topic Auditing without Trusted System in Operating System - HP-UX

Auditing without Trusted System

Tonya Underwood — Wed, 25 Jan 2006 15:41:29 GMT

Is there a way to audit files/directories/logins without enabling trusted system?

Re: Auditing without Trusted System

Tonya Underwood — Wed, 25 Jan 2006 15:58:43 GMT

Let me clarify... audit directories

using the following audits:
Admin
Close
Create
Delete
Modaccess
Moddac
Open
Process - is it possible to restrict this to processes generated by command line access from a login? (i.e., I don't necessarily need to know about automated app processes, just commands run from a login shell)
Removable
Login

Thank You
Tonya

Re: Auditing without Trusted System

Deoncia Grayson_1 — Wed, 25 Jan 2006 16:58:41 GMT

From what I read you cannot audit an hpux server without converting to a trusted server, but maybe these threads can be of help:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=969783

and this document:

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUX-HIDS

Re: Auditing without Trusted System

Sundar_7 — Wed, 25 Jan 2006 17:06:10 GMT

Tonya,

Are you running 11.11 or 11.23 ? It is possible to enable auditing in 11.23 without converting the system to trusted.
http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=SecurityExt

But why would you not want to trust the system ?

Sundar

Re: Auditing without Trusted System

Tonya Underwood — Wed, 25 Jan 2006 19:19:34 GMT

11.00 :(

My customer has stated that it will cause problems with the applications. We are trying to understand the reason why, but this information is difficult to get.

Re: Auditing without Trusted System

Tonya Underwood — Wed, 25 Jan 2006 19:36:49 GMT

OK... so we must trust!! :)

Can I turn on auditing selective filesystems? Turn off auditing on some filesystems? How?

Thanks,
Tonya

Re: Auditing without Trusted System

Deoncia Grayson_1 — Thu, 26 Jan 2006 17:21:41 GMT

Look at this document for more information on auditing:

http://docs.hp.com/en/B2355-90121/ch02s05.html

Re: Auditing without Trusted System

Tonya Underwood — Fri, 27 Jan 2006 08:09:08 GMT

Yes, I've read that document. It does not address this issue. Does all this silence mean nobody knows? If there is a way, I do not see it documented. I was hoping someone had found a flat file you can modify, something...

Tonya

Re: Auditing without Trusted System

Bill Hassell — Fri, 27 Jan 2006 09:12:31 GMT

The choices for auditing are shownj in SAM. Since auditing occurs at the kernel level, individual files and directories can't be differentiated. You can audit reads and writes (which the kernel understands) but the actual filename is part of the user space. A user program requests that a file be opened by communicating with the LVM and filesystem code and gets back a file descriptor block. Reading and writing that file requires the filesystem code to translate the record in the file into an lvol block and the LVM code translates this into an actual kernel read/write request for the disk (which can be audited).

Re: Auditing without Trusted System

Tonya Underwood — Fri, 27 Jan 2006 09:17:30 GMT

I see... that explains it. Thanks!