topic Re: Auditing without TCB in Operating System - HP-UX

Auditing without TCB

Scott Stewart — Thu, 08 Jul 2004 15:02:08 GMT

We are evaluating a product which centralizes audit logs from our various platforms (UX, AIX, Solaris, Linux). Can system auditing be activated on UX without activating TCB? We use NIS pretty heavily and can't make the conversion to NIS+ or something else at the moment.

Thanks!
Scott

Re: Auditing without TCB

Michael Tully — Thu, 08 Jul 2004 15:06:26 GMT

There is a product called e-Trust from CA, that does some of this type of thing. something to think about. I'm sure there will be more answers to this.

Re: Auditing without TCB

Geoff Wild — Thu, 08 Jul 2004 15:33:53 GMT

Yes - you can.

Check out Unix Control:

http://www.tfstech.com/index.htm

Rgds...Geoff

Re: Auditing without TCB

Sridhar Bhaskarla — Thu, 08 Jul 2004 15:46:59 GMT

Hi Scott,

Interestingly SAM doesn't allow you to configure auditing without converting the system to trusted but you can turn on|off auditing using audsys command. Atleast on 11i. Very recently, I tried it and I was suprized to see it worked. I didn't go further on it but I believe it should give you what you need but I am not sure on it's supportability.

-Sri

Re: Auditing without TCB

Darren Prior — Fri, 09 Jul 2004 04:55:43 GMT

Hi Scott,

There was a thread on using auditing on a non-trusted system fairly recently so it's worth having a quick search of the forums.

This thread mentioned that someone did get auditing working on a non-trusted system... However, it's not supported by HP in this configuration. One of the problems is that the audit ids are stored within the /tcb area, without the audit id auditing becomes less useful!

regards,

Darren.