Special Forums Cybersecurity best practice for logging options Post 302352441 by jim mcnamara on Friday 11th of September 2009 09:54:31 AM
Old 09-11-2009
Your question is really too open-ended IMO. This is random:

Are there external incoming connections (initiated from outside your firewall)?
Can your box connect to boxes in your DMZ?
Do you use an external DNS name service?
Do you consume web services? Consume external web services? Provide web services?
Do you track security violations? - you should.
Do you audit user activity?
Do you have a data access policy and paperwork to back it up?
Do you have a solid backup process? off site backup? failover?
This list goes on - you get the idea.

There is no single set of 'best practices' for logging - it usually is more a matter of what your box is exposed to, your level of risk tolerance, what the datasets on the server represent, etc. Then there are basics like monitoring the heck out of externally initiated connections.

If you google 'best practices' you will be presented with an onslaught of choices. You have to select the models that fit your system. Apache has great guidelines for example.
But they may make no sense for your situation.
 

8 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

What is the best practice?

I'm playing the shell game of moving and deleting files to make room for current DB backup. A set of files gets moved to serverB when serverA threshold is exceeded. I created two scripts one for serverA and one for serverB. Both scripts are run by cron entry. There is a difference of 12 minutes... (4 Replies)
Discussion started by: BigSky
4 Replies

2. Shell Programming and Scripting

best practice please

I have a data file that I tail and dump the data into a new file at midnight. To work I had to use tail -n2 livefile.csv >> storefile.csv. This is ging me 2 or 3 entries at a time into the storefile.csv. if I continue this then I will have to run a second pass on the file to remove the... (4 Replies)
Discussion started by: Mikey
4 Replies

3. Post Here to Contact Site Administrators and Moderators

Constant Logging In (After Logging Out)

Hi Everyone. First, I want to thank all of you for letting me participate in this great group. I am having a bit of a problem. After I get an email from a responder, I login to make my reply. In the mean time I get another response by email from another member, I go to reply to them and I... (6 Replies)
Discussion started by: Ccccc
6 Replies

4. UNIX for Dummies Questions & Answers

hp ux practice

hi i am new in unix.i have installed linux in my pc,but i want to practice and be expatise in hp ux.but i have no hp server for do it.how could i practice hp ux?please help and give suggestion. (1 Reply)
Discussion started by: dipanjan123
1 Replies

5. Ubuntu

Kernel boot options removed by fault, no boot options

Hello Everyone, First of all, I highly appreciate all Linux forum members and whole Linux community. http://forums.linuxmint.com/images/smilies/icon_wink.gif. I wish you the best for all of you ! I will try to be short and concise: I am using Linux Mint 10 for 2 months on 2 ws, and all went... (3 Replies)
Discussion started by: cdt
3 Replies

6. UNIX for Dummies Questions & Answers

practice scripting

Is there any sites out there that have examples of things they want you to go and script for practice? I have looked around but have came up empty handed. I have been writing scripts for things I need on my nix box but have am wanting more challenging things to keep me learning. I would prefer... (3 Replies)
Discussion started by: linuxn00b
3 Replies

7. HP-UX

LVM PE. Best practice

Hi everyone. Unfortunately I can't find advice's about LVM Physical Extent for HPUX. As far as I know we can set for 1PE size from 1MB to 256 MB. But in what cases it should be different? Maybe exist any strict rules, requirements or any best practice? (2 Replies)
Discussion started by: jess_t03
2 Replies

8. Linux

Syslog not logging successful logging while unlocking server's console

When unlocking a Linux server's console there's no event indicating successful logging Is there a way I can fix this ? I have the following in my rsyslog.conf auth.info /var/log/secure authpriv.info /var/log/secure (1 Reply)
Discussion started by: walterthered
1 Replies
CHKCONFIG(8)						      System Manager's Manual						      CHKCONFIG(8)

