bsm pr audit under solaris 8

bsm pr audit under solaris 8

Post by Jay Slagl » Sat, 19 May 2001 00:20:57



Anyone have a program that makes pretty reports for
auditing rather than using praudit?

Thanks,

Jay Slagle

 
 
 

1. BSM, Solaris 8 and auditing changes to /etc/shadow

Platforms:  sun4u, sun4m
OS: Solaris 8 [Solaris 7 and Solaris 9 would be help as well]

I have a requirement to check for user password updates (not the
actual passwords, just that a user updated their password).  All
users on these systems have password expiration configured.  Now,
users login via the console (non-graphical) and fire up their
X server of choice.  I ran into an anomily where if a users passwd
expires and the user if forced to set a new password at login time
(on the console) I cannot see the sucessfull password update in
the audit trail.  I then though I might be able to track changes
to file /etc/shadow, but here again I've run into some strange
behaviour...  On sun4u platforms I might be able to track
unlink(2) and link(2), but I was not able to see these on sun4m
machines (I set all flags simply for testing).

Q:  Is there a way to track password updates during the login
process on the console in the audit trail?  If so, how?  I assume
this has to do with pam_unix.so...

Any help appreciated...

2. Diamond Viper VLB Video Card?

3. Thoughts on Solaris BSM Auditing

4. Compiling Tcsh 6.02 with gcc 2.2.2 under SunOS 4.1.1?

5. Auditing printing using Solaris BSM.

6. Is X getting old?

7. Adding Solaris BSM auditing to a program

8. Dos 16-bit => 32

9. Solaris 8 BSM audit data error

10. How does Solaris BSM audit work?

11. Help: Creating Concise Solaris BSM Audit Trails

12. Does *anyone* use BSM (auditing)

13. configuring auditing on 2.3 with the BSM