one or more named pipes where you can have your intelligent filtering program listening. This is done by prepending a "|" to the named pipe's full pathname without a separating space. The named pipe must exist and the listener must be running prior to syslogd starting.

The listener could arrange for you to be paged. Sky Tel pagers and most others have a feature where e-mail sent to a particular address gets routed to a pager. The e-mail address might be 1234567@skytel.com, where 1234567 would be the pager number.

This e-mail service is free from Sky Tel but must be activated before use. When activating the service you will need to specify which of the following fields get sent to your alphanumeric pager: from:, subject, and body. Selecting all of these fields will cause some messages to exceed the message length limit. Response time typically is about five minutes.

Some other paging companies may offer automated paging by having your modem dial into theirs and supplying a message or via e-mail.

Top