Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Software Your Rights Online

EFF's Logfinder 169

Posted by CmdrTaco from the watching-the-watchers dept.
clonebarkins writes "EFF has just released a new software tool called "logfinder" to help server admins find (and delete) unnecessary log files on their boxen. "By finding unwanted log files, logfinder informs system administrators when their servers are collecting personal data and gives them the opportunity to turn logging off if it isn't gathering information necessary for administering the system.""
This discussion has been archived. No new comments can be posted.

EFF's Logfinder More

EFF's Logfinder

Comments Filter:

  • I just made one, too (Score:4, Funny)

    by Anonymous Coward on Wednesday February 09, 2005 @10:36AM (#11618234)
    locate log
  • it also gives intruders/managers/employees/anyone with something to hide the ability to search and remove incriminating logs. Thanks EFF!

    • Re:Thanks EFF! (Score:2, Insightful)

      by Anonymous Coward
      Pair it with TOR [eff.org] and hacking becomes untraceable! 2005 is going to be a great year.
    • it also gives intruders/managers/employees/anyone with something to hide the ability to search and remove incriminating logs. Thanks EFF!

      don't give them root/admin access - i.e. don't give them permission to delete the logs.

    • Re:Thanks EFF! (Score:5, Insightful)

      by innerweb ( 721995 ) on Wednesday February 09, 2005 @11:11AM (#11618634)
      As is always, that which helps to protect the innocent can be used to protect the *evil*. The problem is the innocent do not know what is being done, and the *evil* are studying and learning to use and abuse. Nothing new there.

      InnerWeb

      • As is always, that which helps to protect the innocent can be used to protect the *evil*."

        Yeah, sure. You guys are so paranoid, next you're going to be telling me that the flesh-reanimation technology I've been working on can be used for evil too.

        • Yeah, sure. You guys are so paranoid, next you're going to be telling me that the flesh-reanimation technology I've been working on can be used for evil too.

          Sure can. My wife just used your invention to bring back to life her dead mother. That is nothing but pure evil, believe you me.

    • So does rm...
    • are you saying you don't stream your logs across the network/frame relay to another site where they are permanently stored and monitored by unrelated personnel? If you have seperate admin teams, make them in charge of other people's logs (and vice-versa). It's like a checks and balances system.
    • As some other comments already beat me to saying, the people with something to hide are already hiding it.
  • Now the question is, can this tool be used for evil? As in finding all the logs on the system and sending them to some script-kiddie?

    • Re:neat (Score:5, Funny)

      by e2d2 ( 115622 ) on Wednesday February 09, 2005 @11:25AM (#11618805)
      Any tool could probably be used for evil. For instance I have a calendar on my wall. If I took it down and rolled it up, I could probably beat you half way to death with enough strong blows.

  • Is a new tool really necessary? (Score:3, Insightful)

    by Lord Kano ( 13027 ) on Wednesday February 09, 2005 @10:40AM (#11618280) Homepage Journal
    A competent admin will know that his/her boxen are collecting personal data. An ethical admin will get rid of any unneeded data.

    LK

  • Can't subpeona what doesn't exist? (Score:5, Insightful)

    by PornMaster ( 749461 ) on Wednesday February 09, 2005 @10:40AM (#11618281) Homepage
    Is the point of this that law enforcement can't subpoena records that don't exist?
    • I think so, but really it's just another step in an arms race. How long until we see court orders to collect this sort of information? Or forbidding the use of log destruction/filtering tools?

      • Re:Can't subpeona what doesn't exist? (Score:5, Insightful)

        by sporktoast ( 246027 ) on Wednesday February 09, 2005 @11:11AM (#11618631) Homepage

        If an admin is just using this tool to destroy potentially incriminating logs, then they are using it poorly. Like trying to pound a screw in with a hammer.

        The use this has for an admin is to survey (or for the less experienced admin, to discover) what logs the system is currently, so that the admin can decide as a policy which logs should be active or not, and with what level of detail. The itch this tool scratches is that many systems as a default keep more logs than perhaps are necessary. A good admin will shut off whatever is deemed unnecessary, based on multiple criteria (security, system load, user/company privacy).

        Forbidding the use of log destruction tools (rm?) is moot. Destroying evidence is illegal. Now, laws (or court orders) mandating a level of logging are a completely different matter.

