topic Re: Gathering Information in Operating System - HP-UX

Gathering Information

Brian butler — Tue, 07 Jan 2003 15:00:54 GMT

Ok im not all the familiar with unix, but today i was prompted by my boss to find out some information, apparently we are getting audited. I was able to gather most of the information on my own, i.e. password files, and crontabs, and much more but I have a question about a couple of commands that are used to gather information.
1. Listing of all directories without ???sticky-bit???.
2. Listing of all root owned files.
3. Listing of all world writeable directories.
4. Listing of all user directories writeable by others.

It would be great if somebody could point me in the right direction to find this information.

Thanks
BPB

Re: Gathering Information

harry d brown jr — Tue, 07 Jan 2003 15:03:49 GMT

Use the "find" command:

man find

live free or die
harry

Re: Gathering Information

Marco Santerre — Tue, 07 Jan 2003 15:08:00 GMT

I know this won't answer your question, but because I have gone through this exercise not so long ago myself, I have discovered a neat little software that HP produced called IDS/9000 (Intrusion detection Software). All four elements that you are looking for, are being monitored whenever changes occurs on your system to create these events. Also this software is centralized on one machine, therefore removing the possibilities of changing the events in the log file. Without going in too much details cause, again I'm not answering your questions, it may be something you want to look into for future use.

Re: Gathering Information

Steve Steel — Tue, 07 Jan 2003 15:08:22 GMT

Hi

Find is correct,check it and

http://www.introcomp.co.uk/hpux/index.html

Will give good example scripts for all sorts of things

Regards

Steve Steel

Quote of the moment
-------------------
"We are drowning in information but starved for knowledge."
-- John Naisbitt

Re: Gathering Information

RAC_1 — Tue, 07 Jan 2003 15:13:29 GMT

1 find . ! -perm 1777 -depth -print

2 find . -user root -depth -print

3 find . -type d -perm 1777 -depth -print

4 find . -type d -perm 066 -depth -print

Re: Gathering Information

harry d brown jr — Tue, 07 Jan 2003 15:14:39 GMT

1. find / -type d \( ! -perm -1000 \)

2. find / -type f -user root

3. find / -type d -002

4. same as 3

live free or die
harry

Re: Gathering Information

Juerg DENNEBERG — Wed, 08 Jan 2003 10:28:52 GMT

Hi Marco

where may I find this IDS/9000 Software?

Thanks

J??rg

Re: Gathering Information

Robert-Jan Goossens — Wed, 08 Jan 2003 10:50:47 GMT

Hi,

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=J5083AA

Robert-Jan.

Re: Gathering Information

W.C. Epperson — Wed, 08 Jan 2003 13:43:16 GMT

A logistical note:

I recently went through a systems audit where such things were requested. Iteratively with minor variations. Over and over.

I finally persuaded the auditors to let me give them a "find / -print|xargs ls -ld" output for them to "grep" on. The finds were killing my servers.