Just read an interesting article about
the addition of 'Security Event Auditing' in FreeBSD 6.2. Until now FreeBSD hasn't had any really useful security auditing other than using 'accounting' to log all syscalls which at best was confusing when it came to working out who did what when and how.
At one time
I installed a kernel module lrexec to log all system exec calls, but this was also quite a handful to configure scripts so they reported only on certain users. Hopefully this new security auditing daemon will make security auditing a lot easier on FreeBSD.
Read the article for more info on what's new:
Security Event Auditing in FreeBSD 6.2
Also of interest is the new addition to the FreeBSD handbook on security auditing:
FreeBSD Handbook: Security Event Auditing
