2 ms·
>This article is predicated on the assumption that an attacker goes from zero access to full root within 10 seconds. While there are vectors which have allowed
by tw04 12y ago
>This article is predicated on the assumption that an attacker goes from zero access to full root within 10 seconds. While there are vectors which have allowed such rapid escalation, they're less common now than historically thanks to Linux's security looking more like an onion rather than just a binary state (root or user).
You mean like a disgruntled system administrator? There are countless scenarios in which an attacker goes from zero access to root within 10 seconds. Predicating your security on that not being a common scenario shows that you've spent next to no time in a real corporate environment. IE: Poettering.
- matthewmacleod 12y agoNonsense – defence in depth and all of that. FSS is useful because it provides a layer of audibility for users that wouldn't have external log servers in any case, and because it provides some minimal guarantees about the ability to tamper with logs. That's useful, regardless of the fact that it's not a bulletproof solution!
- tw04 12y agoI didn't say FSS was a step backwards or wasn't useful. You completely ignored the content of my post. When the project founder tells people "hey, you don't need external syslog servers" it shows an absolute ignorance of WHY we have external logging servers. And that kind of ignorance is dangerous in a project leader. ESPECIALLY when his solution to being called out on his ignorance is to ignore the person who was critical.