Peter@BalaBit

Non-integrated system…

Friday, August 6, 2010 @ 12:08 PM Author: Höltzl Péter

Two interesting affair happened to me, which is a good example, that IT systems are not connected together in providers internal system: 1st affair: my bank placed a serious debit hold on my account, because one of the requirement was not realized (second child, which is a Hungarian governmental bank-loan support). They forgot to notice [...]

[.] Tovább

Trainings in Q3/Q4

Friday, August 6, 2010 @ 10:08 AM Author: Höltzl Péter

We have released training dates in the Q3/Q4: September: SPE-SSB-EN (3 nap) szeptember 14-15-16 (37. hét) November: SCB-EN (2 nap) november 9-10 (45. hét) You can apply for the trainings here. See you soon in Münich!

[.] Tovább

Prioritize messages in network traffic

Friday, August 6, 2010 @ 10:08 AM Author: Höltzl Péter

Sometimes our systems generate large amount of messages, which might flood our network. How can we prevent it, while we make sure that important messages will arrive for sure? Somehow we must prioritize messages by message class or other attribute? Of course our solution works on the client or (mainly) on relays. Fortunately we have [...]

[.] Tovább

Linux Academy 2010

Monday, July 12, 2010 @ 10:07 AM Author: Höltzl Péter

It was the third time I have given lectures an Linux Academy at Szerencs. This konference/training was 10 years old this year. Congratulations! This year I was speaking about syslog-ng (again), but only about classification and on-the-fly log analysis capability of syslog-ng. I think the presentation went really well. Next day we had a full-house [...]

[.] Tovább

A problem with classification and the solution

Friday, May 28, 2010 @ 03:05 PM Author: Höltzl Péter

I have just found a problem with message classification. We have a message, which describes a user login. Let’s have an SSH message, but it can be anything: Accepted password for balabit from 192.168.56.1 port 12345 ssh2 Let’s see the meaning! The first part indicates it was a successful login (Accepted), than comes the authentication [...]

[.] Tovább

Cloud Computing

Friday, May 28, 2010 @ 03:05 PM Author: Höltzl Péter

Nowadays fashionable topic, cloud computing as every new technology brings new and unexpected security risks. A few weeks ago the Cloud Computing Alliance, which was formed in 2008 from providers and vendors, released a white paper about the most important threats on the new technology. They also listed the possible ways of handling them. You [...]

[.] Tovább

Away

Friday, April 23, 2010 @ 02:04 PM Author: Höltzl Péter

Ih has been a long time I haven’t posted. On one hand there were no time to think and write interesting posts, on the other hand I was doing my job: Training im Münster and travelling back on a tricky way (300km by taxi to Frankfurt) Teaching az home Giving the first CPE certificates Presentation [...]

[.] Tovább

CPE certificates from 2010

Wednesday, March 10, 2010 @ 11:03 AM Author: Höltzl Péter

We have moved forward again. From 2010 we issue CPE certificates about our trainings. if you need that, just indicate on the traning entry-form. The certificate do not contain CPE points, but hours, that helps everybody counting the points. It can be different for every profession. In addition CPE points are maximized if the training is product [...]

[.] Tovább

syslog-ng OSE: keep_hostname() bug

Friday, March 5, 2010 @ 03:03 PM Author: Höltzl Péter

I have just found a bug in syslog-ng OSE 3.1beta2. When you use keep_hostname(yes) in the options, then at those sources where this field is empty (e.g. messages arriving on /dev/log), it eliminates the hostname, somehow this way: myuser@myhost:~$ logger hello myuser@myhost:~$ grep hello /var/log/syslog myuser@myhost:~$ 2010-03-05T14:05:33+01:00 myuser[]: hello After the patch: myuser@myhost:~$ logger hello [...]

[.] Tovább

Funny spam

Monday, March 1, 2010 @ 01:03 PM Author: Höltzl Péter

I have an own server wich I mainene every day. Yesterday I got the following spam: Dear use of the acme.hu mailing service! We are informing you that because of the security upgrade of the mailing service your mailbox user@acme.hu settings were changed. In order to apply the new set of settings open this file: [...]

[.] Tovább