Sun Solaris Sendmail - Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CONFIGURING DSMS REV 1 Manual

73
Step 1
Step 2
Step 3
Step 4
Step 5
S S
UN OLARIS
A STRM Sun Solaris Sendmail DSM accepts Solaris authentication events using
syslog. You can integrate Solaris Sendmail version 2.x with STRM. STRM records
all relevant events. Before you configure STRM to integrate with Solaris Sendmail,
you must:
Log in as root user.
Open the
/etc/syslog.conf
Forward the system's authentication logs to STRM by adding the following line to
the file:
mail.*; @<IP address>
Where
<IP address>
spaces to format the line.
Note: Depending on the version of Solaris you are running, you may need to add
additional log types to the file. Contact your system administrator for more
information.
Save and exit the file.
Enter the following command:
kill -HUP 'cat /etc/syslog.pid'
You are now ready to configure the sensor device within the STRM interface. To
configure STRM to receive events from a Solaris device, choose one of the
following options:
If you are using STRM 6.0, select Solaris Sendmail v2.x from the Sensor
•
Device Type drop-down list box.
• If you are using STRM 6.0.1 and above, select Solaris Operating System
Sendmail Logs from the Sensor Device Type drop-down list box.
For more information on configuring sensor devices, see the Managing Sensor
Devices Guide. For more information regarding your Solaris, see your vendor
documentation.
Configuring DSMs Guide
S
ENDMAIL
file.
is the IP address of the STRM system. Use tabs instead of