collecting config and logfiles in datacenterenvironment

[Ralf Seefeldt]

Hello all,

we runsomme 100 HP-UX servers, mostly blade, mostly 11.31, all ServiceGuard clusters. Virtual hosts will be part of the environment, soon. Our customers have root access - bad idea, but we can not discuss about that.

I want to collect and store centrally all security relevant files from all servers on a central, virtual, HP-UX based server. (syslog, wtmp, ..., all historyfiles from all accounts, all .profile, ..., passwd, group, /etc/shells, netconf, ...

A 2nd stepp would be to automatically get alarmed, when specific alterations in the files can be detected. A 3rd stepp could be including servers with other UNIX flavors and Windows.

I expect, there are prooven concepts, established (freeware) products, ... but so far I was not able to find any concrete descriptions, whitepapers or similar.

Any Ideas or hints are greately welcome.

Best regards

Ralf

[Kenan Erdey]

Hi,

you want to know all what is done in your environment. some of them may not be needed indeed. and some of them will bring more workload to your environment also.

as relevant to syslogs, you can install a central syslog-server. you can install syslog-ng on a server and redirect syslogs from all servers to this server. there are some tools running ong cental log server for querying logs(php-syslog-ng etc.) or you can buy tools like kiwi logserver, or from symantec etc.) as logs about logins are also in syslogs, you may not need collect binary logs like btmp,wtmp etc.

To keep history files in a centralized location may not be a good idea. everybody has root access in your environmet. in this environment keeping and logging security is not easy. imho what you can done is, cetralizing authentication with a tool like centrify, likewise. with this tools you can log user sessions, keydrops even if they are all root.

as relevant to monitoring configuration files for the risk of being deleted, changed, you can use host based ids(hids). again with a centralized hids server you can monitor servers which you installed hids clients. hids supplies you kernel based monitoring, so it will bring a overhead.

if you want all this to be done in one step, you can buy custom tools and consultancy from symantec, quest, etc. they have log correlation tools, they collect logs from c2 level trusted systems. what the hell is done is collected and correlated in one server.

[Kenan Erdey]

i missed keeping configuration files centrally.
this is called cmdb. There are opensource and commercial tools for this. you can start reading here. we are using hp's tool.

http://en.wikipedia.org/wiki/Configuration_management_database