Auditing without TCB

[Scott Stewart]

We are evaluating a product which centralizes audit logs from our various platforms (UX, AIX, Solaris, Linux). Can system auditing be activated on UX without activating TCB? We use NIS pretty heavily and can't make the conversion to NIS+ or something else at the moment.

Thanks!
Scott

[Michael Tully]

There is a product called e-Trust from CA, that does some of this type of thing. something to think about. I'm sure there will be more answers to this.

[Geoff Wild]

Yes - you can.

Check out Unix Control:

http://www.tfstech.com/index.htm

Rgds...Geoff

[Sridhar Bhaskarla]

Hi Scott,

Interestingly SAM doesn't allow you to configure auditing without converting the system to trusted but you can turn on|off auditing using audsys command. Atleast on 11i. Very recently, I tried it and I was suprized to see it worked. I didn't go further on it but I believe it should give you what you need but I am not sure on it's supportability.

-Sri

[Darren Prior]

Hi Scott,

There was a thread on using auditing on a non-trusted system fairly recently so it's worth having a quick search of the forums.

This thread mentioned that someone did get auditing working on a non-trusted system... However, it's not supported by HP in this configuration. One of the problems is that the audit ids are stored within the /tcb area, without the audit id auditing becomes less useful!

regards,

Darren.