        • Re:Can't subpeona what doesn't exist? (Score:4, Informative)

          by jafiwam ( 310805 ) on Wednesday February 09, 2005 @11:33AM (#11618911) Homepage Journal
          Destroying evidence is indeed illegal. However, before you are aware of, or have "reasonable belief" of a lawsuit or criminal investigation logs are not evidence yet and may be deleted freely.

          I do exactly that with logs for my company. Once a month I clean out everything we don't need, including "email logs" and other stupid shit MS piles up in various places in the operating system. If/When the lawyers/cops come knocking, I can point to the policy and scheduled reminder and say "sorry, dont have that".

          Logs are not the only place stuff resides and piles up, but it's one easy fix and keeps my servers and machines clear of unnecessary disk-space robbing files.
          • > Once a month I clean out everything we don't need, including "email
            > logs" and other stupid shit MS piles up in various places in the operating
            > system. If/When the lawyers/cops come knocking, I can point to the policy
            > and scheduled reminder and say "sorry, dont have that".

            "...but if you'd have come yesterday you could have had 30 days worth".

            I think I prefer the policy apparantly in place at www.cryptome.org, which is to delete all your logs every 24 hours.

  • I appreciate the effort but... (Score:5, Insightful)

    by garcia ( 6573 ) * on Wednesday February 09, 2005 @10:40AM (#11618284)
    I would seriously hope that:

    a) the sysadmins are competent enough to handle this themselves. I would think that a sysadmin would know how to use some sort of local file search.

    b) the EFF understands that it's not always up to the sysadmins to determine the amount of time to keep logs that might be used against an individual.
    • Most MCSE trained, NT sysadms don't really have a complete understanding of their servers and how they work. Most are just part time admins, doubling up as postmasters, network support and helldesk frontliners. A great many Windows server administrators are simply in fact, the company management accountant, who may never have recieved any computer training whatsoever! Many will not know where to begin looking for files without googling for the answer. This issue stems from the poor quality of the MCSE courses about, rather than from organisational difficulties with the NT servers themselves.

      Admittedly NT logfiles are slightly more organised than *nix logfiles. Most will at least be under c:\Windows\system rather than spread over /etc /var /usr /root /usr/X11 and even (I kid you not) /bin. The rather haphazard way different programs save their files about *nix systems can be a headache sometimes. It would be nice if someone would standardise the process. However, such a thing has been tried with disasterous results, i.e. the windows registry, so I guess I should be careful what I wish for!

      In short, competant *nix admins will know most of the many location where their important daemons are storing logfiles. NT admins on the other hand, many not even know what daemons are running on the machine anymore, let alone where they store their log files!

      P.S.
      Hey wait! This is a python app. I guess NT admins will just have to keep on googling.
      • Unix admins versus MCSE's aside -- do you want your admin (on any platform) deleting files without understanding why they're there, just because some script from the EFF pointed them out to him?
      • spread over /etc /var /usr /root /usr/X11 and even (I kid you not) /bin.

        wtf? What distro are you running?
      • God, I hope helldesk was a typo...

      • Re:I appreciate the effort but... (Score:5, Informative)

        by EnronHaliburton2004 ( 815366 ) on Wednesday February 09, 2005 @01:44PM (#11620740) Homepage Journal
        Admittedly NT logfiles are slightly more organised than *nix logfiles. Most will at least be under c:\Windows\system rather than spread over /etc /var /usr /root /usr/X11 and even (I kid you not) /bin. The rather haphazard way different programs save their files about *nix systems can be a headache sometimes. It would be nice if someone would standardise the process.

        I don't think you understand *nix logging, or you've been working with poorly-designed systems.

        Locations for log files has been pretty well standardized by Posix and the LSB. Logs generally go in /var/log (or /var/adm on older systems), or in $APPLICATION_ROOT/log. A sysadmin might write a log to /var or /root, but those are temporary logs.

        Logfiles which end up in /etc, /bin, /usr or /usr/X11 is the result of poor or very old configuration.

        Now, compare this to a Windows 2003 Server running Exchange 2003, where the log files in c:\windows c:\Windows\system c:\Windows\system\Logfiles c:\Windows\system\security
        C:\Program Files\Exchsrvr\ C:\Program Files\Exchsrvr\MDBDATA C:\Program Files\Exchsrvr\mtdata . Many of the logfiles are not viewable with a text viewer. Some of the log files really aren't "Log files", but are "Transaction Logs", which is a different thing in my book.

