White Paper

ManualsBrandsHP ManualsSoftwareHP HP-UX Auditing System Extensions

HP-UX 11i v2 and 11i v3 Security

Configuring and Managing the Auditing System

Technical white paper

Table of contents

Audience............................................................................................................................................ 2

Introduction......................................................................................................................................... 2

Auditing system overview ..................................................................................................................... 3

Architecture..................................................................................................................................... 3

Audit tags ....................................................................................................................................... 5

Audit trail........................................................................................................................................ 5

Audit events .................................................................................................................................... 5

Audit tunable parameters (HP-UX 11i v3 only) ..................................................................................... 7

Self-auditing programs...................................................................................................................... 7

Auditing system extensions (HP-UX 11i v3 only) ................................................................................. 13

HP-UX Auditing System Administration.................................................................................................. 14

Installation..................................................................................................................................... 14

Configuration ................................................................................................................................15

Management................................................................................................................................. 18

Writing a DPMS service module .......................................................................................................... 19

Service Provider Interfaces (SPIs) ...................................................................................................... 19

DPMS service module implementation............................................................................................... 19

Best practices .................................................................................................................................... 19

Audit policy................................................................................................................................... 20

Audit generation and capture.......................................................................................................... 20

Audit retention and storage............................................................................................................. 21

Audit log analysis .......................................................................................................................... 21

Audit log configuration, security, and protection................................................................................ 22

Troubleshooting................................................................................................................................. 22

Glossary........................................................................................................................................... 24

For more information.......................................................................................................................... 26

Send comments to HP......................................................................................................................... 26

Summary of content (26 pages)

