HP UX 11i Role-based Access Control (RBAC) Software manual Monitoring Audit Files

Page 76

1.Configure the users you want to audit using the userdbset command. For more information on configuring auditing for users, refer to “Auditing Users”.

2.Configure the events you want to edit using the audevent command. For example, to configure the admin, login, and moddac events for auditing, enter the following command:

# audevent -P -F -e admin -e login -e moddac

Use the audevent command with no options to display a list of events and system calls that are currently configured for auditing.

For more information on configuring auditing for events, refer to “Auditing Events”.

3.Set the audevent argument parameters in the /etc/rc.config.d/auditing file to enable the auditing system to retain the current configuration parameters when the system is rebooted. For example to retain the parameters configured in step 2, set the parameters as follows:

AUDEVENT_ARGS1 = -P -F -e admin -e login -e moddac

4.Start the auditing system and define the log files using the audsys command. For example:

#audsys -n -c primary_audit_file -s 1000

5.Set up your log files and log file switch parameters in the /etc/rc.config.d/auditing file. Follow these steps:

a.Set PRI_AUDFILE to the name of your primary audit log file.

b.Set PRI_SWITCH to the maximum size of your primary audit log file (in KB), at which audit logging switches to the auxiliary log file.

c.Set SEC_AUDFILE to the name of your auxiliary log file.

d.Set SEC_SWITCH to the maximum size of your secondary audit log file (in KB).

For more information about setting up primary and auxiliary audit log files, refer to “Audit Log Files”.

6.Set the AUDIT flag to 1 in the /etc/rc.config.d/auditing file to enable the auditing system to retain the current event configuration when the system is rebooted.

Step 3: Monitoring Audit Files

To view, monitor, and administer your audit files, follow these steps:

1.View the audit log files with the audisp command:

#audisp audit_file

Refer to “Viewing Audit Logs” for details on using the audisp command.

2.Monitor the sizes of the log files with the audomon command:

#audomon -p 20 -t 1 -w 90

The audomon command also monitors the capacity of the file system on which the audit file is located. The audomon command takes the following arguments:

-p fss

The minimum percentage of space left on the file system that contains the

 

primary audit log file before the auditing system switches to the auxiliary

 

log file. The default fss value is 20%.

-t sp_freq

The minimum wakeup interval, in minutes, at which the system prints

 

warning messages for audit log file switch points on the console. The default

 

sp_freq value is 1 minute.

-w warning

The percentage of audit log file space used or minimum file system free

 

space used after which warning messages are sent to the console. The

 

default warning value is 90%

Refer to audomon(1M) for more information.

