topic Re: Persona Audits in Operating System - OpenVMS

Persona Audits

John A. Quinn — Thu, 17 Dec 2009 20:50:50 GMT

The persona audits do not appear to be documented under the set audit command... Does anyone know when I turn on audits for persona create, delete and modify, what am I auditing? Am I auditing the use of the system services associated with these functions or the actual creation, deletion or modification of the persona?

Thanks

Re: Persona Audits

Hoff — Thu, 17 Dec 2009 21:22:14 GMT

Um, is there a particular difference?

Re: Persona Audits

John A. Quinn — Thu, 17 Dec 2009 21:27:09 GMT

I guess that depends on whether there is another way to create, delete or modify persona's other than using the system services. Is there?

Re: Persona Audits

Hoff — Thu, 17 Dec 2009 21:33:56 GMT

Short of hacking the kernel, I hope not.

Re: Persona Audits

Richard J Maher — Fri, 18 Dec 2009 12:34:16 GMT

Hi John,

Good question.

What auditing do you have set?

What output are you getting?

I wonder if it covers reserve/delegate and I'm guessing the TCB bit turns it all off?

Cheers Richard Maher

Re: Persona Audits

John A. Quinn — Fri, 18 Dec 2009 14:52:59 GMT

Richard,

I have turned on Persona auditing for delete, create and modify. This is on a test system and since I have turned it on, I have not gotten any audit records. The use of this audit has been suggested by Larry Kilgallen's LJK software tool and I am trying to figure out what exactly it does so I can describe it to others in the organization.

Thanks

Re: Persona Audits

Graham Burley — Fri, 18 Dec 2009 15:42:26 GMT

There's a brief section on the persona services in the Programming Concepts manual System Security Services chapter, you may not have any software that actually uses them.

As I understand them, you haven't really exercised them until you do a $persona_assume, and software could create & delete personas without actually using them (with assume), but I guess it would be impractical to audit the assume.

Re: Persona Audits

Hoff — Fri, 18 Dec 2009 16:20:07 GMT

OpenVMS itself didn't use the persona services, when last I checked. Those particular audits will be rather quiet.

You'll have to issue some system service calls yourself to get any traffic on those particular audits, or install a product that uses those calls.

Lob a report at HP for the documentation of the audits, and lob a second report at Mr Kilgallen for the LJK pieces.