PAGE 1
HP-UX 11i v2 and 11i v3 Security Configuring and Managing the Auditing System Technical white paper Table of contents Audience ............................................................................................................................................ 2 Introduction......................................................................................................................................... 2 Auditing system overview ................................................................
PAGE 2
Audience This white paper is for security administrators responsible for defining and implementing host audit security policies, and for system administrators responsible for configuring and managing HP-UX. This white paper provides guidance to administrators for planning, deploying, configuring, and managing the HP-UX Auditing System features on HP-UX 11i v2 with HP-UX Standard Mode Security Extensions (SMSE) installed and on HP-UX 11i v3 with HP-UX Auditing System Extensions installed.
PAGE 3
Auditing system overview This section describes the HP-UX Auditing System architecture and provides a high-level description of the major HP-UX Auditing System components. For a complete introduction and overview of HP-UX Auditing System, see audit(5). Architecture Figure 1 shows the main user-space and kernel-space components of the HP-UX Auditing System on HP-UX 11i v2 and 11i v3. Components that are only available on HP-UX 11i v3 are labeled. Figure 1.
PAGE 4
• userdbset(1M) — Modifies the per-user AUDIT_FLAG attribute stored in the userdb(4) database. • audisp(1M) — Analyzes and displays the audit information contained in the specified audit trails. For more information, see the corresponding manpages. System calls • audswitch(2) — Invoked by privileged programs to temporarily suspend or resume auditing on the current process; it affects only the current process.
PAGE 5
Audit tags When a user logs in, a unique audit session ID called an audit tag is generated and associated with all audit records for the user's processes associated with that login. The audit tag is a string that includes the login name and the login time, and remains the same during the login session. Even if a user changes identity within a single session, all events are still recorded with the same audit tag and accountable under the original login user's name.
PAGE 6
• Where the event occurred (host name and IP address of host) • When it occurred (timestamp) • Details (for example, system call arguments and self-auditing text) There are also audit records called version and system call table records that appear at the beginning of each audit trail, and a Process ID (PID) Identification Record for each audited process. Each of these audit records consists of an audit record header and a record body.
PAGE 7
Audit tunable parameters (HP-UX 11i v3 only) You can modify the auditing operation dynamically by changing one of the following audit tunable kernel parameters: • audit_memory_usage — Defines the percentage of physical memory to be used by audit records. If the audit record memory usage exceeds the audit_memory_usage limit, the audit subsystem blocks the system call until memory usage decreases to within the limit. You can change this tunable value at any time.
PAGE 8
The list and information is incomplete and might change in the future. Audit aware Most self-auditing programs are audit aware. They can suspend the currently specified low-level system call auditing on themselves by invoking the audswitch(2) system call and can produce a high-level description of the operations they perform by invoking the audwrite(2) system call to generate self-auditing events.
PAGE 9
audomon: kernel audit daemon has switched auditing to the backup trail audomon: FreeSpaceSwitch point reached, but audomon failed to switch audit trail audomon: AuditFileSwitch point reached, but audomon failed to switch audit trail audomon: failed to update audit trail configuration information in /etc/audit/audnames:current_trail=pathname of current trail • audsys(1M) (admin) audsys: argv1 … argvn audsys: various error condition messages (too many to list here) audsys: current audit trail directory is cha
PAGE 10
• groupadd(1M) (admin) Attempt to add a new group failed A new group added successfully.
PAGE 11
ACCESS CONTROL CHECK: privrun: command execution failed: command=command; username=username; program=privrun; euid=euid; ruid=ruid; egid=egid; rgid=rgid; • setfilexsec(1M) (modaccess) Could not lock file No passwd entry Memory allocation failed Failed to re-exec the command after initializing FAT Not authorized Failed to raise necessary privileges Could not register exit routine Configuration file update failed for file pathname • setrules(1M) (admin) Memory allocation failure Failed to create ipc rules for
PAGE 12
Audit unaware Some self-auditing programs do not invoke the audswitch(2) system call to suspend system call auditing on themselves, nor directly invoke audwrite(2) to generate self-audit records. Instead, these privileged programs invoke a library routine that generates a self-auditing event on its behalf. For example, telnetd(1M) is a privileged program that invokes the pam_hpsec(5) PAM module for authenticating users.
PAGE 13
Failed login attempt - login incorrect. | Failed login attempt - anonymous password not rfc822. (ipcopen) The login event for the Service=su self-audit event is only generated when the pam.conf entry for su does not have the bypass_setaud flag set and when source user is not root. See pam_hpsec(5).
PAGE 14
• The audit_filters DLKM makes filtering decisions and enforces the filtering policy in the kernel. Filtering in the kernel can occur both before and after the invocation of the system call code. See the definitions of system call pre-filtering and post-filtering in Glossary.
PAGE 15
• HP-UX Auditing System Extensions (HP-UX 11i v3) The auditing system is installed as part of the base HP-UX 11i v3 distribution. However, Auditing System Extensions bundle must be installed to make use of the AudReport and AudFilter product features. Both products are available on software.hp.com and have Release Notes on the Business Support Center that contain details about product compatibility, installation requirements, patch requirements, and installation instructions.
PAGE 16
• The root user runs su – non_root_user, where the target non-root user is being audited. When the root user switches to another user, the Pluggable Authentication Module (PAM) is not invoked; no authentication is done when running as root. Therefore, audit records are not generated as being triggered by the non-root target user, but are instead attributable to the root user. Configuring events for audit Use the audevent(1M) command to specify system activities (auditable events) that you want to audit.
PAGE 17
NTHREADS – The number of log files that compose an audit trail. The recommended value is the number of processors on a system divided by two. • Audevent settings – Arguments to the audevent command – AUDEVENT_ARGS1 describes those events that are audited for both success and failure. – AUDEVENT_ARGS2 describes those events that are success only. – AUDEVENT_ARGS3 describes those events that are failure only. – AUDEVENT_ARGS4 describes those events that are audited for neither success nor failure.
PAGE 18
Use an editor (for example, vi) to directly edit the /etc/rbac/aud_filter file. The HP-UX RBAC administrative commands do not provide an interface to configure /etc/rbac/aud_filter. Management This section describes how to enable and disable auditing, and how to rotate audit log files. Enabling auditing To enable auditing, use one of the following methods: • Enter the /sbin/init.d/auditing start command. When you do this, the following occurs: – Reads the /etc/rc.config.d/auditing file.
PAGE 19
sh -c "/usr/local/bin/rcp_audit_trail hostname /var/.audit/my_trail" This copies /var/.audit/my_trail to a remote system, assuming that is what the given script intends to do. Writing a DPMS service module The Audit Data Process Module Switch (Audit DPMS) framework offers the ability to selectively access audit data in various formats through a set of common programming interfaces.
PAGE 20
Audit policy Develop a policy for auditing based on the amount of security the site requires, the types of users administered, and the costs of auditing. Document the policies, perform periodic reviews, and update policies as needed. Based on the policy, take the following decisions as part of planning: • Decide which users and events to audit based on the site policy. • Decide whether to audit the selected events for success, for failure, or both.
PAGE 21
Audit retention and storage Storage cost is the most significant operational cost of auditing. The amount of audit data depends on the site policy for the following major factors: different number of users; different usage of the system or system loads (web or application server, timesharing system, workstation); degree of traceability and accountability that is required.
PAGE 22
– Audit Trail Reports (auditdp) in HP-UX 11i v3. In addition, you can use the following tools in /opt/audit/AudReport/bin: audit_p2l — This sample script demonstrates how to convert audit data in portable format (see audit_hpux_portable(5)) to message lines similar to syslog. The script takes no options or arguments. It reads portable audit data from stdin and outputs the message lines to stdout.
PAGE 23
The inetd daemon honors the AUDIT_FLAG only for the user under whom the service is run when inetd is started with the –a option. Self-audit login and logoff events are generated regardless of the inetd –a option and whether the user is enabled or disabled for auditing. Most inetd services run as user root and disabling auditing for root is not recommended, as this results in no system call auditing of users logged in as root.
PAGE 24
Glossary Audit Aware Programs Privileged programs that invoke either the audswitch system call to suspend system call auditing or the audwrite system call to generate self-auditing events. Audit aware programs are also called self-auditing programs. Audit Event Also called an Audit Record. An event is an instance of a subject accessing an object. For example, a process opening a file or a user logging into a system.
PAGE 25
AudFilter Product pre-filtering — Fine-grained filtering in the kernel to selectively record the audit records that were generated and stored in the audit trail. This reduces the size of the audit trail and enhances system call pre- and post-filtering by supporting rules-based filtering as a function of other attributes, such as system call parameters (for example, the open(2) oflag parameter), file owner, file system on which a file resides, and system call errno.
PAGE 26
For more information To read more about the HP-UX Auditing System, see the following: • Manpages (either installed on the system or at http://www.hp.com/go/hpux-clickable-manpages • HP-UX System Administration Guide: Security Management at: http://www.hp.com/go/hpux-core-docs Click on the HP-UX version you want and scroll down to User guide. Send comments to HP HP welcomes your input.