        Some of this makes sense, some of this does not. But I'm not a windows admin, and I didn't design this network here, so maybe this is the result of a poor configuration.
        • For the list:

          Apache: /var/log
          Syslog: /var/log
          Apache-ssl: /var/log
          Samba: /var/log
          LPD: /var/log
          FTP: User-defined in config
          Email programs: /var/log (except for individual user procmail logs which are in their homedirs)

          Not really sure what system the grandparent was using, but all my logs have generally been easy to find too. The only time logs go somewhere else is if *I* want them to, usually in the event that somebody else is hosted on my machine and I want them to have access to their own logs but
      • Admittedly NT logfiles are slightly more organised than *nix logfiles. Most will at least be under c:\Windows\system rather than spread over /etc /var /usr /root /usr/X11 and even (I kid you not) /bin. The rather haphazard way different programs save their files about *nix systems can be a headache sometimes. It would be nice if someone would standardise the process. However, such a thing has been tried with disasterous results, i.e. the windows registry, so I guess I should be careful what I wish for!

        The
    • the sysadmins are competent enough to handle this themselves.

      I didn't bother to read a description of the tool, but there's nothing to say that a competent admin might not want something like this if it eased his burden. Also, there's the matter of incompetent admins. Many of us wear multiple hats. I do development, support, and administration on linux and windows for a small office, mostly by myself. Suffice to say, nobody can be perfect at everything. I'm always looking for tools that help me auto

    • Yeah, well I don't think that Unix distributions should include the find command!

      I would seriously hope that the sysadmins are competent enough to do a recursive ls and pipe that into grep when they want to locate a file with a particular name!

      (Seriously, what's wrong with providing toolsets to administrators that would like to use them?)
  • Most administrators already have effective methods of managing their logs. They crontab the hell out of it.

  • Oh, yeah (Score:5, Funny)

    by Otter ( 3800 ) on Wednesday February 09, 2005 @10:43AM (#11618318) Journal
    God forbid professional sysadmins should be expected to understand how their services are configured and what files are being written. If I were a user on one of their systems, sendmail log files would be the least of my concern.
    • Oh ... so you think that the release notes written by development teams and software vendors are accurate.

      Poor, naive admin. You have much to learn. Fuser is your friend.

    • Re:Oh, yeah (Score:4, Insightful)

      by stephenbooth ( 172227 ) * on Wednesday February 09, 2005 @11:45AM (#11619040) Homepage Journal

      In an ideal world every system would be administered by a well trained and experienced system admin, or a trainee admin being mentored by one, who had plenty of time to investigate and maintain the machine. In practice most system admins are people in other roles (developers, DBAs, desktop support or even receptionists) who have been handed the task of managing half a dozen white box Wintel servers (with maybe a SCO or Linux box or even an aging Sun box in the mix) and probably a Netware server doing file and print, most were built and installed by someone one of the manager's knows or have been inherited third hand from another company. If they're lucky they get a training course where they'll learn a few of the GUI screens, more likely they'll be given a few dozen pages of handwritten notes (aka 'the manual') and told to go to the nearest Waterstones/Borders/Whatever and buy a book if they need more.

      That was pretty much my first job. I had trained as a C programmer; then I found myself managing 70 desktops running various versions of Windows, a dozen or so White Box Intel based servers running Windows NT 3.51 and 4.0, a SCO OpenServer box, an Alpha running VMS, a 3 member VAX cluster running VMS and an RS6000 running AIX. All with no usable documentation or training. A little later they added in DBAing the Oracle databases and managing the network (a variety of devices from 3Com, Cisco and Bay), at the time I only knew a bit of SQL and wasn't really sure of the difference between a router and a switch. After spending a lot of money on books then a lot of time reading them (I didn't have web access at the time, when I did I started reading websites as well) I eventually learned what I needed to know.

