Are there audit capabilites for file access

[Craig Miller_6]

My manager is asking me if there are audit capabilities on HP-UX for file access, ie reads/updates. My HP security is very,very limited and I'm drawing blanks...

Any ideas? these are not trusted systems, most running 10.20, a couple running 11i.

[Florian Heigl (new acc) · Accepted solution]

without going to trusted mode, the answer is most definitely 'no'

sorry.

[Rainer von Bongartz]

Take a look at the HIDS product from HP at:

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUX-HIDS

Regards
Rainer

[DCE]

You will have to convert to trusted systems if you want auditing. If you convert, make sure you are current on your patch levels.

Also the conversion can be backed out fairly easily if you encounter problems

Helpful hint if you do the conversion: have a couple of windows open on the system with root access. The conversion, if done with certain parameters, has been known to deactivate root logins. As long as you have a root window open you can rectify the issue with out any problems test by opening a new window and try to logon as root

[Rainer von Bongartz]

you don't need to go to trusted to use HIDS

HIDS can do (amongs a lot more)


Modification of critical system files and directories
Creation of world writable files
Creation and modification of privileged "setuid" files
File additions and deletions



Regards
Rainer

[Florian Heigl (new acc)]

Hmmm, yes, if You didn't really need auditing of file accesses, but are happy with detection tampering or updates, then HIDS will prove a great tool.

Depends on what You need, for computer security purposes, HIDS is the best tool. If it's really about auditing who looked at "the secret files", You need trusted mode.

Also I'm not sure, if a current HIDS is made available for 10.20, but You can take the open source tripwire as a substitution on these systems.

[Craig Miller_6]

Thanks for the advice. Sounds like we need to move to trusted systems to get the controls everyone is asking for..

[Craig Miller_6]

I have forwarded the information to my manager. Will have to see if we make the move to trusted systems