Sun Microsystems, Inc.
spacerspacer
spacer www.sun.com docs.sun.com |
spacer
black dot
 
 
  Previous   Contents   Next 
   
 
Chapter 24

Managing the BSM Service (Tasks)

This chapter presents procedures that are designed to help you set up and manage a Solaris environment that includes auditing. This chapter also includes instructions for administering the audit trail and for administering device allocation. This is a list of the task maps in this chapter.

Managing BSM (Task Map)

The following task map shows the major tasks that are required to administer the BSM services.

Task

Description

For Instructions

Plan for auditing

Configuration issues to consider and make decisions about, before you configure auditing.

Chapter 23, Audit Planning

Configure audit files

Defines which events, classes, and users require auditing.

"Configuring Audit Files"

Configure auditing

Configures each host so you can use auditing.

"Configuring the Audit Service"

Manage audit records

Merges and analyzes the audit data.

"Managing Audit Records"

Manage device allocation

Defines which devices should be accessed through the device allocation mechanism.

"Managing Device Allocation"

Configuring Audit Files

Before you enable auditing on your network, you may want to edit the audit configuration files. Many of the following procedures require that you restart the service or reboot the local system. You should make as many of these changes as possible before you start the service.

Configuring Audit Files (Task Map)

The following task map describes the tasks in this section.

Task

Description

For Instructions

Change audit flags

Defines the location of the audit directories and system-wide flags for the audit service.

"How to Change Audit Flags"

Change audit characteristics for users

Selects specific auditing for a user.

"How to Change Users' Audit Characteristics"

Change audit classes

Selects which events, classes, and users require auditing.

"How to Change Audit Classes"

Change audit events

Adds new events to the auditing service.

"How to Change Audit Events"

How to Change Audit Flags

Audit flags are defined in the /etc/security/audit_control file. The audit flags select which classes of audit records are written to the audit log.

  1. Become superuser or assume an equivalent role.

  2. (Optional)

    Save a backup copy of the audit_control file.

    # cp /etc/security/audit_control /etc/security/audit_control.save
  3. Add new entries to the audit_control file.

    Each entry has the following format:

    title:string

    title

    Defines the type of line. Options are dir:, flags:, minfree:, or naflags:.

    string

    Lists specific data that is associated with the line type

  4. Instruct the audit daemon to read the new audit_control file.

    The audit daemon stores the information internally. To use the new information, either reboot the system or type the following command:

    # audit -s

Example -- Changing Audit Trail File Locations

Lines that start with dir: define which audit file systems can be used to store audit trail files. In this example, two additional locations for audit trail files are defined.

# cat /etc/security/audit_control
dir:/etc/security/audit/host.1/files
dir:/etc/security/audit/host.2/files
dir:/var/audit
flags:
minfree:10
naflags:lo

Example -- Changing Audit Flags for All Users

The flags line in the audit_control file defines which classes of events are audited for all users on the host. The classes are separated by commas, with no spaces. In this example, the events in the lo class are audited for all users.

# cat /etc/security/audit_control
dir:/var/audit
flags:lo
minfree:10
naflags:lo

Example -- Changing the Soft Limit for Warnings

The minfree line in the audit_control file defines the minimum free-space level for all audit file systems. In this example, the soft limit is set so that a warning is issued when only 10 percent of the file system is available.

# cat /etc/security/audit_control
dir:/var/audit
flags:
minfree:10
naflags:lo

Example -- Changing Auditing of Nonattributable Events

The naflags: line in the audit_control file defines which classes of nonattributable events are audited for all users on the host. The classes are separated by commas, with no spaces. In this example, the na event class was added.

# cat /etc/security/audit_control
dir:/var/audit
flags:
minfree:10
naflags:lo,na

How to Change Users' Audit Characteristics

Definitions for each user can be stored in the /etc/security/audit_user file.

  1. Become superuser or assume an equivalent role.

  2. (Optional)

    Save a backup copy of the audit_user file.

    # cp /etc/security/audit_user /etc/security/audit_user.save
  3. Add new entries to the audit_user file.

    Each entry has the following format:

    username:always:never

    username

    Selects the name of the user to be audited

    always

    Selects the list of audit classes that should always be audited

    never

    Selects the list of audit classes that should never be audited

    You can specify multiple flags by separating the audit classes with commas. For more information about audit flags, see "Audit Flags".

  4. Make the new data available to the BSM service.

    To use the new data, either reboot the system, or have the user log out and back in again.

 
 
 
  Previous   Contents   Next