HardenedBSD/etc/newsyslog.conf

# configuration file for newsyslog
# $FreeBSD$
#
# logfilename          [owner:group]    mode count size when [ZB] [/pid_file] [sig_num]
/var/log/cron				600  3	   100  *     Z
/var/log/amd.log			644  7	   100  *     Z
/var/log/kerberos.log			644  7	   100  *     Z
/var/log/lpd-errs			644  7	   100  *     Z
/var/log/maillog			644  7     *    @T00  Z
/var/log/sendmail.st			644  10    *    168   B
/var/log/messages			644  5	   100  *     Z
/var/log/all.log			600  7     *    @T00  Z
/var/log/slip.log			600  3	   100  *     Z
/var/log/ppp.log			600  3	   100	*     Z
/var/log/security			600  10    100  *     Z
/var/log/wtmp				644  3	   *	@01T05 B
/var/log/daily.log			640  7	   *	@T00  Z
/var/log/weekly.log			640  5	   1	$W6D0 Z
/var/log/monthly.log			640  12	   *	$M1D0 Z
/var/log/console.log			640  5     100	*     Z
added the file /etc/newsyslog.conf (config file for /usr/sbin/newsyslog - see the man-page for it for details) - i put all the "rotations" which were in /etc/[daily,weekly,monthly] in here 1996-01-05 11:24:03 +01:00			`# configuration file for newsyslog`
$Id$ -> $FreeBSD$ 1999-08-28 01:37:10 +02:00			`# $FreeBSD$`
added the file /etc/newsyslog.conf (config file for /usr/sbin/newsyslog - see the man-page for it for details) - i put all the "rotations" which were in /etc/[daily,weekly,monthly] in here 1996-01-05 11:24:03 +01:00			`#`
Syntax for user/group is changed from "user.group" to "user:group" to be consistant with chown(8). 1999-06-28 05:15:02 +02:00			`# logfilename [owner:group] mode count size when [ZB] [/pid_file] [sig_num]`
Move /var/cron/log to /var/log/cron 1999-09-06 22:10:27 +02:00			`/var/log/cron 600 3 100 * Z`
Change various log file modes from mode 664 to 644. Allowing group wheel to trash logfiles is not exactly good security policy. There have been several gid wheel holes in ports. Various other files were changed as well (eg: the locate database were set to more restrictive modes (444) by their generation scripts) so this should be safe for them. utmp and wtmp are mode 644 already on all the systems we checked. Submitted by: jkb Reviewed by: kris 2000-07-14 03:12:50 +02:00			`/var/log/amd.log 644 7 100 * Z`
			`/var/log/kerberos.log 644 7 100 * Z`
			`/var/log/lpd-errs 644 7 100 * Z`
			`/var/log/maillog 644 7 * @T00 Z`
			`/var/log/sendmail.st 644 10 * 168 B`
			`/var/log/messages 644 5 100 * Z`
Add two commented out syslog.conf entries, one to demonstrate the use of an all.log for logging all messages, and one to demonstrate use of loghosts. Also, a matching entry in newsyslog.conf for all.log. Per request of Garrett Wollman, also modified the maillog entry to use the @T newsyslog time specification mechanism. Because newsyslog doesn't support the mod date specification machanism, couldn't change other entries that required more than one execution a month, but less than once a day. Approved by: jkh Reviewed by: freebsd-security 2000-02-08 22:57:28 +01:00			`/var/log/all.log 600 7 * @T00 Z`
Change the header line to read "count" instead of "ngen" so that it matched the terms used in the manual page. Closes PR# 2663. 1997-02-05 15:17:11 +01:00			`/var/log/slip.log 600 3 100 * Z`
Fix ppp log name 1997-06-10 22:39:10 +02:00			`/var/log/ppp.log 600 3 100 * Z`
This is the addition of a syslog(3) security.* top-level category. This should be used from now on for anything security but not auth-related. Included are updates for all relevant manpages and also to /etc files, creating a new /var/log/security. Nothing in the system logs to /var/log/security yet as of the time of this commit. Reviewed by: rgrimes, imp, chris 1999-08-21 20:24:29 +02:00			`/var/log/security 600 10 100 * Z`
Now that newsyslog is capable of doing this at a specific time, let it rotate /var/log/wtmp again, and update monthly/200.accounting to take this into account. (Some sites might want to change the parameters of the rotation; it's easier to do this when it's all centralized in newsyslog.conf.) 1999-01-28 21:03:31 +01:00			`/var/log/wtmp 644 3 * @01T05 B`
Another overhaul of the periodic stuff. All periodic sub-scripts <larf> now have their return codes interpreted by periodic(8). Output may be masked based on variable values in periodic.conf. It's also now possible to email periodic output to arbitrary addresses, or to send it to a log file, examples of which can be found in newsyslog.conf. The upshot of it all should be no discernable changes to the default behaviour of periodic(8). PR: 21250 2000-09-14 19:19:15 +02:00			`/var/log/daily.log 640 7 * @T00 Z`
			`/var/log/weekly.log 640 5 1 $W6D0 Z`
			`/var/log/monthly.log 640 12 * $M1D0 Z`
Log the console output to "/var/log/console.log", not "/var/log/console" (MFC candidate) 2001-02-17 21:27:58 +01:00			`/var/log/console.log 640 5 100 * Z`