scfmgr tool... I cant remember where to get it

[Todd McDaniel_1]

My old company used this tool on all our HPU X boxes. I am not sure if it is a home-grown tool or not. It was very useful imho...

I googled it and only found my old reply to an post on www.unix.com forums from 2002.

There are no references to it in this forum or on docs.hp.com either.

The command line is scfmgr and it monitors su activity related to su'ing to root. The config file is edited by typing scfmgr and it has several parameters you can also monitor in it besides su activity.

[Todd McDaniel_1]

also, whats that website address for the free unsupported products?

[James R. Ferguson]

Hi Todd:

I don't have knowledge of the tool you note, but the '/var/adm/sulog' is where 'su' activity is recorded.

As for add-on products:

http://hpux.cs.utah.edu/

..and its various worldwide mirrots.

Regards!

...JRF...

[Todd McDaniel_1]

yes I know about the sulog file... but that is rather passive... This was an active tool.

It managed a file which allowed users the rights to su to root. If they werenâ t in the file, they failed to get in as root, and the system sent mail to root notifying of the attempt.

You would typically type scfmgr at the prompt and then edit the file. And that was pretty much it. I think it had some type of daemon running in the back ground.

[Todd McDaniel_1]

I emailed a friend of mine at my old firm.

He sent me this...

==========================================
man scfmgr

SCFMGR(bcr) SysGuard Security Software SCFMGR(bcr)

NAME

scfmgr - access the Security Control File (SCF)

SYNOPSIS

scfmgr [ -c ] [ -v ] [ -p ] [ -f filename ]

DESCRIPTION

scfmgr provides access to the SCF (also known as sc_file) to validate or change parameter values. If no options are specified, the user is automatically placed in edit mode. scfmgr uses the following options:

-c recalculates the checksum
-v validates a copy of the SCF
-p updates system password
-f filename

use filename instead of the default.

OPERATION

Use of scfmgr(bcr) on current SCF is restricted to one process at a time.

FILES

sc_file

/tmp/tmpScFile

SEE ALSO

BR-007-301-211, SysGuard User Guide, Section 7.

BR-007-301-217, SysGuard Reference Manual, Section 8.

- 1 - Formatted: October 31, 2007

[James R. Ferguson]

Hi (again) Todd:

> It managed a file which allowed users the rights to su to root.

You can get close to this with the '/etc/default/security' file's SU_ROOT_GROUP setting:

http://docs.hp.com/en/B2355-60105/security.4.html

Of course, this is a by-group restriction and there is no automatic email generated for invalid attemps. The standard 'sulog' would track the attempts.

Regards!

...JRF...

[Geoff Wild · Accepted solution]

Sounds like a third party utility.

I don't know if this is it:

http://www.datasure.com/~mackinnn/sysguard.html

Myself, I use a solution from Fox Technologies called BoKS.

Rgds...Geoff

[Todd McDaniel_1]

Geoff gets the bunny!!!!

ding ding ding!!!

That is what I was looking for...thanks!