UNIX for Dummies Questions & Answers

Hi everyone !

I'd like to know if unix keeps track of all operations done in a log file. I know crontab works this way, but what about operations specified in command lines ?

Thanks !

Christian B

This depends on several factors...

First most modern shells can optionally keep a history file. Users can use the the history file to record their commands and repeat previous commands, etc. Users can also decline to keep a history file.

Most (perhaps all?) version of unix have systemwide accounting. But accounting was developed in an era when users paid for cpu seconds. It's pretty good at recording cpu time used by each user. And it can produce produce a list of commands that each user ran. But the info is limited and can be easily fooled. It was never intended for security.

Some versions of unix have what are called C2 security features. Few of them have actually obtained a C2 rating from the US Dept of Defense, but they have the features that DOD would look for. HP-UX is in this category. It can record each system call executed by each user. And you can specify various levels of logging for various users. This type of logging can be very detailed and on a properly admin'ed system cannot be fooled by a non-root user.

Note that both accounting and c2 security logging can require considerable resources including lots of disk space. For this reason, they are rarely used.

Just as a little note:
HP-UX 9.* actually has a C-2 rating from the NSA... I don't know if any variants still do.

I believe you can find out at the nsa.gov site...

No version of HP-UX has ever achieved a C2 rating although I'm sure it could if HP choose to persue it.

HP-UX BLS 8.04 and HP-UX BLS 9.09 are rated at B1. And yes, the ratings are current. These are the only official ratings that HP-UX has ever held.

HP's proprietary OS, MPE, did have a C2 rating. MPE V/E G.03.04 was rated at C2 but this rating has now expired. This may be what you thinking of.

Also, it's ok to have a higher level of security than is needed. So if NSA wanted a C2 version of UNIX, HP may indeed have sold them HP-UX BLS 9.09. When you hold a B1 rating, you completely meet the requirements for C2.

You can view the list of currently rated products at the Evaluated Products List. And here is the Historical EPL.

Oops, got my B's and C's mixed up, eh? Even then...

Oh well, what's the point of making excuses...

Thanks for the info, Perderabo.