From: francis@ircam.fr (Joseph Francis)
Newsgroups: comp.unix.programmer
Subject: Re: ethics of logging telnet destinations (was Re: logging outgoing...)
Date: 16 Apr 92 12:44:58 GMT
Organization: IRCAM, Paris (France)

In article <33004@darkstar.ucsc.edu> shandon@cats.ucsc.edu (Timothy Daniel Kolar) writes:
>In article <1992Apr15.190205.2111@ircam.fr>, francis@ircam.fr (Joseph Francis) writes:
>
>|> The long-distance carrier companies log all long-distance calls, and
>|> your local calls are logged locally, for purposes of accounting. For
...
>I don't believe anyone suggested that the logs would be looked at, or
>handed over to anyone, until a problem existed.  The original purpose
>of the phone logs is irrelevant--if the phone company suddenly decides
>to stop charging, I will lay you very good odds that the accounting
>will stay installed.  (I would also question if monetary accounting
>was all they had in mind in the first place, but that's a whole other
>bag of worms)

If they decide to stop charging, there are still other questions which
accounting answers, mostly relating to resource utilization, and in
turn scheduling such things as equipment maintenance and upgrade,
where to put new switching centers, etc. If they decided to stop
charging, I doubt if they would keep monetary accounting around,
simply because it is expensive to do.

>|> I don't envision many "problems" with outbound telnets that must
>|> be monitored.
>I think this may be the heart of the disagreement.  There is a 
>sizeable problem with outbound net connections: to put it bluntly,
>why would anyone risk breaking into a local system, when they can
>make anonymous attacks on systems across the net?

There are a series of issues which should be resolved before attacking
the problem of a local user penetrating foreign systems. These include
resource utilization -- is there an 'overusage' of telnet resources (a
dedicated line perhaps) which displaces other normal or necessary
usage; is the resource competition such that someone is lacking? This
can be deduced from very simple monitoring. Then. If there is somone
who in routinely using much more resource than others causes delay or
abort of resource-bound processing, then find out who they are, and
negotiate acceptable usage. If there are complaints from other systems
that there are excessive connects from the local systems, and that
someone is trying to penetrate, then machinery clicks into place to
find out who is trying to do it.  Even then, of course, you must
guarantee simple things like: is it the actual account owner who is
trying to break in another system? This isn't a matter of just
logging.

I find the idea that a system administrator on one site is justifying
logging all external connects in order to possibly aid at some
unspecified future time the work of an anonymous system administrator
on another site a bit hard to swallow.

>This leads to the reasonable idea that you only start tracking telnets
>when someone at another site reports an attack from your site.  However,
>if you trust your system administrator (and you had better) then having
>logs that aren't looked at until a problem arises is about the same thing.

Is it? The information gathered is a "virtual problem" in the sense
that it isn't dangerous (if ever) to anyone until the moment that it
is accessed; when thinking about system security, would you trust not
the administrator, but the fact that such log files are never
examined, even accidentally, by someone other than the system
administrator? I wouldn't. I think such classes of information are
better left ungathered unless necessary for a specific purpose, then
discarded again. (A tenuous example) What if it accidentally came out
that someone working with the Gnu project was telnetting into Apple,
or vice versa; innocent, but with possible, though not profound,
implications. This is also one reason why I don't ever use electronic
mail for anything I wouldn't mind anyone to read; it has practically
no security unless encrypted, and even then...

>|> Also, the safety of user's data is most easily secured with backups...
>
>	Safety also entails protecting the information from 
>unauthorized access (ironically, backups make that harder instead of
>easier).  

Unfortunately true, and very often overlooked, and in the context of
this discussion, interestingly relevant.
-- 
| Le Jojo: Fresh 'n' Clean, speaking out to the way you want to live
| today; American - All American; doing, a bit so, and even more so.