Do I have to convert the system to trusted before turn on Auditing?

[Hanry Zhou]

I am a little confused about the relationship between trusted system and auditing.

Based on what I have read, I have to convert the system to trusted before I can turn on auditing. However, on our 11i servers, we have /etc/rc.config.d/auditing setup, and we can turn on auditing either by /sbin/init.d/auditing start or "audsys -n", and the system is not trusted.

Can anybody please let me know why I can turn on auditing without being converted to trusted? or by doing that, if it would cause any problems?

Thanks,

[spex · Accepted solution]

Hi,

HP has separated auditing functionality from trusted mode. Please refer to:

"HP-UX Standard Mode Security Extensions"
http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=StdModSecExt

PCS

[Peter Godron]

Hanry,
man 5 audit will give you an overview of auditing.
This can be run on any system, as in your case an non-converted system.

Trusted systems will have their password file moved etc.
http://www.docs.hp.com/en/B2355-90121/index.html

I'm sure other people will explain better!

[Hanry Zhou]

Okay. Since I am running 11.23, so I don't have to convert the server to trusted.

the way I am configuring what needs to be audited, what doesn't is to add parameters in /etc/rc.config.d/auditing file. What is "usual" or "common" parameters I should put in? NOw, we have a lot in the file, which means a lot of things are being auditted, what are these parameters people usually would put in?

[Hanry Zhou]

If I understand it correctly, all initial parameters/events you want to audit could be put in /etc/rc.config.d/auditing file, but what is the online auditing parameters/events dataase located?