      This script is a separate issue. Inpractice I don't expect those sorts of admins to run it, they probably wouldn't know what to do with the information if they did. Where I think it would be useful is for the professional admin who suddenly inherits a bunch of machines (maybe they've moved companies or their company has merged with another). Put this script on them and run it for a few days then see what it turns up. No matter how wonderful and professional you are unless you built and installed a machine yourself and can guarantee that no-one else has ever had the root/admin password to a box you can't be 100% sure that there's not some process running somewhere that is quietly logging something somewhere. No-one who manages a non-trivial number of machines has time to check every machine to make sure that there are no new or unexpected services that have snuck in (and remember it's not something you could do once and then not again, you'd have to keep on doing it). That's why you need scripts that look for anything that could point to unexpected activity. Not just looking for anything that looks like a log on a box but also ports that shouldn't be open (I've lost count of the number of times I've found a box with port 25 open when I know I've disabled SMTP, only to find that someone has re-enabled it without telling me) or unexpected activity on a switch or firewall port. Not only do we have too many machines to manage but also users who delete files they shouldn't which then must be restored from backup, managers who constantly demand reports on system availabity stats and projects that we have to keep an eye on to make sure they don't run wild and break every standard we have.

      Stephen

  • "Boxen" (Score:5, Funny)

    by m_member ( 771187 ) on Wednesday February 09, 2005 @10:43AM (#11618321)
    Can I have a tool to locate and delete people who use the word 'boxen'? GPL preferably.
    • You can, it's called VI [vim.org]. It's also used as an editor :D

    • I think there ought to be a Privoxy module to do that. As an added bonus, it would s/virii/viruses/g.
    • If somebody could find me a device that would hunt down annyoing people who complain about improper pluralization among tech nerds, then I'd definitely pay for that.

      "Boxen" is fine. If the plural of ox is oxen, then pluralizing box as boxen seems perfectly acceptable to me. It also helps to understand that somebody is talking about a bunch of computers as opposed to a bunch of cardboard boxes. :-)

      But I swear that the next person who tells me (in person) that virii is not correct is getting a punch in the

  • WTF is Boxen? (Score:2, Interesting)

    by Evil W1zard ( 832703 )
    Am I behind the times in cool admin speak or was this simply boxes mispelled? In any case I could definitely see this being used for both good and bad.
    • Box rhymes with ox. The plural of ox is oxen, so the plural of box is boxen.

      Mysteriously, admins don't seem use "mouses", or "hice", or "meese" (plural of moose)

      (Of course, then there's the ones who will vehemently argue that "its" is not a word because special cases are bad and "it's" is the proper possessive)
      • I don't think "oxen" itself is the reason. I think folks like the German plural form (of which "oxen" is an English example) 'cause it sounds cooler.

        • Well, the German plural of ox (die Ochse) is "Ochsen," and in German, you do have multiple "Boxen."

          If the person who wrote the submission was German, I'm willing to forgive them. However, as "Carl" claims to have been born in Philadelphia (presumably the newer one in the US, and not the older one in the Middle East), he needs beating with at least two wet fish. Maybe it was the fault of the apes, although the spell in Elbonia probably didn't help.

          -- Steve

          • Hey, "boxen" is totally standard admin speak, so don't beat him up. And my "oxen" example is, as I said, not German, but an example of a German-derived plural in English. Just trying to figure out why admins call them "boxen," not supporting the strange practice.

    • Re:WTF is Boxen? (Score:2, Insightful)

      by MojoSF ( 658720 ) *
      I also think of it as a nod to the old days when a room full of DEC VAX computers would be referred to as vaxen.
    • It comes from the term used to describe multiple VAX machines (VAXen). The root of that word is oxen, admins refered to many VAXen as VAXherds.

      Unfortuniatily, the term has found its way onto Dictionary.com [reference.com].

    • Re:WTF is Boxen? (Score:3, Informative)

      by TheRaven64 ( 641858 )
      From the Jargon File:

      boxen /bok'sn/ pl.n. [very common; by analogy with VAXen] Fanciful plural of box often encountered in the phrase `Unix boxen', used to {Unix">describe commodity {Unix hardware. The connotation is that any two Unix boxen are interchangeable.

      And yes, you are seriously behind the the times. The oldest copy of the Jargon File I have is from the early '90s and that contains the word boxen.

      It can be quite useful, since boxen are always computers, while boxes can be the

      • And yes, you are seriously behind the the times. The oldest copy of the Jargon File I have is from the early '90s and that contains the word boxen

        Well, maybe he's so behind the actually he's ahead. I don't know anyone but lamer kiddies and old farts trying desperately to be hip that really use the phrase anymore. It's almost as if it's become a marketing buzz word, and if you know anyone who uses it frequently to refer to computers is probably reaching out for acceptance or hoping that you'll think they'r
    • Boxen is from Brian Regan stand-up

      Here's the transcript...

      Plurals were hard, too.

      "Brian, how do you make a word a plural?"

      "You put a 's'...put a 's' at the end of it."

      "When?"

      "On weekends and holidays."

      "No, Brian. Let me show you." So she asked this kid who knew everything. Irwin. "Irwin, what's the plural for ox?"

      "Ox. Oxen. The farmer used his oxen."

      "Brian?"

      "What?"

      "Brian, what's the plural for box?"

      "Boxen. I bought 2 boxen of doughnuts."

      "No, Brian, no. Let's try another one. Irwin

  • EFF would sell more copies if... (Score:1, Funny)

    by Anonymous Coward
    rather than letting the admin delete the logs, it instead automatically sent logs to the management.

  • is this stupid? (Score:4, Insightful)

    by digitalgimpus ( 468277 ) on Wednesday February 09, 2005 @10:46AM (#11618360) Homepage
    I'm sorry, but this might just be the dumbest move yet they have made...

    lots are crucial for many reasons:

    1. Hacking attacks (how else do you track them, and prevent them)?
    2. Abuse problems (spammers, credit card fraud)
    3. aggregate statistics (what percentage of my customers are based in Europe?)

    I can't see why someone would shoot themselves in the foot and use this.

    Like log files are really intrusive anyway.

    • Re:is this stupid? (Score:3, Insightful)

      by Dasein ( 6110 )
      Don't use it. Seriously. If you are comfortable with the level of logging you have, okay. There are others, who may be in the positions of not wanting log files that identify users because of the expense associated with discovery or complying with a subpeona.

      Note, this is why large companies have email retention policies -- because having to do discovery or comply with a subpeona on email records going back years is expensive. So doing this type of thing isn't anything new or sinister.
    • 3. aggregate statistics (what percentage of my customers are based in Europe?)

      I know that webalizer keeps these statistics itself. You don't need to keep the rotated logs for that long. I would assume that you would use utlities that keep that extract that data and use it away from the actual logs themselves.

      Like log files are really intrusive anyway.

      Depends on what's being logged I guess.
    • I have to agree. I don't do much system administration work outside of our data-storage network these days, but even then I want to see what employees are putting on the 6TB system. Why? We've found porn before, against company policy, warezed games, against company policy, personal files, etc. before. For most random logs, they are archived every month and backup to optical media every quarter. But the storage system is supposed to be used to store completed video projects for the past year. Nothing

  • Redhat (Score:2, Informative)

    by RalphLeon ( 856789 )

    The last time I checked out redhat (about version 8 I rekon) they inluded this nice little utility called "logviewer". And, I though, wow a text viewer how novel, Linux doesnt have many text viewers.

    So not only is this a text viewer, but it also finds all those logs hidden in /var/log/*, it must be hard to find anything in /var/log/* ...

  • Just as an example... (Score:4, Insightful)

    by PartialInfinity ( 856052 ) on Wednesday February 09, 2005 @10:48AM (#11618388)
    This is just EFF's way of reminding sysadmins to be vigilent about their log files, it's not meant to replace good administration habits.

  • Interesting Motive (Score:4, Interesting)

    by peterdaly ( 123554 ) <petedaly@@@ix...netcom...com> on Wednesday February 09, 2005 @10:55AM (#11618459)
    My first thought was the main purpose of this would be to identify and eliminate "wasted" disk space. There are a bunch of logs that, without management, really just end up being wasted bits on your disk. Generally, that may be a useful utility, at least to me.

    I was suprised to see the EFF seems to have a totally different motivation. It seems their real motivation is that the government can't demand logs that don't exists, or more specifically you can't get in trouble for not providing what you don't actually have.

    Not sure what I think of that...
    • There's a catch in thinking only of being served with a warrant for logs.

