HP-UX System Administrator's Guide: Security Management HP-UX 11i v3 (B3921-90020, September 2010)

starts a new login session. See Chapter 9 for more information about audit
tags.
• Turns on the audit flag for all existing users.
• Converts the at, batch, and crontab input files to use the submitter's audit
ID.
5. Verify that the audit files are on the system:
1. Use swlist -l fileset to list the installed file sets. Look for the fileset
called SecurityMon, which contains the auditing program files. To reduce
the listing, enter the following command:# swlist -l fileset | grep
Security
2. In addition, verify that the following files (not specified in SecurityMon)
also exist:
• /etc/rc.config.d/auditing contains parameters to control auditing.
You can modify this file with SMH or by hand with a text editor.
• /sbin/rc2.d/S760auditing is the script that starts auditing. Do not
modify this file.
6. After converting to a trusted system, you can use the audit subsystem and run the
HP-UX system as a trusted system.
NOTE: On HP-UX 11i v3, an auditing system also works on a system without
converting to a trusted system.
See Chapter 9 for more information.
If you need to convert from a trusted system back to a standard system, run HP SMH
and use the Auditing and Security window. The Audited Events, Audited System
Calls, and Audited Users screens all provide an unconvert option.
TIP: One way to determine if the system has been converted to a trusted system is to
look for/tcb files. If they exist, then you have a trusted system.
A.2 Auditing a Trusted System
Auditing a trusted system is very similar to auditing a system that has not been
converted to trusted mode. See Chapter 9 for the information on auditing. The only
difference is how to select audited users. On a system that has not been converted to
trusted mode, the userdbset command is used to specify those users who are to be
audited. See userbdset(1M) and userdb(4). The associated attribute is called AUDIT_FLAG
and is described in security(4). On a trusted system, the audusr command specifies
those users who are to be audited. See audusr(1M) for more information.
A.3 Managing Trusted Passwords and System Access
The password is the most important individual user identification symbol. With it, the
system authenticates a user to allow access to the system. Because they are vulnerable
186 Trusted Systems