topic Re: Security Concern in Operating System - HP-UX

Security Concern

Avinash20 — Tue, 04 Dec 2007 08:26:05 GMT

Friends,

I like to have the following to be done on my server:

Information to be logged
- Login Successes and Failures
- Addition / Deletion / Modification of Users
- Changes to Security Settings
- Changes to Logging and Auditing Settings
- Service Access Logs e.g. FTP, Telnet, SSH etc
Login Control
After successful login, every user must be given information reflecting the last login time, date and details of any unsuccessful login attempts since the last successful login.

Terminal Timeout
Inactive Terminal Session (Telnet, SSH, tty, vty, sessions) must be set to a timeout of 15 minutes

any response is highly appreciated

Re: Security Concern

Kapil Jha — Tue, 04 Dec 2007 09:10:27 GMT

>>>Login Successes and Failures
It is already logged in wtmp files and you may use "last" command to see when a particular user was logged in.

>>>Inactive Terminal Session
there is a variable TMOUT you can set it to according to your requiredment.

>>>Addition / Deletion / Modification of Users
M not sure about any tools but you can write a script which will tell you whenever thers is some modification in /etc/passwd file.

I suppose you need some tool or you'll have to wrie script for each.
BR,
Kapil

Re: Security Concern

Avinash20 — Tue, 04 Dec 2007 09:37:33 GMT

Any further suggestion will be more helpful

Re: Security Concern

Shrikant Lavhate — Tue, 04 Dec 2007 10:16:01 GMT

>Service Access Logs

for logging FTP logs that is incoming and outgoing FTP file transfers, insert the-i and -o options with the ftp entry in the /etc/inetd.conf file. like this:
ftpd -a -l -d -i -o

The logs will be saved into /var/adm/syslog/xferlog.

Re: Security Concern

Jeeshan — Tue, 04 Dec 2007 10:55:35 GMT

Hi Avinash

Did u convert your system in trusted mode. You can do your queried security concern in trusted system

- Login Successes and Failures
If trusted you can get message
- Addition / Deletion / Modification of Users
If u use SAM to do so you have sam.log to view
- Changes to Security Settings
its in trusted system
- Changes to Logging and Auditing Settings
you can do also in trusted system
- Service Access Logs e.g. FTP, Telnet, SSH etc
you can view the syslog.log to view such like messages if your syslog process has entry for this services
-Login Control
if your system in trusted mode user can also see the message of successful and unsuccessful logins
Terminal Timeout
for telnet edit file in /etc/default/security
and for other terminal use their individual configuration files

Re: Security Concern

Avinash20 — Wed, 05 Dec 2007 12:31:34 GMT

Thanks everyone:

http://docs.hp.com/en/B2355-90950/ch08.html

This will help.

Re: Security Concern

Sp4admin — Wed, 05 Dec 2007 16:02:11 GMT

Hello Avinash,

you can also use SAM's auditing. For system calls and other command.

sp,

Re: Security Concern

Avinash20 — Sat, 29 Mar 2008 05:48:59 GMT

Above url helped