topic Re: security script in Operating System - HP-UX

security script

Paula J Frazer-Campbell — Fri, 27 Oct 2000 10:26:45 GMT

Hi to all.

I am looking at writing a script that will on being run FTP copies of system log files to another server. So that in the event of a security problem I can concentrate on fixing and bring the attacked sever back on line and then later do an offline investigation.

Well guys/gals what are your thoughts on this?

Is it feasible to set up a list of all the files that may show an intruders footsteps?

And if so which file do you include - some are very obvious (wtmp,btmp,syslog etc)but what are the less obvious?

Awaiting your ideas-
Paula

Re: security script

CHRIS_ANORUO — Fri, 27 Oct 2000 11:06:22 GMT

You can use /var/adm.inetd.sec to restrict access to your system. It provides additional security.
Also check /var/adm/sulog.

Re: security script

Ossie de Jongh — Fri, 27 Oct 2000 11:40:31 GMT

Hi Paula,
Your problem will be as follows:
If someone gets into the system, he/she will always try to wipe their prints. So depending on what level of access they get to you system will basically determine how well they can wipe their prints. Most damaging obviously being root.

Besides they few obvious ones like wtmp,btmp,etc you should consider copieng some of these files as well:
passwd
shell history commands
acct files
crontab - yes nice way to reinstate access
syslog
maillog
nettlogs

This list might vary a lot depending on the setup of your system
Like: is accounting enabled?
are you running a secure system ?
etc

Hope you find some info to be usefull.

Re: security script

Paula J Frazer-Campbell — Fri, 27 Oct 2000 14:01:05 GMT

Hi and thanks to Chris and Ossie so far.
- points will be awarded.

The list so far is:-

1. wtmp
2. btmp
3. utmp
4. utmpx
5. syslog.log
6. passwd
7. groups
8. shell history
9. mail.log
10. netlogs
11. sulog
12. inetd.sec
13. crontab

Now the list is mainly log files, how about.

ll ?R |grep ?ATTACK_DATE? >attacked

and this file included in the routine?

Re: security script

Rick Garland — Fri, 27 Oct 2000 14:18:51 GMT

There is a SW app called Tripwire that will keep tabs on what has been modified. You can configure the files it is to watch and it can tell you if changes have occurred.

Can be obtained from the COAST security site.

Re: security script

Paula J Frazer-Campbell — Tue, 31 Oct 2000 08:54:21 GMT

Thanks Chris Ossie and Nick,

Points have been awarded.

Best wishes
Paula

Re: security script

Paulo Afonso Bruno — Tue, 31 Oct 2000 17:51:21 GMT

Rick

do you know what is internet address this sw ( SW Tripwire ) ?

thank?s
Paulo

Re: security script

Paulo Afonso Bruno — Tue, 31 Oct 2000 17:51:38 GMT

Rick

do you know what is internet address this sw ( SW Tripwire ) ?

thank?s
Paulo

Re: security script

Paulo Afonso Bruno — Tue, 31 Oct 2000 17:52:06 GMT

Rick

do you know what is internet address this sw ( SW Tripwire ) ?

thank?s
Paulo

Re: security script

Paula J Frazer-Campbell — Tue, 31 Oct 2000 17:55:25 GMT

Hi
Address for tripwire is
http://www.tripwiresecurity.com/products/

Re: security script

Paulo Afonso Bruno — Tue, 31 Oct 2000 18:07:38 GMT

Thanks Paula