topic Re: Audit trail in Operating System - HP-UX

Audit trail

Tom Gore — Thu, 26 Feb 2004 13:40:01 GMT

Is there a way to determine when/who changed a shell script? Also, is there a way to produce a listing of users who have not logged into the system within the last "nn" days. Since the introduction of the Sarbanes-Oxley Act, we are now required (by our auditors) to provide numerous "audit trail" reports. Virtually all movement through the system has to be accounted for and documented.

Thanks

Re: Audit trail

David Child_1 — Thu, 26 Feb 2004 13:46:01 GMT

If you set your system to Trusted there is a quite a bit of auditing you can do.

David

Re: Audit trail

Paula J Frazer-Campbell — Thu, 26 Feb 2004 13:48:20 GMT

HI

For login info here:-

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=39611

ll <scriptname> will show owner, group time and date.

Also set-up and use change control procedures.

Paula

Re: Audit trail

Sridhar Bhaskarla — Thu, 26 Feb 2004 13:52:27 GMT

Hi Tom,

Unless you turn the 'auditing' on, it's difficult to find out who changed what on the system. There are softwares like CA's eTrust Access-control, powerbroker etc., that can provide additional controls in addition|replacing the standard UNIX permissions along with excellent reporting.

If this system is trusted, you can get this information easily with getprpw command.

/usr/lbin/getprpw -m slogint

will tell you when the user logged in successfully.

To find out the users that have not logged into the system exactly within the last 'n' days, you will need to write a small script. Calculate the seconds since epoch with ' /usr/contrib/bin/perl -e "printf("%d\n",time())" ' - say A. Then in each user's tcb files /tcb/files/auth//user) you will find seconds since epoch when the user successfully logged in - say B. Calculate (A - B)/86400 and compare it against 'nn'.

Without trusted system, you will need to depend on 'last' command. It shows it in days which you will need to convert into epoch and then do the calculations. Also last may not provide 100% information as *tmp files it uses might have gotten trimmed.

-Sri

Re: Audit trail

Tom Gore — Fri, 27 Feb 2004 09:35:42 GMT

Thanks to all. For whatever reason, they have chosen not to implement our system as "trusted". I like the idea of the script to monitor logins. At least I can check that off my "to do" list. The shell script thing is more of a paper trail thing. There are only three of us that even have command access to the system.