topic Re: Shell scripts for the following in Operating System - HP-UX

Shell scripts for the following

ShivKumar_1 — Wed, 28 Feb 2001 21:46:37 GMT

Hi Experts
I have the following requirement from my client , he wants shells scripts to monitor the following processes. The client has a NIS environment so he cannot have a trusted system or turn the auditing on. I am aware about the tools like TRIPWIRE, AXENT, Bigbrother, COPS etc but I wanted to specifically know if there were any tools to monitor the following. Thanks in advance

ShivKumar
---------------------------------------------------
Each system must generate a security alaram by which to alert the
administrator of a potential security or
suspicious activity Eg: High volumes of bad packet data or corrupted
data.
The alarm must be activated by the following events

1) Five consecutive unsucessful login attempts during a single session
2) Sucessful modification of critical system or application files
3) Sucessful and unsucessful attempts to gain permission or assume
identitiy
of another user
4) Upon sucessful login the system must display the date and time of
last
sucessful logins
5) Each system must maintain a list of security files which is
accesible by
the administrator of the following events

a) Sucessful and unsucessful events
b) Sucessful and unsucessful attempts to switch to another user's
account
c) All changes to system security ,including adding users
d) Operating system configuration changes
e) Logoffs
f) Inactive user sessions

6) Disabling inactive userids which were inactive for more than 15 days
7) No reuse of the same password used in the past

Re: Shell scripts for the following

Tim Malnati — Wed, 28 Feb 2001 23:34:21 GMT

I guess it's time to address this more directly...

You asked this question in http://forums.itrc.hp.com/cm/QuestionAnswer/1,1150,0x95b16af52b04d5118fef0090279cd0f9,00.html and I gave you a response. You then asked again in http://forums.itrc.hp.com/cm/QuestionAnswer/1,1150,0x96b16af52b04d5118fef0090279cd0f9,00.html and some others gave you a response. You then ask yet again in http://forums.itrc.hp.com/cm/QuestionAnswer/1,1150,0x9db16af52b04d5118fef0090279cd0f9,00.html an Bill Hassell gave you a very long and detailed (point by point) response to it all.

So now you are asking again? What do really want, the forum population to write these scripts for you? I don't think it's going to happen. As far as I can tell, that is what your client is paying you to do. If it's a case where your client isn't willing to foot the bill for you or someone else to an extensive rewrite of things in script form to his specifications, then he will need to live with what's available for free. A previous mentor of mine stated, "In the computer business, TIME and MONEY will get you anything". You are offering neither here; you can't seem to be bothered enough to award points either.

Re: Shell scripts for the following

Tom Danzig — Thu, 01 Mar 2001 01:26:57 GMT

Absolutely classic ...

Re: Shell scripts for the following

Shannon Petry — Thu, 01 Mar 2001 17:47:05 GMT

As has been pointed out previously by Bill Hassel NO system running NIS can be secure! Most of what you want is kind of scriptable, but somewhere consessions MUST be made.

I agree also that it appears that by posting the same question 3 times and obviously not getting the answer you want you may not be qualified to deel with this customer.

Maybe your customer needs to call a new consultant!

Regards,
Shannon

Re: Shell scripts for the following

Dieter Degrendele_1 — Fri, 16 Mar 2001 17:43:30 GMT

Hi,

The sysadmin magazine did something about this subject. go to their site www.sysadminmag.com

Rgds,
DD

Re: Shell scripts for the following

Paula J Frazer-Campbell — Sun, 18 Mar 2001 13:19:21 GMT

Well said Tim

;^)

Paula