Is it time to block all Microsoft protocols in the core?

Tue Jan 28 20:43:08 UTC 2003

Joe Abley wrote:
> 
> You're using mixed tense in these sentences, so I can't tell whether you 
> think that syslog's network port is open by default on operating systems 
> today.
> 
> On FreeBSD, NetBSD, OpenBSD and Darwin/Mac OS X (the only xterms I 
> happen to have open right now) this is not the case, and has not been 
> for some time. I presume, perhaps naïvely, that other operating systems 
> have done something similar.

Current versions of Linux appear to be safe.  This is from the syslog 
package that ships with RedHat version 8 (sysklogd package version 
1.4.1-10).

	NAME
	    sysklogd - Linux system logging utilities.

	...

	OPTIONS
	...
	    -r    This option will enable the facility to receive
	          message from the network using an internet domain
	          socket with the syslog service (see  services(5)).
	          The default is to not receive any messages from
	          the network.

	          This option is introduced in version 1.3 of the
	          sysklogd package.   Please note that the default
	          behavior is the opposite of how older versions
	          behave, so you might have to turn this on.

The default RedHat installation does not turn on this option.

Looking through RedHat's FTP server, their 4.2 distribution (the oldest 
on on their server) is at version 1.3-15, and therefore incorporates 
this feature.  This release has a README dated 1997, and the sysklogd 
package on their server is dated December 1996.

I would assume that other Linux distributions from the same era (1997 
through the present) would also have sysklogd version 1.3 or later, and 
therefore have this feature.

-- David