From owner-FreeBSD-users-jp@jp.freebsd.org  Fri Aug 27 22:38:28 1999
Received: (from daemon@localhost)
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) id WAA57508;
	Fri, 27 Aug 1999 22:38:28 +0900 (JST)
	(envelope-from owner-FreeBSD-users-jp@jp.FreeBSD.org)
Received: from light.imasy.or.jp (root@light.imasy.or.jp [202.227.24.4])
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) with ESMTP id WAA57503
	for <FreeBSD-users-jp@jp.FreeBSD.org>; Fri, 27 Aug 1999 22:38:27 +0900 (JST)
	(envelope-from mistral@imasy.or.jp)
Received: from tasogare.imasy.or.jp (mistral@tasogare.imasy.or.jp [202.227.24.5])
	by light.imasy.or.jp (8.9.3+3.2W/3.7W-light) with ESMTP id WAA28367
	for <FreeBSD-users-jp@jp.FreeBSD.org>; Fri, 27 Aug 1999 22:38:25 +0900 (JST)
	(envelope-from mistral@imasy.or.jp)
Received: from mistral.wind.prv (isdnb20.imasy.or.jp [202.227.24.148])
	by tasogare.imasy.or.jp (8.9.3+3.2W/3.7W-tasogare/smtpfeed 1.01) with ESMTP id WAA28368
	for <FreeBSD-users-jp@jp.FreeBSD.org>; Fri, 27 Aug 1999 22:38:24 +0900 (JST)
	(envelope-from mistral@imasy.or.jp)
Message-Id: <199908271338.WAA28368@tasogare.imasy.or.jp>
Received: (from yohta@localhost)
	by mistral.wind.prv (8.9.3/3.7Wpl2-990626) id WAA47119;
	Fri, 27 Aug 1999 22:30:40 +0900 (JST)
Date: Fri, 27 Aug 1999 22:30:40 +0900 (JST)
From: mistral@imasy.or.jp (Yoshihiko -OHTA- SARUMARU)
To: FreeBSD-users-jp@jp.FreeBSD.org
In-Reply-To: Your message of "Tue, 24 Aug 1999 23:01:12 +0900 (JST)".
	<199908241402.XAA06011@tasogare.imasy.or.jp>
X-Mailer: mnews [version 1.21PL5] 1999-04/04(Sun)
Reply-To: FreeBSD-users-jp@jp.freebsd.org
Precedence: list
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+990727
X-Sequence: FreeBSD-users-jp 45214
Subject: [FreeBSD-users-jp 45214] Re: security check report: login failures
Errors-To: owner-FreeBSD-users-jp@jp.freebsd.org
Sender: owner-FreeBSD-users-jp@jp.freebsd.org
X-Originator: mistral@imasy.or.jp

$B!!1n4]$G$9!#$_$J$5$^$$$m$$$m$"$j$,$H$&$4$6$$$^$$$?!#(B

1999-08-24($B2P(B) 23:01:12.$B:"!";d$O=q$-$^$7$?!#(B

>   $B$3$l$G$O$&$C$H$&$7$$$7!"K|0l(B login failure $B$,5/$-$F$b5$$E$-$K(B
> $B$/$/$J$C$F$7$^$&$N$G!"0lEY(B login failure $B$,=P$F$b!"<!$NF|$+$i$O(B
> $BI=<($5$l$J$$$h$&$K$7$?$$$N$G$9$,!"$_$J$5$s$O$I$N$h$&$KBP=h$5$l$F(B

$B!&(Bnewconfig $B$G!"(Blog file $B$N(B rotate $B$rAa$/$9$k(B
$B!&(Bgrep $B$GA0F|$N$@$1<h$j=P$9(B
$B!&(B/var/log/messages $B$NB>$K(B /var/log/security $B$N$h$&$J%U%!%$%k$K(B
  $B$b!"(Bsyslog $B$N@_Dj$rJQ$($F=P$5$;!"(Bsecurity report $B$O$=$A$i$N%U%!(B
  $B%$%k$r8+$k$h$&$K$9$k!#$3$N%U%!%$%k$O?tF|$G(B rotate $B$5$;$k!#(B

$B$H$$$&$h$&$K$$$/$D$+0F$r$$$?$@$-$^$7$?!#(B

  $B$G$b:#2s$N%?!<%2%C%H$O4IM}$K$"$s$^$j>\$7$/$J$$B>?M$,4IM}$9$k%^(B
$B%7%s$J$N$G!"JQ99E@$,$G$-$k$@$1>.$5$/$J$k$h$&$K$7$?$+$C$?$?$a!"(B
$B%7%9%F%`$K$OJQ99$r2C$($:!"Mh$?%a!<%k$r2C9)$9$k$H$$$&J}?K$K$7$^$7(B
$B$?!#MW$O(B security report $B$N%a!<%k$O$"$k%U%)%k%@$K=8$a!"(B

  diff -u "$BA02s$N%a!<%k(B" "$B:#2s$N%a!<%k(B" 

$B$H$$$&=hM}$r$9$k(B script $B$r(B procmail $B$G8F$S=P$9$h$&$K$7$F!"$=$N7k(B
$B2L$N%a!<%k$r(B mailbox $B$K=q$-La$9$h$&$K$7$^$7$?!#(B
  $B$3$N$?$a(B 1$BF|8+K:$l$?$i5$$E$+$J$/$J$j$^$9$,!"$^$!$A$c$s$H8+$k$@(B
$B$m$&$H$$$&2>Dj$N85$K$3$l$G1?MQ$7$F$_$?$$$H;W$$$^$9!#(B


1999-08-26($BLZ(B) 11:35:54.$B:"!"(Bchi@bd.mbn.or.jp$B$5$s$O=q$-$^$7$?!#(B

> SunOS4.1.x$B$@$H!"(Broot$B$G(Bdmesg$B$r<B9T$7!"$=$N:]!"0z?t$H$7$F(B"-"$B$rIU$1$k$H(B
> $BA02sI=<($7$?B3$-$+$iI=<($5$;$k$3$H$,$G$-$F!"$3$N<j$NL\E*$K$OHs>o$K(B
> $BJXMx$G$7$?!#(B
> FreeBSD$B$N(Bdmesg$B$K$b!"$3$N5!G=$,$"$l$P(B...$B$H$$$&$H$3$m$G$9$M!#(B

  AIX $B$G$OL@<(E*$K>C$5$J$$8B$jFbMF$,;D$jB3$1$k%(%i!<%P%C%U%!$_$?(B
$B$$$J$b$N$,$"$C$F!"%(%i!<$rI=<($9$k%3%^%s%I$r$rKhF|<B9T$9$l$P!"(B
$B$3$l$^$G$N%(%i!<FbMF$,I=<($5$l$k!"$H$$$&;EAH$_$,$"$k$h$&$G$9!#(B
errclear $B%3%^%s%I$@$C$?$+(B($B$J$s$+0c$&5$$,$9$k(B)$B$r<B9T$9$k$H!"(B
$B$=$N%(%i!<$,>C5n$5$l$F!"<!$+$i$OI=<($5$l$J$/$J$k$H$$$&!#(B
  $B$=$s$J$N$,$"$C$F$b$$$$$N$+$b$7$l$^$;$s!#(B

--
$B1n4](B($B5l@+(B: $BB@ED(B)$BK'I'(B (Yoshihiko SARUMARU)
E-mail: mistral@imasy.or.jp	URL: http://www.imasy.or.jp/~mistral/