      The much more common case is a civil suit where logs are requested in discovery. Woefully, failing to produce logs for a particular period can weigh heavily against your side of the case in a civil matter. I know of several companies that keep email forever for example, only because defending themselves in a suit might rely on being able to demonstrate that actions were taken at a particular time. Saying "yeah, we did that then, but w
    • I am not a lawyer and I have had to comply with several subpoenas for computer records. Obviously you have never had to comply with a computer records subpoena. Pruning unnecessary logs saves disk space AND it is a real time saver. Do not decide to prune your logs after you receive a subpoena, and make sure that you comply with all applicable laws. Why are you surprised that the EFF would provide a utility that saves an admin trouble by removing unnecessary logs?
      • But how will that help defeat the Evil Terrorists ? Personally I would like a program which scans my logs for Arabic and automatically informs the necessary authorities
        • Oh dear, I forgot about the Evil Terorists. Never mind what I said earlier; turn all your logging to maximum verbosity and retain all of your logs forever. Somebody needs to start spamming HTML propoganda posters that show that log retention is our patriotic duty.

        • But how will that help defeat the Evil Terrorists ?

          Actually, we love the evil terrorists, so we'd never want to defeat them. We must - after all, we're making so many of them.

    • I was suprised to see the EFF seems to have a totally different motivation. It seems their real motivation is that the government can't demand logs that don't exists, or more specifically you can't get in trouble for not providing what you don't actually have.

      Same thing libraries did to get around having to turn over patron's reading habits to the police.

      Of course the next step the government will take is passing a law requiring everyone to keep their logs for 5 years.

  • interesting... (Score:5, Informative)

    by Spider[DAC] ( 129824 ) on Wednesday February 09, 2005 @11:04AM (#11618558) Homepage
    Actually, it uses lsof and a few other niceties to locate open files that change over time, then scans them for presence of time/date stamps, mailaddress or other "log" activity.

    So, no, its not just "locate log" that somone suggested, nor is it "find /var/log" either, but a bit more complex.

    As for the comment about competent site-admin. This is a bit more than that too, its also about users and active software, peoples IRC logs, various ftp clients that clobber up and log passwords along with everything else in their config dir. And so on and so forth.

    • Re:interesting... (Score:3, Informative)

      by scrotch ( 605605 )
      Right. From their README:

      "... We have created a program called logfinder as a sample means of locating files that might be logs on an existing system. logfinder uses regular expressions to find local files with "log-like" contents; you can customize those expressions if necessary to meet your needs. logfinder requires Python 2 or greater and finds logs in text files on a POSIX-like system. (It might also find some log-like data in binary files if the binary files represent that data in textual form.)

      log
  • Around here, we call that "logrotate."
    • > Around here, we call that "logrotate." logrotate is mentioned explicitely in the README file of the software.

      Some operating systems come with preinstalled log-rotation software. However, the log-rotation software provided by an operating system vendor is normally -- at best -- able to recognize and rotate logs created by vendor-provided software. If you have installed third-party application software, or software you have written or compiled yourself, it may keep logs completely outside the notice

  • Good work, but... (Score:2, Interesting)

    by IBeatUpNerds ( 827376 )
    You could be treading in some dangerous territory. Let's say, for instance, as a sysadmin, you know one of your users has been accessing some machine they should not access for whatever reason (immoral, illegal, etc...). Well, you run this tool and uncover evidence to support that theory, then discuss with JaneUser and, out of the goodness of your heart, decide to remove the logs in question. All is well.

    Two months later, "they" subpoena your logs to find no trace of evidence. Suspecting log-alteration, th
    • Selectively editing your logs to omit/obscure nefarious activity doesn't require any special tools--that only requires poor ethics.
    • Two months later, "they" subpoena your logs to find no trace of evidence. Suspecting log-alteration, they subpoena the upstream providers logs and find correlating evidence that is mysteriously missing from your logs. So, JaneUser ends up getting in trouble, and the kind-hearted sysadmin gets slapped with evidence tampering.

      How would it be "evidence tampering" if you didn't even know about the existence of an investigation until 2 months after you edited the logs? For you to be tampering with "evidence",

    • Re:Good work, but... (Score:3, Insightful)

      by Secrity ( 742221 )
      I am not a lawyer, the following is a general discussion, your mileage and your laws may vary. It is possible that some jurisdictions may have laws that require the retention of data, I know of no such requirement in the US. Did I mention that I am not a lawyer?

      There is a difference between evidence tampering (illegal) and system administration (legal). If you remove data because it may be incriminating, you are tampering with evidence. It would also be illegal to delete data after you receive a subpo
  • I'm sorry, this reminds me of another recent story [slashdot.org]. I think the EFF is doing a lot of good things, but releasing this kind of agenda-pushing software does seem a bit strange to me.

