>"Ryan Purita" <ryan@totally-connected.com> wrote: >The file psd.conf should be owned by root and its mode 600. Only if a person gets root access in that box, she could read the password. Lots of applications relay on that, for instance, snort, which is used by Demarc PureSecure, stores the SQL password in plain text in snort.conf. ------- But why do the agents need "DROP" privileges on the database? In my mind for any "secure" logging system the agents should have append only access, that is the ability to create new entries. Not modify or remove old ones. If an attacker breaks into a Puresecure agent they can now flush out any traces of their attack and future attacks on the server. Seeing as how this product is aimed at major deployment (i.e. multiple sensors) including installation on end systems (running all sorts of potentially vulnerable services, or simply having hostile users with local access already....) this creates a huge number of oppurtunities for an attacker. Is it just me or does anyone else think such as system where the agents have the ability to remove any trace of an attack once they are compromised is a bad thing? Kurt Seifried, kurt@seifried.org A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 http://seifried.org/security/