NAME
chkconfig - enable or disable system services SYNOPSIS
chkconfig -t|--terse [names] chkconfig -s|--set [name state] chkconfig -e|--edit [names] chkconfig -c|--check name [state] chkconfig -l|--list [--deps] [names] chkconfig -A|--allservices chkconfig -a|--add [names] chkconfig -d|--del [names] DESCRIPTION
chkconfig is used to manipulate the runlevel links at boot time (see init.d(7)). It can be thought of as a frontend to insserv(8). Chk- config can run in six different modes: terse list mode, set mode, edit mode, list mode, add mode and delete mode. The last three modes were added for compatiblity reasons. TERSE LIST MODE
This mode lists the state of the specified services, or all known services if no service name was provided. Every printed line consists of the name of the service and the runlevels the service is configured for at the moment. If it is configured in no runlevel, off is used instead, if it is configured in the runlevels defined as a default by the start script, on is used. If the service is an enabled inetd or xinetd service, inetd and xinetd are used. Inetd/xinetd services are configured in /etc/inetd.d and /etc/xinetd.d, respectively. You can use the -A or --allservices parameter to get all services (even the boot.*-services) listed. If chkconfig is called without arguments, all services are listed in terse mode. SET MODE
Set mode is used to configure at which runlevel a service should be started. The arguments must be specified as pairs of service name and new state. You can use on and off as special states to select the default set of runlevels or to disable a service completely. You can use inetd or xinetd to configure a service managed by the inetd/xinetd daemons. Insserv can calculate dependencies for only one service at the same time. To work around this limitation imposed by insserv, chkconfig uses the '-f' option of insserv when it reads the list of services from standard input. Note that --force switches off all dependency checks and could lead to depending services no longer working, use with care. If no services are specified, chkconfig reads lines from standard input. Each line must consist of a service/state pair. As this is exactly the output of the terse list mode, this can be used to reconfigure a service specification saved by a former run. If the option -f or --force is also given, insserv is called with a '-f' option. EDIT MODE
This mode is a combination of the terse list mode and set mode. It writes the state of all specified services (or all known services, if no service was provided) into a temporary file, starts an editor and re-configures all services to reflect the states of the changed tempo- rary file. CHECK MODE
This mode can be used to check the state of a service. chkconfig exits with a return code of '0' if the service is enabled in all of the specified runlevels, otherwise the exit status is '1'. If chkconfig is called with only a service name the current runlevel of the system is used for checking. LIST MODE
List mode prints for each specified service a line that consists of the service name and for runlevels zero to six on or off depending if the service will be started or not. on will be printed in bright green if the output is written to a terminal. If the --deps option is given, the names of the services that must be started before this service is appended to each line. The inetd/xinetd services are listed in extra sections. You can use the -A or --allservices parameter to get all services (even the boot.*-services) listed. ADD MODE
Calls insserv to enable a service and uses list mode to display the new setting afterwards. DEL MODE
Same as add mode, but disable the service. OTHER OPTIONS
When no service names are given on the command line, chkconfig defaults to all known services excluding those that are not enabled in run- levels 1 to 6 and start with 'boot.'. Use the --allservices or -A option if you want to see such services as well. EXAMPLES
chkconfig list the runlevel configuration of all known services chkconfig apache list the runlevel configuration of the apache web server chkconfig -t apache xntpd list the runlevel configuration of the apache web server and the network time protocol daemon. chkconfig apache on configure the apache web server to be started on next boot time. chkconfig apache 5 configure the apache web server to be started only if the system reaches runlevel 5. chkconfig apache 35 configure the apache web server for runlevel 3 and 5. chkconfig apache on xntpd off configure two services chkconfig finger xinetd configure a xinetd service chkconfig -A >~root/chkconfig.save backup the current configuration chkconfig -s <~root/chkconfig.save restore the configuration chkconfig -e apache xntpd change the runlevel configuration interactively chkconfig -e change the runlevel configuration of all services interactively FILES
/etc/init.d/ path to the boot script base directory as required by the Linux Standard Base Specification (LSB). /etc/inetd.d/ path to the inetd services. See the inetd manpage to find out how to enable this feature. /etc/xinetd.d/ path to the xinetd services. SEE ALSO
init.d(7), init(7), inetd(8) xinetd(8) insserv(8) COPYRIGHT
2003 SuSE Linux AG, Nuernberg, Germany. AUTHOR
Michael Schroeder <mls@suse.de> Oct 2006 CHKCONFIG(8)

Featured Tech Videos

All times are GMT -4. The time now is 05:03 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy