topic Re: Capturing tool in Operating System - HP-UX

Capturing tool

wahab — Tue, 23 Dec 2003 00:04:53 GMT

Dear Colleagues,

As a security administrator I am supposed to takeover our HP-UX system security administration from our production system administrators.
I am looking for a tool that allows me to take snapshot of the current system situation, which reflects the status of the system at the takeover time.

Re: Capturing tool

Steven E. Protter — Tue, 23 Dec 2003 00:11:03 GMT

There is a very good system snapshot tool in the Hands on with 11i course. My book is 15 miles away, so I'll post back in the morning.

Another way to get a good snapshot, if you have somewhere to install it is make_tape_recvoery

You take a copy of vg00 and you've got a great picture of where a system is.

tripwire security tool comes to mind and will track changes to configuration files for you.

I'll try and get back you in the morning.

SEP

Re: Capturing tool

Michael Tully — Tue, 23 Dec 2003 00:27:52 GMT

As part of the ignite suite of tools, you can use print_manifest to get a snapshot of the system. From a security standpoint, there are a number of tools around, nessus, satan, tripwire and the like. You could always turn on the system auditing for a period of time to track system events. As part of our security, we use an in-house script thet tracks changes to certain files and reports the difference between the new and the old.

Re: Capturing tool

wahab — Tue, 23 Dec 2003 01:03:25 GMT

Dear Michael,
what are these files?
if possible can you send to my e-mail
the script.

Thanks,

Re: Capturing tool

T G Manikandan — Tue, 23 Dec 2003 01:26:01 GMT

Ignite is a software which is available here

http://software.hp.com/products/IUX

Take a look at the web page

All the commands Micheal suggested will be available once the software is loaded

Re: Capturing tool

Tony Romero_1 — Tue, 06 Jan 2004 12:56:31 GMT

I highly recommend you use sysinfo for this. It gives you all everything you need to know regarding system data such as hostname, ip, logical and group volumes, etc, etc.