Security Concern

[Avinash20]

Friends,

I like to have the following to be done on my server:

Information to be logged
- Login Successes and Failures
- Addition / Deletion / Modification of Users
- Changes to Security Settings
- Changes to Logging and Auditing Settings
- Service Access Logs e.g. FTP, Telnet, SSH etc
Login Control
After successful login, every user must be given information reflecting the last login time, date and details of any unsuccessful login attempts since the last successful login.

Terminal Timeout
Inactive Terminal Session (Telnet, SSH, tty, vty, sessions) must be set to a timeout of 15 minutes

any response is highly appreciated

[Kapil Jha]

>>>Login Successes and Failures
It is already logged in wtmp files and you may use "last" command to see when a particular user was logged in.

>>>Inactive Terminal Session
there is a variable TMOUT you can set it to according to your requiredment.

>>>Addition / Deletion / Modification of Users
M not sure about any tools but you can write a script which will tell you whenever thers is some modification in /etc/passwd file.

I suppose you need some tool or you'll have to wrie script for each.
BR,
Kapil

[Avinash20]

Any further suggestion will be more helpful

[Shrikant Lavhate]

>Service Access Logs

for logging FTP logs that is incoming and outgoing FTP file transfers, insert the-i and -o options with the ftp entry in the /etc/inetd.conf file. like this:
ftpd -a -l -d -i -o

The logs will be saved into /var/adm/syslog/xferlog.

[Jeeshan · Accepted solution]

Hi Avinash

Did u convert your system in trusted mode. You can do your queried security concern in trusted system

- Login Successes and Failures
If trusted you can get message
- Addition / Deletion / Modification of Users
If u use SAM to do so you have sam.log to view
- Changes to Security Settings
its in trusted system
- Changes to Logging and Auditing Settings
you can do also in trusted system
- Service Access Logs e.g. FTP, Telnet, SSH etc
you can view the syslog.log to view such like messages if your syslog process has entry for this services
-Login Control
if your system in trusted mode user can also see the message of successful and unsuccessful logins
Terminal Timeout
for telnet edit file in /etc/default/security
and for other terminal use their individual configuration files

[Avinash20]

Thanks everyone:

http://docs.hp.com/en/B2355-90950/ch08.html

This will help.

[Sp4admin]

Hello Avinash,

you can also use SAM's auditing. For system calls and other command.

sp,

[Avinash20]

Above url helped