  • Log Retention Policy (Score:2, Insightful)

    by dRn-1 ( 732935 )
    I can see how useful logfinder could be/is. And how it along with relevant administration, can eleviate the possibility that your systems are harbouring evidence of criminal activity... Could they seize any systems they deem necessary? I certainly wouldn't want any of my systems seized because I don't have a log retention policy, and hence when they ask do you have logs for such and such @ such and such a date, a reply of I'm not sure wouldn't go down too well! In short and IMHO having a log retention polic

  • My experience with logfinder (Score:3, Informative)

    by carpe_noctem ( 457178 ) on Wednesday February 09, 2005 @11:27AM (#11618843) Homepage Journal
    Running openbsd 3.6 on x86:
    tresor:src$ tar xfvz logfinder-0.1.tar.gz
    logfinder-0.1
    logfinder-0.1 /logfinder.py
    logfinder-0.1/README
    logfinder-0.1 /COPYING
    tresor:src$ cd logfinder-0.1
    tresor:logfinder-0.1$ sudo ./logfinder.py
    Scanning for open files systemwide...
    [Errno 2] No such file or directory: '(/dev/wd0a)'
    [Errno 2] No such file or directory: '(/dev/wd0a)'
    [Errno 2] No such file or directory: '(/dev/wd0a)'
    [Errno 2] No such file or directory: '(/dev/wd0a)'
    [Errno 2] No such file or directory: '(/dev/wd0a)'
    [Errno 2] No such file or directory: '(/dev/wd0a)'

    (repeats several dozen more times...)

    [Errno 2] No such file or directory: '(/dev/wd1a)'
    [Errno 2] No such file or directory: '(/dev/wd0a)'
    [Errno 2] No such file or directory: '(/dev/wd0a)'
    [Errno 2] No such file or directory: '(/dev/raid0a)'
    [Errno 2] No such file or directory: '(/dev/raid0a)'
    [Errno 2] No such file or directory: '(/dev/wd1a)'
    [Errno 2] No such file or directory: '(/dev/wd0a)'
    [Errno 2] No such file or directory: '(/dev/wd1a)'
    Scanned sizes of 30 files.
    Waiting for log activity; please allow time to elapse.
    Press Enter to continue.
    [Errno 2] No such file or directory: '(/dev/wd1a)'
    [Errno 2] No such file or directory: '(/dev/wd0a)'
    [Errno 2] No such file or directory: '(/dev/raid0a)'
    tresor:logfinder-0.1$ cd ..
    tresor:src$ rm -rf logfinder*
    At least the EFF's lawyers are better than their programmers. ;)

  • This tool could be moderately useful, especially in an environment where the administrator can't be expected to know all of the ins and outs of third-party add-ons.

    I was once assigned to a dotcom that used a third-party component to allow for credit card transactions. What the admin didn't realize was the default configuration left the component in debug mode, placing all user-submitted credit card data in plain text files on the web server

    We only found the log file accidentally while performing an unr

  • anybody else have this lock up their system? (Score:3, Interesting)

    by rcpitt ( 711863 ) on Wednesday February 09, 2005 @12:15PM (#11619415) Homepage Journal
    OK - I downloaded it, untar'd, and ran it as root on my Toshiba laptop (RH-9 2.4.20-31.9 kernel, 1G RAM) and the machine locked up. I had switched to another window and was looking at a log file while the program "thought" in the original window. I also had a number of remote ssh sessions open. The machine had been up for about 30 minutes today already.

    This system is rock solid, in use for hours/day with the exact same mix of programs running constantly (evolution, mozilla, ssh/rxvt windows to external systems, etc.)

    comments?

  • No offence to the fact that almost all the comments under this thread are mocking it.... But even as a professional admin whom has worked on hosting envrionment servers for years, sometimes I run into problems from a log file getting out of hand that hadnt been properly managed etc... It's hard to know and find them sometimes and, :O this does ;P
  • ...for my new r00t kit! Now I can upload this onto a machine to easily find all the sensitive logs to swipe and wipe. I'm gunna be a l33t hax0r. Yay me! (Now I just need to wait for a story about a new vunerability. This'll be kewl.)
  • Did the EFF just beat Google to the punch on a "Server Search" app?

Slashdot Top Deals

Single tasking: Just Say No.

Close