Re: [SAGE] Re: Official sudosh announcement

["Adam S. Moskowitz" <adamm@menlo.com>]

On Fri, 1 Oct 2004 09:07:59, Doug Hanks <dhanks@gmail.com> wrote:
> Thanks for the feedback. I'll just ignore your attitude, because I
> know it runs rampant in the technical community.

Attitude or not, Bill has a very real, very valid, very serious point.

> sudosh provides accountability through syslog.

"[A]ccountability through syslog" is an oxymoron. syslog message are not
secure, are easily diverted/modified/falsified, fake messages can easily
be sent to the central log host, etc. This certainly wouldn't stand up
in court, and I seriously doubt that it would meet the SOx requirements.

> Nothing else out there does.

And with good reason: Using syslog for accounting is neither reliable
nor secure.

The basic idea of sudosh (a root shell with full logging) is good, but
it requires a better remote logging mechanism than syslog. Claiming that
sudosh, using syslog, would meet SOx requirements is at best
disingenuous, at worst negligent.

AdamM