basic ideas for monitoring security

[HSW Support]

I'm thinking of writing a shell script to monitor basic security issues which will fire off an email if it thinks something needs checking. Basically I'm looking for any suggestions on things to check ? My quick ideas so far are :

1. Check logins for unusual times
2. Warn if user (root etc) has more than 3 failed logins over a certain period
3. Check ftp connections, warn if not from known sources (IP address perhaps)

That's about as far as I've got so far. The system is not 'trusted' and should be fairly secure from the general internet so my main intention is to check for casual internal access attempts or unusual conditions.

Any suggestions will, as always, be rewarding with points.

Thanks in advance,

Mike

[Rob Smith · Accepted solution]

Hi, couple of things. Check and see if an account has been created with UID 0. Do a checksum to make sure no one has added any additional SUIG/SGID scripts. Turn on FTP logging to see what people are transferring. Hope this helps.

Rob

[Rainer von Bongartz]

You should look at IDS/9000 from HP .
This system can be downloaded for free from software.hp.com

With IDS/9000 you can monitor all aspects of system security even on non-trusted systems.

I installed it on a couple of servers and it works fine.

[HSW Support]

Thanks for the replies so far, forgot to mention version is 10.20.

Mike

[Bill McNAMARA_1]

In terms of software patches from the internet & security area of software.hp.com
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProducts.pl?group_type=category&group_name=ISS
You can download a tool that'll analyse your patch levels.
You can also d/l as was mentioned before, ids
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=J5083AA
on trial.

Other than that, close off most services, make sure your disk arrays config area passwords are all set, as well as your switches/hubs etc..

Get tripwire/satan to analyse your system. Make sure file sizes of /usr/sbin commands and /sbin commands stay the same. Watch out for symbolic links and world readable files and suid programs.

Later,
Bill

[Bill McNAMARA_1]

You should check if /dev/console has an active shell and whether root is allowed to access from somewhere other than that.

Hard to script but is the key in the door!
Is BCH password protected to stop hpux -is
(probably through mstm)

Later,
Bill

[Brian Markus]

There are a number of things I checked for in my first monitor script. Su's, bad loging attempts (btmp), SUID's on files, any access to the /etc/passwd (copy's etc.) I reciently threw out my script and went to IDS/9000. It has all those featurs plus more. It can check for race conditions, buffer overflow's, and a number of other things that would be a burden to code. Since it's realtime, I chucked my tripwire also. I've got to say, other than the dependancy on java 1.18 I love the product. It's in it's infancy stage, and has blown away everything out already. The combination of this and SSH, the security_patch_check tool, and a few other things you can make a pretty hard box. Check the Txt on Building a Bastion Host Using HP-UX 11.x. You can find a lot of really usefull things in there.


Good luck

Brian.