From: marchany@vtserf.cc.vt.edu (Randy Marchany)
Newsgroups: comp.unix.programmer,comp.admin.policy
Subject: Re: logging outgoing telnet sessions to catch 'hackers' (summary)
Date: 16 Apr 92 01:55:05 GMT
Followup-To: comp.unix.programmer
Organization: Virginia Tech, Blacksburg, VA

In article <1992Apr15.185018.1918@ircam.fr> francis@ircam.fr (Joseph Francis) writes:
>This presumes that someone will be guilty. It is also tantamount to 1)
>mandatory blood testing for drugs 2) wiretapping 3) making lists of
>delivered letter return addresses (called "Mail Cover") 4)
>credit-rating checks 5) traffic violations reported on backs of
>licenses (soon to appear in California). 6) Universal identification
>codes.
>

I'm sorry but logging where telnet, finger, rlogin, ftp accesses by
means of TCP wrapper style code is NOT presuming that the people using
those services are guilty. There are numerous reasons for wanting to
log information ranging from justifying a particular service on a host
to general system auditing. In some cases, this info is useful in
tracking down illegal usage of a particular site. 

The general comments of this thread seem to indicate that there are mad
sysadmins running around trying to "capture" innocent users and not give
them due process. Be real, most sysadmins are professional (by whatever
standards) and like the phone company log a lot of information that is
rarely examined with a fine tooth comb. For the most part, they don't
have time to review this info UNTIL there is a problem or need to do
so.

To the people who feel that this consitutes spying or violating user's
rights, I would hope that your individual site's acceptable use policies
cover BOTH the responsibilities of the users and the sysadmin. If not,
then you aren't doing your part to help define YOUR particular computing
environment. Remember that one site's acceptable use could be another 
site's usage violation (to rework an old cliche). The important issues are
to have some sort of statement that can be as general or specific as
required by each INDIVIDUAL site, distributing this policy to your user
community and refining/reviewing the policy on a regular basis.
 
If you don't know where to get help, I suggest reading
RFC 1244 (Guide to writing a Site Security policy) available via
anonymous FTP from CERT and other sites. 

I also ask this thread what YOU would do if someone discloses sensitive
info, destroys data or uses accounts illegally on your system(s). How
would you track down the "offender" presuming, of course, that your 
supervisor/management instructs you to track them down. I think a
discussion of this nature would point out the difficulties in trying to
determine who 'raided' a site and would be far more useful to the
readers of this group.

The bottom line is that any discussions of a GENERAL nature (what this
particular thread has degenerated into) is really blowing a lot of
smoke. These types of discussions are useful only in SPECIFIC cases
such as the comments reviewing Wes Morgan's policy statement or the
Brack incident at OSU.

Sorry for the soapbox treatment.

	-Randy Marchany
	VA Tech Computing Center


Xref: sparky comp.unix.programmer:2289 alt.security:2739