Identify External devices on Itanium servers

[Haralambos]

Our security policy states that no external devices are allowed to be connected to HP-UX (Itanium) servers. Such devices will include, but not limited to, USBs, CDROMs, external SCSI drives, etc.

The question though is how to verify this programaticaly.

At first I thought that it can be done based on the file system type that a device has, but this will not actually work as I can have, for example, HFS on a USB stick.

Any ideas?

Regards, haralambos

[Patrick Wallek · Accepted solution]

You would have to know what the SCSI addresses are for any potential connection points for external devices. The address I am talking about is the address that can look like '0/0/1.1.0' in the output of 'ioscan -fn'.

The key to this is going to be doing an 'ioscan -fn', or for better performance 'ioscan -kfn' (the -k looks at the kernel and doesn't actually scan all I/O buses), when the system is in its live production state.

You should take the output of that ioscan and store it somewhere. Then you could occasionally run another ioscan and compare the output of it to the output of the original ioscan. If there are any discrepancies / changes, then you should be notified.

If something is intentionally attached to the machine, new disks, net LAN card, etc., then you would need to update your production ioscan that you compare against.

This could all be done pretty easily via a shell script.

[rick jones]

That is an interesting policy - does th epolicy also limit the people who have physical access to the system? If not, unless you were scanning very often, you would quite likely miss a quick connection of an external peripheral to the system.

If physical access to the system is limited to "trusted" individuals, then the main value of the scanning would be to help keep them honest, but it would still have the same limitations.

Of course, if you still allow the system to be connected to a network... :)

[Haralambos]

Physical access in indeed limited and controlled.

Anyway, the ioscan suggestion will get us closer to our goal even though, as Rick said, it will only provide to me a system snapshot during the script's run.

Thanks

[Haralambos]

The proposed solution will work for the moment during which the script takes to run.

But, a complete/real time solution might be hard to achieve.

regards