Following up on the recent postings about various kinds of spoofing, I'd like to present one particularly ugly case. I think no one would argue that syslog is every Unix sysadmin's close friend.
Some people trust syslog and make important decisions based on what they see there.
Fortunately, defendant, sysadmin of the system in question, was able to show that syslog entry means nothing. Well, he was absolutely right. What is less known, however, is that many syslogd implementations have remote reception turned on by default. Remote reception is a very simple thing. The idea is OK, but implementation is not.