topic Re: Detect configuration changes for SOX in Operating System - OpenVMS

Detect configuration changes for SOX

Wim Van den Wyngaert — Mon, 11 Dec 2006 08:21:05 GMT

For SOX reasons, I should be able to detect (unauthorized) configuration changes, t.i. changes to system procedures, configuarion databases, etc.

Is someone doing it already ? By preference with postable procedures and using standard VMS tools. If not postable, a description will also help me. I was thinking of some kind of checksum.

Wim

Re: Detect configuration changes for SOX

Ian Miller. — Mon, 11 Dec 2006 08:26:51 GMT

You could make a database with MD5 checksums of files.

I think pointaudit from pointsecure does this
http://www.pointsecure.com/

LJK/Security does
http://www.ljk.com/ljk/ljk_security.html

Re: Detect configuration changes for SOX

Karl Rohwedder — Mon, 11 Dec 2006 13:01:09 GMT

We run a simple DCL procedure at regular intervals which uses CHECKSUM to create a database of known checksums and compares it to the last run. Any differences are mailed to SYSTEM.

The call is:
- define a path logical of directories to be searched, e.g.
$ define CHECKSUM_PATH SYS$SYSTEM,SYS$SHARE,SYS$LOADABLE_IMAGES
- define some excludes
$ Checksummer_Exclude_1 = ...
- and call
$ @Checksummer *.EXE "" EXE
P1 - filespec
P2 - optional mail target, if not SYSTEM
P3 - tags database

Fount it somewhere on the internet and modified it a little.

Perhaps it gives some idea...

regards Kalle

Re: Detect configuration changes for SOX

Karl Rohwedder — Mon, 11 Dec 2006 13:04:14 GMT

Just noticed some garbage characters at the end of the attachment, which may be safely ignored.
(File was attached from a NFS Share on a VMS system on a Linux system...)

regards Kalle

Re: Detect configuration changes for SOX

Wim Van den Wyngaert — Tue, 12 Dec 2006 05:26:55 GMT

Kalle,

Do you also have the config of excludes and the paths that are used ?

It seems to do exactly what I need. Only due to DTSS the revision date is not always stable. I logged only hh:mm. And I also logged the file protection.

Wim

Re: Detect configuration changes for SOX

Karl Rohwedder — Tue, 12 Dec 2006 05:42:04 GMT

Wim,

here is full call sequence from here:

1. Image check
$ Define/NoLog CHECKSUM_PATH -
SYS$SYSTEM,SYS$SHARE,SYS$LOADABLE_IMAGES,SYS$STARTUP,CNC_MANAGER,MEN_PROC,CNC_DISK:[CNC_*MGR_*]
$ Checksummer_Exclude_1 = "SYS$SYSTEM:TERMTABLE.EXE"
$ Checksummer_Exclude_2 = "SYS$LOADABLE_IMAGES:SYS.EXE"
$ Checksummer_Exclude_3 = "SYS$SYSTEM:NETSCAPE-EXPORT.EXE"
$ Checksummer_Exclude_Cnt = 3
$ @Cnc_manager:Checksummer *.EXE "" EXE

2. Procedure check:
$!__check procedures
$ Checksummer_Exclude_1 = "CNC_CLUMGR:SETRIGHTS.COM"
$ Checksummer_Exclude_2 = "SYS$SYSTEM:TNT$EMERGENCY_MOUNT.COM"
$ Checksummer_Exclude_Cnt = 2
$!__loop over TDC commandfiles to skip them from checksumming (they change every day)
$ TDC_Tmp = "SYS$MANAGER:TDC$*$*.COM"
$ TDC_1:
$ Nx = F$Search("''TDC_Tmp'")
$ If (Nx.nes."")
$ Then
$ Checksummer_Exclude_Cnt = Checksummer_Exclude_Cnt + 1
$ Checksummer_Exclude_'Checksummer_Exclude_Cnt' = Nx
$ Goto TDC_1
$ Endif
$ @Cnc_manager:Checksummer *.COM "" COM

regards Kalle

Re: Detect configuration changes for SOX

Wim Van den Wyngaert — Tue, 12 Dec 2006 05:57:43 GMT

And a final question : with what frequency do you run it ?

Wim

Re: Detect configuration changes for SOX

Karl Rohwedder — Tue, 12 Dec 2006 06:27:01 GMT

Wim,

we run it daily as part of our 'midnight' job.
I've attached the complete routine, which does the CHECKSUMMER call.

regards Kalle

Re: Detect configuration changes for SOX

Wim Van den Wyngaert — Tue, 12 Dec 2006 09:36:55 GMT

A remark for those that want to implement this too : ctf$section.dat is a variable record length file with invalid contents.

When you do a checksum with this file, the checksum goes into a cpu loop. I had to reboot the system (an AS500) to get the cpu back.

Wim