Re: Logging of DBA activity for SOX

It's helpful to see these answers. I also have a need to evaluate the controls for database management relating to Informix. Does anyone know where to find an audit program for the "internal controls" for a Informix database. (From an auditor perspective, controls apply accross all platforms and OSes). In this case, this is for Informix on Unix (HPUX 11.0) Thanks. Jonathan Leffler wrote: > On 31 Jul 2006 05:21:05 -0700, SteveT68@gmail.com wrote: > > > I am not an Informix DBA, but have been challenged with implementing a > > logging solution for Sarbanes Oxley compliance. > > > Bad luck - that you got the assignment. I wish you good luck in achieving > the "solution". > > What we would like to do is log all activity on the database by the > > Informix DBA's. In particular, we would like to include log on/off > > activity, plus all scripts run by the DBA during their connection. > > > You are going to need to clarify your terminology, to yourself and to us. > It would also be helpful to have basic environment information - which > machine type (especially Unix/Linux vs Windows) and which version or > versions of IDS (7.31 vs 9.xx vs 10.00, for example). > > What do you mean by: > * The Informix DBAs > * Log on/off > * Scripts run by the DBA > > I'm not trying to be awkward - though I'm probably succeeding. However, the > terms have a variety of meanings, and not everyone within the Informix camp > would necessarily automatically agree withme about the meanings, though I > could probably argue them into agreeing eventually. > > Informix DBAs: Do you mean the 'informix' user who monitors the server > instance, or do you mean the DBA who manages a database within an instance? > I susepct the former, primarily, though you'll also need to worry about the > latter too. > > Log on/off: Do you mean the log on to the operating system (which is an o/s > level auditing operation - there's nothing Informix can do to help you > directly there), or do you mean connections to the database server and > operations on the database server - such as running 'oninit', 'onmode', > 'oncheck', 'onstat' and 'onbar' (or do you use 'ontape'?). > > Scripts run by the DBA: There are very few scripts provided by IDS - do you > really mean programs run by the DBA? Such as the ON* utilities mentioned > above? > > The details of what you do will probably vary depending on the answers to > these questions. > > You will need to look at an integrated or holistic solution - some parts > will depend on the operating system itself (syslog, basic process > accounting, general system security), other parts will depend on IDS > facilities (notably the ON-Audit and ON-ShowAudit facilities documented in > the Trusted Facility Manual - as mentioned by Obnoxio the Clown), and other > parts may have to be introduced. For example, I'd consider using the sudo > command to control access to the informix user ID. No-one can login as user > informix - they can only assume the user ID by invoking sudo (not su), and > sudo is used to log that activity auditably. > > You will need to consider whether 'role separation' is appropriate for you. > In part, that will depend on the size of your operation - how many > administrative types are you dealing with? If you've got one person running > both the operating system and the databases, you face a different challenge > from if you have a staff of 30 managing the operating system aspects of the > systems, and another 10 managing the databases, plus 50 developers working > on development and maintenance of the systems running the show. > > As you will see from the above, I am no expert, in fact have never > > touched Informix! What I am after is some background info, to help me > > guide the DBA's in order that they do not just tell me "it can't be > > done". > > > I'd suggest hunting for 'Is Your DBA Paranoid Enough' on Google - with > quotes. You'll find various versions of my presentation in this general > area. It doesn't directly answer your question - it does contain lots of > information. For the most part, the version of IDS is not a critical issue, > but the most secure solution is the most recent 10.00 version. > > Our Log collection tool, will be Network Intelligence enVision, which > > supports logs from syslog, or ftp of text files from a server, or ODBC > > connection to a table in the DB. > > > It is, just about, possible to get IDS to report auditing activity to the > syslog. It requires root privileges to do that (unless I'm misremembering > horribly), and it isn't quite as simple as you'd like. > > By the way, we have similar challenges with Oracle and SQL! > > > SQL? As in MS SQL Server? Or as in the common language used by Oracle and > IDS (and other SQL DBMS of note)? You will need to sharpen up the precision > of your language if you wish to get sharp answers. > > -- > Jonathan Leffler #include <disclaimer.h> > Email: jleffler@earthlink.net, jleffler@us.ibm.com > Guardian of DBD::Informix v2005.02 -- http://dbi.perl.org/ >