Security scripting

[Rogelio Ordinario]

Guys,

Please help me create the script to audit my server being use as an NFS server, FTP server and ASU server.

Requirements:
1. I need to know the users and the filesystem or directories they were accessing.
2. ACLs
3. Files and directories owned by whom?
4. Users and files they were accessing
email me at oji.ordinario@rbcds.com. Thanks

[David Rodman]

Have you looked into converting to a trusted system and using the HP audit capabilities?

[Jim Hendrick]

Hmmm... You probably aren't going to like this...

As far as I know (having managed multi terabyte NFS services for some time now) there is no great way to perform the access logging you ask for. (even if there was, the size of the logs would be prohibitive) The basic reason for this is that NFS honors the client's authentication (so if a file is owned by UID 135 on the server, and the client creates an account with UID 135, they own the file)

As far as securing the server, you should take a look at "UNIX SYSTEM ADMINISTRATION HANDBOOK" by Nemeth, Snyder, Seebass and Hein or "PRACTICAL UNIX SECURITY" by Garfinkel & Spafford. These are always on my bookshelf.

Later,

Jim