HP UX 11i Role-based Access Control (RBAC) Software manual Auditing Your System, Enabling Auditing

Page 75

Commands

Table 6-5 “Audit Commands” contains a brief description of each auditing command.

Table 6-5 Audit Commands

Command

Description

audevent

Changes or displays event or system call status.

audisp

Displays the audit records.

audomon

Sets the audit file monitoring and size parameters.

audsys

Starts and stops auditing; sets and displays audit file or directory information.

userdbset

Selects users to be audited by specifying the AUDIT_FLAG=1 option.

Manpages

Table 6-6 “Audit Manpages” contains a brief description of each manpage associated with the auditing feature.

Table 6-6 Audit Manpages

Manpage

Description

audevent(1M)

Describes audevent functionality and syntax.

audisp(1M)

Describes audisp functionality and syntax.

audomon(1M)

Describes audomon functionality and syntax.

audsys(1M)

Describes audsys functionality and syntax.

userdbset(1M)

Describes userdbset functionality and syntax.

audit(5)

Gives introductory information about HP-UX auditing.

Auditing Your System

Use the following three procedures to plan, enable, and monitor auditing on your system.

Step 1: Planning Your Auditing Implementation

To plan your auditing implementation, follow these steps:

1.Determine which users to audit. By default, all users are selected for auditing.

2.Determine which events to audit. Use the audevent command to display a list of events and system calls that are currently selected for auditing.

3.Decide where you want to place the audit log files (audit trails) on your system. For more information on configuring your audit log files, refer to “Audit Log Files”.

4.Create a strategy to archive and back up audit files. Audit files often take up a lot of disk space and can overflow if you do not carefully plan file management.

For additional information about auditing system performance and administration that can help you plan your auditing implementation, refer to “Performance Considerations” and “Guidelines for Administering Your Auditing System”.

Step 2: Enabling Auditing

To enable auditing on your system, follow these steps:

Auditing 75

Image 75
Contents HP-UX 11i Security Containment Administrators Guide Copyright 2007 Hewlett-Packard Development Company, L.P Table of Contents Fine-Grained Privileges Index Page List of Figures Page List of Tables Page List of Examples Page Publishing History About This DocumentIntended Audience New and Changed Information in This EditionTypographic Conventions HP-UX Release Name and Release IdentifierUserInput Related Information HP Encourages Your CommentsHP-UX 11i Releases Page Account Policy Management AuthorizationHP-UX 11i Security Containment Introduction Conceptual OverviewAuditing Features and BenefitsDefined Terms IsolationFeatures Benefits Installation Installing HP-UX 11i Security ContainmentPrerequisites and System Requirements # swlist -a state -l fileset SecurityExt Verifying the HP-UX 11i Security Containment Installation# swlist -d @ /tmp/securitycontainmentbundle.depot # swverify SecurityExt# swverify Rbac Installing HP-UX Role-Based Access ControlVerifying the HP-UX Role-Based Access Control Installation Installing HP-UX Standard Mode Security Extensions# swlist -a state -l fileset TrustedMigration Uninstalling HP-UX 11i Security ContainmentUninstalling HP-UX Rbac # swverify TrustedMigrationUninstalling HP-UX Standard Mode Security Extensions # swremove Rbac# swremove TrustedMigration Page HP-UX Role-Based Access Control HP-UX Rbac Versus Other Rbac SolutionsOverview Access Control Basics Simplifying Access Control with RolesExample of Authorizations Per User HP-UX Rbac Components Example of Authorizations Per RoleHP-UX Rbac Configuration Files HP-UX Rbac Access Control Policy SwitchHP-UX Rbac Configuration Files HP-UX Rbac CommandsHP-UX Rbac Manpages HP-UX Rbac CommandsHP-UX Rbac Manpages HP-UX Rbac ArchitectureHP-UX Rbac Architecture HP-UX Rbac Example Usage and OperationPlanning Authorizations for the Roles Planning the HP-UX Rbac DeploymentPlanning the Roles HP-UX Rbac Limitations and Restrictions Planning Command MappingsConfiguring HP-UX Rbac Configuring Roles Creating RolesExample Planning Results Configuring Authorizations Assigning Roles to UsersAssigning Roles to Groups Configuring Additional Command Authorizations and Privileges Is mainly intended for scripts Examples of Hierarchical Roles Example Roles Configuration in HP-UX Rbac B.11.23.02Hierarchical Roles OverviewHierarchical Roles Considerations Changes to the authadm Command for Hierarchical RolesExample 3-1 The authadm Command Syntax Example 3-2 Example of the authadm Command UsageConfiguring HP-UX Rbac with Fine-Grained Privileges Configuring HP-UX Rbac with Compartments CommandMatches the following /etc/rbac/cmdpriv entries GID Configuring HP-UX Rbac to Generate Audit TrailsProcedure for Auditing HP-UX Rbac Criteria Following is the privrun command syntax Using HP-UX Rbac# privrun ipfstat HP-UX Rbac in Serviceguard Clusters Customizing privrun and privedit Using the Acps Troubleshooting HP-UX Rbac Rbacdbchk Database Syntax ToolPrivrun -v Information Fine-Grained Privileges Components CommandsFine-Grained Privileges Commands Fine-Grained PrivilegesAvailable Privileges Available PrivilegesManpages Fine-Grained Privileges ManpagesOr launch policy Configuring Applications with Fine-Grained PrivilegesPrivilege Model Compound Privileges# setfilexsec options filename Privilege Escalation Fine-Grained Privileges in HP Serviceguard ClustersTroubleshooting Fine-Grained Privileges Security Implications of Fine-Grained Privileges# getprocxsec options pid Compartment Architecture CompartmentsCompartment Architecture Planning the Compartment Structure Default Compartment Configuration# cmpttune -e Modifying Compartment ConfigurationActivating Compartments # setrules -pChanging Compartment Names Compartment Configuration FilesCompartment Components Changing Compartment RulesCompartment Manpages Compartment CommandsCompartment Configuration Files Compartment CommandsCompartment Rules and Syntax Compartment DefinitionFile System Rules Permissionlist IPC RulesIPC mechanism in the current compartment Network RulesAccess Interface Miscellaneous RulesConfiguring Applications in Compartments Troubleshooting CompartmentsExample Rules File # vhardlinks Configured rules are loaded into the kernelDo not configure standby LAN interfaces in a compartment Compartments in HP Serviceguard ClustersStandard Mode Security Extensions System Security Attributes Configuring Systemwide AttributesConfiguration Files Security Attributes and the User DatabaseCommands AttributesManpages Auditing Components Configuring Attributes in the User DatabaseTroubleshooting the User Database AuditingEnabling Auditing Audit CommandsAuditing Your System Planning Your Auditing Implementation#audsys -n -c primaryauditfile -s # audevent -P -F -e admin -e login -e moddacAUDEVENTARGS1 = -P -F -e admin -e login -e moddac Monitoring Audit Files#audsys -f Guidelines for Administering Your Auditing SystemAuditing Users Performance Considerations# /usr/sbin/userdbset -u user-nameAUDITFLAG=1 Audevent command optionsAuditing Events Streamlining Audit Log DataSelf-auditing processes Audit Log FilesConfiguring Audit Log Files Viewing Audit Logs#/usr/sbin/audisp auditfile Examples of Using the audisp Command Page Index SymbolsSecurity attribute defining
Related manuals
Manual 10 pages 36.76 Kb