next up previous contents
Next: Attaining low ports with Up: Implementation Previous: Enhancing functionality   Contents


Excessive logging and privacy concerns

ProtoWrap can log its activity in five different verbosity levels. This was done in order to allow the system administrator to have a proven wrapper be as quiet as possible, reporting only fatal errors and exceptions, or to be helpful when developing new modules or debugging incorrect operation, reporting every single byte and the way it was reacted upon. All the logging is done using the central Unix Syslog facility.

Being too verbose raises some privacy concerns - everything gets recorded. User passwords, the whole text to users' email messages, everything. It is strongly suggested not to use the three more verbose levels (3, 4 and 5) except when absolutely necessary.

Besides the privacy concerns, the logs get saved to a hard disk. Super-verbose logging has a lot of overhead, giving very abundant extra information on each line. Logging too much can easily fill up the logging partition, and valuable log data could be lost. An attacker could easily abuse this to erase the tracks of what he had just done to the system.

Reading logs is also a very important daily task that every administrator should religiously do. If the logs are too large, important information can be missed, endangering the whole system.

On the other side, being too conservative with the amount logged can lead us to ignore useful information.

The author strongly reccomends a log level of 1 or 2 for normal operation, and 3 or --at most-- 4 for normal debugging. Level 5 (ultra-verbose) should only be used to monitor behavior while developing new modules. Level 0 should be avoided, as it leaves very important information not logged..


next up previous contents
Next: Attaining low ports with Up: Implementation Previous: Enhancing functionality   Contents
Gunnar Wolf
2001-03-12