Auditing SYSUAF modifications to the SYSTEM account

[Jess Goodman]

The following command will do what you are looking for:
$ ANALYZE/AUDIT/EVENT=SYSUAF/SELECT=UAF_SOURCE=SYSTEM/FULL

The /SELECT=UAF... keywords have not been documented since VMS 6.2 but they still work the same way they always did. By that I mean /SELECT=UAF_MODIFY= never worked right, but /SELECT=UAF_SOURCE= seems to work fine.

[Mike Kier]

Jess,

That sounds like a good addition to Parsec's Undocumented VMS Features page at http://www.parsec.com/openvms/undocumented.php
- perhaps you can get them to add it.

[Wim Van den Wyngaert]

SUCCESS+WRITE ACL (Audit)

Almost. This still allows to copy the sysuaf, modify it, delete the original and put the copy back in place. And then finish with adding the acl again.

I would add the delete to the acl too.

Wim

[Wim Van den Wyngaert]

Make sure that you have the ACL option in show audit.

If not, the user can remove the ACL, modify the file and put it back again. And monitor audit entries of course. Otherwise it's logged but nobody knows.

Wim

[Hoff]

Have you considered using the two-password login on the privileged user(s)?

That's a mechanism specifically intended for this situation.

Two users, both of which must be present to perform the privileged action(s).

As for all the auditing and accounting, that's comparatively insecure around privileged users; if you're privileged (and reasonably competent at DCL) it's usually easy to get rid of that stuff or (if you're somewhat better at OpenVMS and at your nefariousness) at covering your tracks.

[Steven Fletcher_1]

Thanks folks, lots of usefull info here.
I like the two password setting for the system account, that will help.
I think it's going to end up being most of the suggestions on here to get a comprehensive audit trail.

Obviously there is the priv user issue being able to cover their tracks, but from a PCI-DSS standpoint, we're auditing what we need to, so that's good enough.

There's always got to be some element of trust with your priveledged users, otherwise the system just wouldn't work, you could spend months/years going to the nth degree of security access.