Gathering Information

[Brian butler]

Ok im not all the familiar with unix, but today i was prompted by my boss to find out some information, apparently we are getting audited. I was able to gather most of the information on my own, i.e. password files, and crontabs, and much more but I have a question about a couple of commands that are used to gather information.
1. Listing of all directories without ???sticky-bit???.
2. Listing of all root owned files.
3. Listing of all world writeable directories.
4. Listing of all user directories writeable by others.

It would be great if somebody could point me in the right direction to find this information.

Thanks
BPB

[harry d brown jr]

Use the "find" command:

man find

live free or die
harry

[Marco Santerre]

I know this won't answer your question, but because I have gone through this exercise not so long ago myself, I have discovered a neat little software that HP produced called IDS/9000 (Intrusion detection Software). All four elements that you are looking for, are being monitored whenever changes occurs on your system to create these events. Also this software is centralized on one machine, therefore removing the possibilities of changing the events in the log file. Without going in too much details cause, again I'm not answering your questions, it may be something you want to look into for future use.

[Steve Steel]

Hi


Find is correct,check it and

http://www.introcomp.co.uk/hpux/index.html

Will give good example scripts for all sorts of things


Regards

Steve Steel

Quote of the moment
-------------------
"We are drowning in information but starved for knowledge."
-- John Naisbitt

[RAC_1 · Accepted solution]

1 find . ! -perm 1777 -depth -print

2 find . -user root -depth -print

3 find . -type d -perm 1777 -depth -print

4 find . -type d -perm 066 -depth -print

[harry d brown jr]

1. find / -type d \( ! -perm -1000 \)

2. find / -type f -user root

3. find / -type d -002

4. same as 3

live free or die
harry

[Juerg DENNEBERG]

Hi Marco

where may I find this IDS/9000 Software?

Thanks

J??rg

[Robert-Jan Goossens]

Hi,

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=J5083AA

Robert-Jan.

[W.C. Epperson]

A logistical note:

I recently went through a systems audit where such things were requested. Iteratively with minor variations. Over and over.

I finally persuaded the auditors to let me give them a "find / -print|xargs ls -ld" output for them to "grep" on. The finds were killing my servers.