Visit Our UNIX and Linux User Community


File Auditing in Sun Solaris environment


 
Thread Tools Search this Thread
Top Forums UNIX for Advanced & Expert Users File Auditing in Sun Solaris environment
# 1  
Old 11-10-2009
File Auditing in Sun Solaris environment

Hi All,

I have a requirement to report us on changing a group of static files.
Those are the binary files that run in Production every day.

Due to the in sercure environment situations, I found many are indulging in there own changes to the binaries by doing some changes in the souce code.

We have decided to have an audit system for all those files and report a group(send email) on changes in the files we are looking for.

I searched a lot and got the below link:
Linux audit files to see who made changes to a file

But, this needs system admin to enter the picture.

Please let me know, is there a way/script to do the same.

The environment is Sun Solaris E20K.

Regards,
Mohan Kumar CS
# 2  
Old 11-11-2009
Can you not prevent writing the binaries? chmod 711 the files, then change the owner of the file to root or some other similar userid.

Otherwise, how can you know absolutely that the binaries you have out there are the right ones? As soon as you create the file, another user, in 5 seconds, could overwrite it.

Assuming you can know, which I don't believe, use cksum to create a file:
Code:
cd /binary/directory
cksum * > ~/mycksum

Next, put simple script into your crontab that runs every few minutes:
Code:
cd /binary/directory
cksum * > ~/testcksum
diff ~/testcksum ~/mycksum > badfiles
if [[ $? -eq 1 ]] ; then 
   /usr/bin/uuencode badfile badfile | /usr/bin/mailx -s 'binary file change' me@comp.com
fi

You will get a continuing stream of emails until you revert the offending file(s).
This User Gave Thanks to jim mcnamara For This Post:

Previous Thread | Next Thread
Test Your Knowledge in Computers #975
Difficulty: Easy
In July 2009, Alan Cox quit his Linux kernel development role as the TTY layer maintainer after disagreement with Linus Torvalds about who should pay for beers during a trip to Amsterdam.
True or False?

9 More Discussions You Might Find Interesting

1. Solaris

Exclude an specific directory for auditing in Solaris 10

Hello, Im glad to become a member of this forums, Im new on solaris and recentrly im introducing to use auditing service in that system. The need is, that I need how to exclude a directory to the audit service not audit it. And, a plus, I need of how to disable auditing the root user in... (0 Replies)
Discussion started by: sysh4ck
0 Replies

2. Solaris

Auditing Sun Servers

Hi All, I am new joinee to this forum and recently promoted as sun administrator from dba. I still dont know whether i can handle it fully . My first task is to audit set of sun servers and findout what it is doing and whether it can be upgraded or decommissioned and if upgraded whether it can... (5 Replies)
Discussion started by: sundba
5 Replies

3. Cybersecurity

Solaris Auditing: Newly specified events not being logged

Hi all I'm busy testing auditing on Solaris 10. I am using the syslog plugin to get real time view of what's happening on the system. Initially I am only monitoring lo events. The audit_control file looked like this: dir:/var/audit flags:lo minfree:20 naflags:lo... (1 Reply)
Discussion started by: notreallyhere
1 Replies

4. Solaris

Solaris user auditing

Hello, I was wondering when Solaris auditing is enabled, If it is possible to keep track of users that are allowed to sudo to root. In other words, I would like to know which user did what on my Solaris box. (assumig that user can "sudo su -" ) Thanks. (2 Replies)
Discussion started by: niyazi
2 Replies

5. UNIX for Advanced & Expert Users

Solaris auditing (file access logging) for specific directory only.

Hello, We need to log the operations that specific user on Solaris 10 (SPARC) is performing on one directory and it's contents. I was able to configure solaris auditing service (auditd) and it works fine. The only problem is that auditd logs huge amount of unneeded information. We need to log... (0 Replies)
Discussion started by: +Yan
0 Replies

6. Programming

Uncompress a gzip and bzip file using java on unix solaris environment

Hi, I need to uncompress a gzip and bzip file using java on unix solaris environment. I also need to retreive the header information of the file inorder to differentiate between gzip and bzip file. Please help Pooja (0 Replies)
Discussion started by: wadhwa.pooja
0 Replies

7. Solaris

Solaris 9 Auditing

How do I setup audit to alert on write conditions for individual files? Thanks. (3 Replies)
Discussion started by: dxs
3 Replies

8. UNIX for Dummies Questions & Answers

solaris BSM and Auditing

Hi Guys, I am new to this forum so I am sorry if i posted this thread in the wrong place. I am currently trying to get BSM to work on solaris 10 by Logging few things for me. I need your help to complete this task please. this is the config of the audit files: audit_conto # Copyright... (18 Replies)
Discussion started by: skywalker850i
18 Replies

9. Shell Programming and Scripting

speeding up the compilation on SUN Solaris environment

Dear friends, Please let me know how do I increase the speed of my compilation in SUN Solaris environment. actually I have many subfolders which contains .cc files. when I compile makefile at the root it will take much time to compile all the subfolders and generates object(.o) files. Can... (2 Replies)
Discussion started by: swamymns
2 Replies

Featured Tech Videos