OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Han (han_at_mijncomputer.nl)
Date: Tue Aug 06 2002 - 07:37:30 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    Jan Johansson (janj+openbsdwenf.org) wrote:
    > On Tue, Aug 06, 2002 at 09:05:44AM +0200, Han wrote:
    > > #!/bin/sh
    > > /usr/sbin/tcpdump -e -n -tttv -r /var/log/pflog > /tmp/pflog.txt
    > > /usr/local/sbin/pf.pl
    > > rm /tmp/pflog.txt
    > > kill -HUP `cat /var/run/pflogd.pid`
    >
    > If you skip the filename in dshield.conf pf.pl will read from
    > standard in and you do not need the dangerous /tmp file handling.
    >
    > This is in my root crontab.
    > 0 */6 * * * /usr/sbin/tcpdump -n -e -tttv -r /var/log/pflog | /usr/local/sbin/pf.pl

    Ow off course. Somebody could put a symlink there. /me bad.

    Cya, Han.