Subject: [OPSAWG] sec 9, syslog-msg-mib-00.

From: WashamFan <[email-masked]>
Date: Thu, 12 Feb 2009 15:59:23 +0800

Hi,

bullet 1:
  "Unauthorized modifications may either cause increased 
   memory consumption or turn off the capability to 
   retrieve notifications using GET class operations."

In what case, a attack could turn off the capability to
use GET? Could you elaborate it?

bullet 2:
  "Unauthorized modifications to enable
   notification generation may be used as part of a denial of service
   attack against a network management system if for exampe the
   syslog server accepts unauthorized syslog messages."

Does 'syslog server' refer to 'syslog-to-snmp converter'?
Do you mean many unauthorized syslog messages are converted
to SNMP notification to be sent out in this case?

Thanks,
Washam

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 12 Feb 2009 10:03:28 +0100

> use GET? Could you elaborate it?

Here is the full quote:

   o  syslogMsgTableMaxSize: This object controls how many entries are
      kept in the syslogMsgTable.  Unauthorized modifications may either
      cause increased memory consumption or turn off the capability to
      retrieve notifications using GET class operations.  This be used
      to hide traces of an attack.

If you look at the definition of syslogMsgTableMaxSize, it should be
obvious that setting this to 0 means not cache of syslog messages
exists. Do you think this is not obvious? OK, since you asked, I will
try to explain this better.
 
> to SNMP notification to be sent out in this case?

Yes, I will s/syslog server/SYSLOG to SNMP converter/ here and fix the
spelling of example.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: WashamFan <[email-masked]>
Date: Thu, 12 Feb 2009 18:32:12 +0800

>  try to explain this better.

Maybe this is obvious to some people, I am not sure. But, It would help
if you explain this better, I think.

Washam

---

From: "David Harrington" <[email-masked]>
Date: Thu, 12 Feb 2009 10:07:44 -0500

Hi,

>From the wording you used, I didn't find that obvious either. 

s/This be/This can be/

dbh

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Juergen Schoenwaelder
> Sent: Thursday, February 12, 2009 4:03 AM
> To: WashamFan
> Cc: [email-masked]
> Subject: Re: [OPSAWG] sec 9, syslog-msg-mib-00.
> 
> _______________________________________________
> OPSAWG mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsawg
>