76 Standard Mode Security Extensions

Image 76
Contents HP-UX 11i Security Containment Administrators Guide Copyright 2007 Hewlett-Packard Development Company, L.P Table of Contents Fine-Grained Privileges Index Page List of Figures Page List of Tables Page List of Examples Page About This Document Intended AudienceNew and Changed Information in This Edition Publishing HistoryHP-UX Release Name and Release Identifier Typographic ConventionsUserInput HP Encourages Your Comments Related InformationHP-UX 11i Releases Page Authorization HP-UX 11i Security Containment IntroductionConceptual Overview Account Policy ManagementFeatures and Benefits Defined TermsIsolation AuditingFeatures Benefits Installing HP-UX 11i Security Containment InstallationPrerequisites and System Requirements Verifying the HP-UX 11i Security Containment Installation # swlist -d @ /tmp/securitycontainmentbundle.depot# swverify SecurityExt # swlist -a state -l fileset SecurityExtInstalling HP-UX Role-Based Access Control Verifying the HP-UX Role-Based Access Control InstallationInstalling HP-UX Standard Mode Security Extensions # swverify RbacUninstalling HP-UX 11i Security Containment Uninstalling HP-UX Rbac# swverify TrustedMigration # swlist -a state -l fileset TrustedMigration# swremove Rbac Uninstalling HP-UX Standard Mode Security Extensions# swremove TrustedMigration Page HP-UX Rbac Versus Other Rbac Solutions HP-UX Role-Based Access ControlOverview Simplifying Access Control with Roles Access Control BasicsExample of Authorizations Per User Example of Authorizations Per Role HP-UX Rbac ComponentsHP-UX Rbac Access Control Policy Switch HP-UX Rbac Configuration FilesHP-UX Rbac Commands HP-UX Rbac Configuration FilesHP-UX Rbac Commands HP-UX Rbac ManpagesHP-UX Rbac Architecture HP-UX Rbac ManpagesHP-UX Rbac Example Usage and Operation HP-UX Rbac ArchitecturePlanning the HP-UX Rbac Deployment Planning Authorizations for the RolesPlanning the Roles Planning Command Mappings HP-UX Rbac Limitations and RestrictionsConfiguring HP-UX Rbac Creating Roles Configuring RolesExample Planning Results Assigning Roles to Users Configuring AuthorizationsAssigning Roles to Groups Configuring Additional Command Authorizations and Privileges Is mainly intended for scripts Example Roles Configuration in HP-UX Rbac B.11.23.02 Hierarchical RolesOverview Examples of Hierarchical RolesChanges to the authadm Command for Hierarchical Roles Example 3-1 The authadm Command SyntaxExample 3-2 Example of the authadm Command Usage Hierarchical Roles ConsiderationsConfiguring HP-UX Rbac with Fine-Grained Privileges Command Configuring HP-UX Rbac with CompartmentsMatches the following /etc/rbac/cmdpriv entries Configuring HP-UX Rbac to Generate Audit Trails GIDProcedure for Auditing HP-UX Rbac Criteria Using HP-UX Rbac Following is the privrun command syntax# privrun ipfstat HP-UX Rbac in Serviceguard Clusters Customizing privrun and privedit Using the Acps Rbacdbchk Database Syntax Tool Troubleshooting HP-UX RbacPrivrun -v Information Commands Fine-Grained Privileges CommandsFine-Grained Privileges Fine-Grained Privileges ComponentsAvailable Privileges ManpagesFine-Grained Privileges Manpages Available PrivilegesConfiguring Applications with Fine-Grained Privileges Or launch policyCompound Privileges Privilege Model# setfilexsec options filename Fine-Grained Privileges in HP Serviceguard Clusters Troubleshooting Fine-Grained PrivilegesSecurity Implications of Fine-Grained Privileges Privilege Escalation# getprocxsec options pid Compartments Compartment ArchitectureCompartment Architecture Default Compartment Configuration Planning the Compartment StructureModifying Compartment Configuration Activating Compartments# setrules -p # cmpttune -eCompartment Configuration Files Compartment ComponentsChanging Compartment Rules Changing Compartment NamesCompartment Commands Compartment Configuration FilesCompartment Commands Compartment ManpagesCompartment Definition Compartment Rules and SyntaxFile System Rules IPC Rules PermissionlistNetwork Rules IPC mechanism in the current compartmentAccess Miscellaneous Rules InterfaceTroubleshooting Compartments Configuring Applications in CompartmentsExample Rules File Configured rules are loaded into the kernel # vhardlinksCompartments in HP Serviceguard Clusters Do not configure standby LAN interfaces in a compartmentStandard Mode Security Extensions Configuring Systemwide Attributes Configuration FilesSecurity Attributes and the User Database System Security AttributesAttributes CommandsManpages Configuring Attributes in the User Database Troubleshooting the User DatabaseAuditing Auditing ComponentsAudit Commands Auditing Your SystemPlanning Your Auditing Implementation Enabling Auditing# audevent -P -F -e admin -e login -e moddac AUDEVENTARGS1 = -P -F -e admin -e login -e moddacMonitoring Audit Files #audsys -n -c primaryauditfile -sGuidelines for Administering Your Auditing System Auditing UsersPerformance Considerations #audsys -fAudevent command options Auditing EventsStreamlining Audit Log Data # /usr/sbin/userdbset -u user-nameAUDITFLAG=1Audit Log Files Self-auditing processesViewing Audit Logs Configuring Audit Log Files#/usr/sbin/audisp auditfile Examples of Using the audisp Command Page Symbols IndexSecurity attribute defining
Related manuals
Manual 10 pages 36.76 Kb