Subject: Where we're at
From: Chris Lonvick <[email-masked]>
Date: Tue, 1 Apr 2003 07:49:49 -0800 (PST)

Hi Folks,

The IESG has updated our milestones and I've updated our WG page:
  http://www.employees.org/~lonvick/index.shtml
This has the presentations from the 56th IETF and the minutes.

Right now, we need reviews of the syslog-sign ID and of the syslog-mib
ID.  Please look through those documents and provide your thoughts to
the mailing list.

Thanks,
Chris

------------------------------

Date: Fri, 04 Apr 2003 11:24:38 +0100
From: "[email-masked]" <[email-masked]>
Subject: FYI: implementation of syslog-sign now on SF.net

Hello All,

To keep you informed, I have uploaded my implementation of syslog-sign
(based on draft-07) to sourceforge.

Info can be found on
	http://sourceforge.net/projects/syslog-sec/

Note: Today (April 4), the CVS Repository does contain incorrect files.
It is corrected, but it will take a day or so, before the correct files
are publicly visible.

The downloadable file is correct. And contain the latest sources to
insert syslog signatures in (FreeBSD's) syslog deamon.

Comment's are welcome.

Note, changes and updated will be made, someday :-)
- -- 
- --ALbert Mietus
Send prive mail to:        albert _at_ ons-huis . net
Send business  mail to:  albert . mietus _at_ PTS .nl

------------------------------

Date: Tue, 08 Apr 2003 10:05:28 -0400
From: [email-masked]
Subject: I-D ACTION:draft-ietf-syslog-sign-10.txt

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Security Issues in Network Event Logging Working Group of the IETF.

	Title		: Syslog-Sign Protocol
	Author(s)	: J. Kelsey, J. Callas
	Filename	: draft-ietf-syslog-sign-10.txt
	Pages		: 35
	Date		: 2003-4-7

This document describes syslog-sign, a mechanism adding origin
authentication, message integrity, replay-resistance, message
sequencing, and detection of missing messages to syslog. Syslog-sign
provides these security features in a way that has minimal
requirements and minimal impact on existing syslog implementations.
It is possible to support syslog-sign and gain some of its security
attributes by only changing the behavior of the devices generating
syslog messages. Some additional processing of the received syslog
messages and the syslog-sign messages on the relays and collectors
may realize additional security benefits.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-syslog-sign-10.txt

To remove yourself from the IETF Announcement list, send a message to
ietf-announce-request with the word unsubscribe in the body of the message.

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-ietf-syslog-sign-10.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-ietf-syslog-sign-10.txt".

NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

------------------------------

Date: Fri, 11 Apr 2003 19:20:07 -0700 (PDT)
From: Chris Lonvick <[email-masked]>
Subject: IETF 56 Proceedings Submission Cutoff Date MON, APR 14th (fwd)

Hi,

Our materials look correct on the web page.

Thanks,
Chris

- ---------- Forwarded message ----------
Date: Fri, 11 Apr 2003 14:40:41 -0400
From: IETF Proceedings Administrator <[email-masked]>
To: [email-masked], [email-masked]
Subject: IETF 56 Proceedings Submission Cutoff Date MON, APR 14th

This message is for all group chairs who met at the 56th IETF in San
Francisco.

Please make sure all of your meeting materials have been submitted and
are listed at:
www.ietf.org/proceedings/03mar

If you group is not listed or materials are missing, please contact
[email-masked].

The cutoff date for all material submissions is Monday April 14ht (last
weekend to finish).

Thank you,
IETF Proceedings Administrator

------------------------------

Date: Mon, 21 Apr 2003 06:40:33 -0700 (PDT)
From: Chris Lonvick <[email-masked]>
Subject: Where We're At with syslog-sign

Hi Folks,

http://www.ietf.org/internet-drafts/draft-ietf-syslog-sign-10.txt

Overall this is looking pretty good.  I believe that there are two
outstanding issues which have been discussed on the mailing list but
havn't been resolved in the document:

 - The number of "space" characters between the fields (see notes from
   Albert Mietus -
http://www.mail-archive.com/[email-masked]/msg01121.html )

 - A statement about the length of syslog messages.  I don't think that
   anyone likes a hard limit of 1024 characters.

Beyond that we're going to need a thorough Security Concerns section.  The
five core drafts in the SecSH WG have been delayed because their Security
Concerns sections have not been as expansive as our ADs would like.  Steve
Bellovin commented that he has been working hard in ID reviews to ensure
that WG documents have sufficient Security Concerns sections.  ..and he
expects documents coming from the Security Area to have exemplary ones.  I
suspect that our own documents will be scrutinized closely for that as
well.  I think that we can use a lot of what's been going on in the SecSH
WG discussions as a template for syslog-sign.

I'd like to see some comments/discussion about the first two items above.
Hopefully the Security Concerns discussion on the SecSH WG list will
produce something that we can work into syslog-sign as well.  :-)

Thanks,
Chris

------------------------------

Date: Thu, 24 Apr 2003 08:31:35 -0600
From: [email-masked]
Subject: Remote syslog message retrieval

I have a question for consideration.

I was looking over the draft syslog mib and wondered why there is no
mechanism to retrieve messages that have been stored locally on the remote
device?

I realize that under normal operation the device would be sending its syslog
messages to a syslog server. However, there are situations where the syslog
server may have been unreachable for a period of time. It would be nice if
the locally-stored messages could be read via SNMP.

Brett

------------------------------