topic Re: audit users actions in Operating System - HP-UX

audit users actions

Nabil Boussetta — Mon, 31 Oct 2005 06:00:12 GMT

i'd like to audit users actions. should i convert my system to a trusted system ?

Re: audit users actions

GGA — Mon, 31 Oct 2005 06:08:23 GMT

hello
u have many advantages if u are convert to the trusted system

look this link too:
http://docs.hp.com/en/B2355-90121/index.html
regrads gga

Re: audit users actions

RAC_1 — Mon, 31 Oct 2005 06:14:49 GMT

You will have to.
When you convert to trusted mode all passwords will expire. To take care of this do /usr/lbin/modprpw -V

If you use SAM to convert to trusted mode, you do need to use /usr/lbin/modprpw -V

Re: audit users actions

Nabil Boussetta — Mon, 31 Oct 2005 06:25:56 GMT

is there some disadvantage when converting to a trusted system.
why HP don't give this functionnality by default ?

Re: audit users actions

RAC_1 — Mon, 31 Oct 2005 06:33:46 GMT

There is a very little overhead when converted to trsuted mode. Why HP does not give this a as default will have amny answers.

For you information, with 11i V2 next realease trusted mode will be oboletet. It is being replaced by trusted security extension product. (or something smimilar. Look/search at hp)

Re: audit users actions

GGA — Mon, 31 Oct 2005 06:37:37 GMT

hello
there is "more" administrative task to do

regrads gga

Re: audit users actions

Nabil Boussetta — Mon, 31 Oct 2005 06:54:11 GMT

someone tells me that you C compiler and graphical interface will not function.

is that true ?

Re: audit users actions

RAC_1 — Mon, 31 Oct 2005 06:59:10 GMT

Almost everything will function as it is. Some applications that depend on getpwent may be needed to adjust. Now they should be maing getpwnam sys call.

Re: audit users actions

DCE — Mon, 31 Oct 2005 09:56:49 GMT

If you want to audit user actions, then converting to trusted mode will allow you to do that.

After you convert to trusted mode you will have to activate the auditing - you can do this via SAM or the command line. Be aware that auditing can, and usually does, consume large amounts of disk space for the log files.

One more note - when you convert to trusted mode, any user password over 8 charactors will be truncated.

Re: audit users actions

Rick Garland — Mon, 31 Oct 2005 10:20:40 GMT

There is a utility that can work in conjunction with sudo. This utility is called 'rootsh' Have the users invoke rootsh via sudo commands and there will be a keystroke-by-keystroke log file with the output of user's commands.

Re: audit users actions

Geoff Wild — Mon, 31 Oct 2005 10:55:39 GMT

One of the reasons Trusted System isn't the default - is that it is supported by some third party apps.

Example - we use a a central managemanet system for controlling access to all our systems - whether they are HP, IBM, Sun or Linux.

Rgds...Geoff