12-19-2003
If you are in an environment with too many rogue sysadmins, you do have some nice tools at your disposal under Solaris. Solaris uses the Basic Security Module (BSM) to audit actions on a system. It's not small undertaking to begin to use, but I have found it worthwhile.
Take a look at the following man pages:
bsmconv(1M), praudit(1M), audit(2), audit_control(4),
audit_user(4), attributes(5)
You'd also be better off using RBAC (Role Based Access Control) rather than sudo, as in it's current itteration, it breaks the audit trail. If any real interest is expressed by the group surrounding RBAC or BSM, I'd be happy to throw some FAQ(s)/Processes out in our "Answers to Frequently Asked Questions" forum.
Cheers,
Keith
10 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
Hi there. This is probably a very stupid question, but...
How do I change or set the time in UNIX? I am taking care of a Sun Ultra 5 running SunOS 5.7 and I can't figure out how to change the time.
Help. (3 Replies)
Discussion started by: Tannim
3 Replies
2. Filesystems, Disks and Memory
I want to change a file permission which just I can list , read, and write it. So, does anybody can tell me the command? (2 Replies)
Discussion started by: a8111978
2 Replies
3. UNIX for Dummies Questions & Answers
Hi Guys,
I have an old unix server (HP 9000) which we just use to view history of data. which has a private IP of 121.1.1.n. At present we change our IP addresses (subnetting) and I have to change the old IP of UNIX to 10.10.4.n.
Could someone help me how to do or what the command is?... (4 Replies)
Discussion started by: wide angle
4 Replies
4. UNIX for Dummies Questions & Answers
#! /usr/tsch
foreach f (`cat contacts.list`)
awk '{printf ($2 in a) ? ","$5 : (NR>1) ? RS $2 FS $5 : $2 FS $5; a} END{print e}' $f > $f_inter.map
end
My file: cat contacts.list is just a list of files.
I get this error:
doit_contacts2intermap.sh: Command not found.
Thanks! (1 Reply)
Discussion started by: lost
1 Replies
5. Shell Programming and Scripting
Hi,
my code is:
------------------------------
set r=`ls -L $source_dir/*.snvf`
echo AAA
------------------------------
If does file does not exists I got on the screen
ls: No match.
AAA
How can I remove the "ls: No match." from being printed out
Regards,
Ziv (2 Replies)
Discussion started by: zivsegal
2 Replies
6. UNIX for Advanced & Expert Users
System: Digital Personal Workstation 433a
Processor: Digital Alpha 21164, 433 MHz
Memory: 64 MB
OS: Digital Unix Console (SRM), Digital Unix V4.0D
This type of conmputer run radar application. What i would like to know is whether i can change OS or not.
Thanks in advance. (7 Replies)
Discussion started by: akz
7 Replies
7. UNIX for Dummies Questions & Answers
Hi everyone.
I have some questions...
I have a 2nd pc with windows and i want to change it to unix cause i want to learn unix so can someone tell me how to get unix os and how to change it from windows?:D (6 Replies)
Discussion started by: NParas
6 Replies
8. Shell Programming and Scripting
Hi Everyone,
I am using gdb-7.5 to connect to the target. When I gave the./configure --target=xyz --build=i686-pc-mingw32 --host=i686-pc-mingw32 command then
checking build system type... i686-pc-mingw32
checking host system type... i686-pc-mingw32
checking target system type... xyz-mingw32... (3 Replies)
Discussion started by: Heeka
3 Replies
9. Homework & Coursework Questions
Hey everyone,
I am almost done with this assignment I have to do but there is one last thing nagging me that I can't seem to find. In my script I am feeding line by line to a ./test file and I am getting the return answer correctly. The goal is to test the current script (check.sh) and if it's... (1 Reply)
Discussion started by: tastybrownies
1 Replies
10. UNIX for Beginners Questions & Answers
I had a router change and needed to change the ip in some machines.
I have two machines on SCO Unix 3.2.4.2
I changed the IP in my chain(relinked kernel, used as default) and in /etc/hosts on both.
One is fine. The other I am unable to get to with putty.
Is there anything else I would need to... (11 Replies)
Discussion started by: steveo314
11 Replies
LEARN ABOUT OPENSOLARIS
audit
audit(1M) System Administration Commands audit(1M)
NAME
audit - control the behavior of the audit daemon
SYNOPSIS
audit -n | -s | -t | -v [path]
DESCRIPTION
The audit command is the system administrator's interface to maintaining the audit trail. The audit daemon can be notified to read the con-
tents of the audit_control(4) file and re-initialize the current audit directory to the first directory listed in the audit_control file or
to open a new audit file in the current audit directory specified in the audit_control file, as last read by the audit daemon. Reading
audit_control also causes the minfree and plugin configuration lines to be re-read and reset within auditd. The audit daemon can also be
signaled to close the audit trail and disable auditing.
OPTIONS
-n Notify the audit daemon to close the current audit file and open a new audit file in the current audit directory.
-s Notify the audit daemon to read the audit control file. The audit daemon stores the information internally. If the audit daemon
is not running but audit has been enabled by means of bsmconv(1M), the audit daemon is started.
-t Direct the audit daemon to close the current audit trail file, disable auditing, and die. Use -s to restart auditing.
-v path Verify the syntax for the audit control file stored in path. The audit command displays an approval message or outputs specific
error messages for each error found.
DIAGNOSTICS
The audit command will exit with 0 upon success and a positive integer upon failure.
FILES
o /etc/security/audit_user
o /etc/security/audit_control
ATTRIBUTES
See attributes(5) for descriptions of the following attributes:
+-----------------------------+-----------------------------+
| ATTRIBUTE TYPE | ATTRIBUTE VALUE |
+-----------------------------+-----------------------------+
|Availability |SUNWcsu |
+-----------------------------+-----------------------------+
|Stability |Evolving |
+-----------------------------+-----------------------------+
SEE ALSO
bsmconv(1M), praudit(1M), audit(2), audit_control(4), audit_user(4), attributes(5)
See the section on Solaris Auditing in System Administration Guide: Security Services.
NOTES
The functionality described in this man page is available only if the Solaris Auditing feature has been enabled. See bsmconv(1M) for more
information.
The audit command does not modify a process's preselection mask. It functions are limited to the following:
o affects which audit directories are used for audit data storage;
o specifies the minimum free space setting;
o resets the parameters supplied by means of the plugin directive.
For the -s option, audit validates the audit_control syntax and displays an error message if a syntax error is found. If a syntax error
message is displayed, the audit daemon does not re-read audit_control. Because audit_control is processed at boot time, the -v option is
provided to allow syntax checking of an edited copy of audit_control. Using -v, audit exits with 0 if the syntax is correct; otherwise, it
returns a positive integer.
The -v option can be used in any zone, but the -t, -s, and -n options are valid only in local zones and, then, only if the perzone audit
policy is set. See auditd(1M) and auditconfig(1M) for per-zone audit configuration.
SunOS 5.11 16 Apr 2008 audit(1M)