02-03-2015
Quote:
Originally Posted by
gowron
So... no ideas on how to catch them?
Solaris audit is growing veeeery tiresome...
Redirection is just another form of file creation/truncation/read/write.
How is that any different from starting an editor and opening the file from within the editor? You don't see that on any command line either.
If you're already auditing file creation/truncation/read/write, it really doesn't matter HOW the user did something. And if you're not already auditing those, you're wasting your time with auditing.
10 More Discussions You Might Find Interesting
1. Solaris
Hi All,
Any one has, sun solaris audit program which covers everything one need to check as a security auditor.
Audit Program will help.
Thanks,
Ghanshyam
Emails not allowed - see the Rules (4 Replies)
Discussion started by: ghanshyampatel
4 Replies
2. Solaris
How do I know that audit is enabled in soalris. in AIX 'audit query' command gives me the info whether auditing is on or not.
Raghav (1 Reply)
Discussion started by: raghavender_sri
1 Replies
3. Solaris
can you please share what you use to audit what files are deleted, when files are deleted and who deleted them?
thx (1 Reply)
Discussion started by: melanie_pfefer
1 Replies
4. Solaris
I just want to audit and log to syslog when a user is added, removed or modified from the system.
According to the docs I have:
#/etc/security/audit_control
dir:/var/audit
flags:ua
minfree:20
naflags:ua
plugin:name=audit_syslog.so.1; p_flags=ua
But neither syslog nor auditreduce -c ua... (7 Replies)
Discussion started by: glisha
7 Replies
5. Solaris
Hi Friends
I am a Solaries newbie and I am looking out for a software or command or config that can capture all commands run by all users on a server on a daily basis. I believe that this Audit is being done in almost all enterprises and would like to know how the same is done there.
Any... (3 Replies)
Discussion started by: Hari_Ganesh
3 Replies
6. Solaris
cron audit problem. job failed
I’m getting problem with crontab in Solaris 8
Crontab stop and is not running for all the cron jobs
under cat /var/cron/log
> CMD: /var/sh/go.sh
> root 24835 c Sun Sep 26 08:06:00 2010
< root 24835 c Sun Sep 26 08:06:00 2010 rc=1
! cron audit problem.... (5 Replies)
Discussion started by: Mr.AIX
5 Replies
7. Solaris
Dear All,
I have one of my Servers, running Solaris 9. I wanna enable the Audit log enabling, the way I did in Solaris 10 Servers.
After running, the bsmconv script, giving the reboots, modifying all the audit files in /etc/security, the audit is enabled, but the audit file which shall be... (3 Replies)
Discussion started by: sumeet1806
3 Replies
8. Solaris
Does anyone know if there is software written to view the audit logs generated by Solaris? I am referring the the logs created by auditd. It produces an unreadable log. I am familiar with auditreduce and praudit, but I am looking for something that produces a report, much like logwatch looks at the... (4 Replies)
Discussion started by: brownwrap
4 Replies
9. Solaris
Linux audits in syslog, any time a user is deleted or added. However, I'm running a Solaris11 VM, and find no such entries. How can I enable auditing for useradd and userdel? Oracle's documentation on managing the auditing service, has been of no assistance. Thanks.
Customizing What Is... (7 Replies)
Discussion started by: Nvizn
7 Replies
10. Solaris
hi,
I enabled bsm modules (/etc/security/bsmconv) and rebooted Solaris 10. But service is going into maintenance state. I rebooted server and I see one error saying "sys/c2audit:audit_kssl() not defined properly". I am not sure, what it is indicating and how it should be fixed. Please suggest, how... (5 Replies)
Discussion started by: solaris_1977
5 Replies
LEARN ABOUT ULTRIX
auditmask
auditmask(8) System Manager's Manual auditmask(8)
Name
auditmask - get or set auditmasks
Syntax
auditmask [ option ... ] [ event[:succeed:fail]
Description
The command with no arguments displays the system-calls and trusted-events currently being audited for the system, and displays whether
they are being audited under successful or failed occurrences or both. The format used for the display is acceptable as input to the com-
mand.
The command with event arguments sets the system-call and trusted-event audit masks for the system. This is cumulative operation, so it is
possible to turn on or off audit for one set of events, then turn on or off audit for a second set of events without changing the first set
of events (except for intersection between the two sets). Command line arguments to can include one or more events, each with an optional
field :succeed:fail, where succeed is either 0 to specify no auditing of successful occurrences of event, or 1 (or any non-zero character)
to specify auditing of successful occurrences of event; and fail is either 0 to specify no auditing of failed occurrences of event or 1 (or
any non-zero character) to specify auditing of failed occurrences of event. The event name is the system-call name or the trusted-event
name (see audit.h ).
The command will also accept redirected input, which can be the output of a previously issued command. This is a file which contains lines
of the format event [succeed][fail]. If the keyword succeed is present, successful occurrences of that event will be audited; if the key-
word fail is present, failed occurrences of that event will be audited; if both are present, successful and failed occurrences will be
audited; if neither keyword is present, that event will not be audited.
The auditmask command can also be used to set the audit style characteristics of the audit subsystem. These characteristics control how
much information is recorded on exec operations.
The command is used in to initialize the auditmask at boot time according to the file This makes use of privileged operations within the
system call.
Options
-f Turns on full auditing for the system. This list may include events which have no symbolic name and are represented only by a
number (reserved for future use); these events will not be audited, despite their presence in the auditmask.
-n Turns off all auditing for the system.
-s aud_style
An aud_style of "exec_argp" enables the auditing of the argument list to an or syscall. An aud_style of "exec_envp" enables
the auditing of the environment strings to an or syscall.
See Also
audcntl(2)
auditmask(8)