Re: How to determine auditing on/off
Ad.1 not a problem - Monitoring Agent will search in all files. Ad.2 not a problem for me/Agent Ad.3 I think it's obvious for all DB's, as I said it's security monitoring. That means if HD operator notice an alert /Audit Conf Changed/ he will check if that operation was scheduled. If yes - alert gonna be canceled, if not then it maight be a potential attack. Ad.4 I think the answer is in Ad.3 . Monitoring Agent (software) has access to logs. Using yours metaphore - I want to secure DB against burglar in police officer's uniform. Thanks for your help! The second part of your answer was really helpful! Best regards Michal
My answer may have been incomplete. Check what Jonathan mentions. As an example: ONLN|2012-05-07 15:55:55.856|myhostname|21373|my_informixserver|myuser|0:ONAU:-l 7 -p /usr/informix/work/audit -s 50000000 -e 0 ONLN|2012-05-07 15:56:02.115|myhostname|21551|my_informixserver|myuser|100:LSAM: ONLN|2012-05-07 15:56:19.290|myhostname|21944|my_informixserver|myuser|100:LSAM:_default ONLN|2012-05-07 15:56:19.291|myhostname|21944|my_informixserver|myuser|0:UPAM:_default ~ "ONAU" example activating the audit (Level 7) "UPAM" a change in the _default mask So, yes, you should make sure you have ONAU activated which will force some changes to appear. As for the burglar and the police, you should restrict the tool to read only the files (not easy with sytandard UNIX filesystem permissions, but trivial with Unix ACLs). And of course, make sure you audit all the logins/commands from the privilege AAOs and DBSSOs. These can trigger the alerts for confirmation that the operation was scheduled. Again, you seem to be taking this very seriously which to be honest is nor very usual. As such, make sure you set your instances to role separation. Regards. On Mon, May 7, 2012 at 4:45 PM, MICHAL KIEK <michal.kiek@gmail.com> wrote: > Ad.1 > not a problem - Monitoring Agent will search in all files. > Ad.2 > not a problem for me/Agent > Ad.3 > I think it's obvious for all DB's, as I said it's security monitoring. That > means if HD operator notice an alert /Audit Conf Changed/ he will check if > that operation was scheduled. If yes - alert gonna be canceled, if not > then it > maight be a potential attack. > Ad.4 > I think the answer is in Ad.3 . Monitoring Agent (software) has access to > logs. Using yours metaphore - I want to secure DB against burglar in police > officer's uniform. > > Thanks for your help! > The second part of your answer was really helpful! > > Best regards > Michal > > > > ******************************************************************************* > Forum Note: Use "Reply" to post a response in the discussion forum. > > -- Fernando Nunes Portugal http://informix-technology.blogspot.com My email works... but I don't check it frequently... --0023544705ec32b57004bf7465bf
You might want to use a more sophisticated product to protect your data. Take a look at the Guardium product: http://www-01.ibm.com/software/data/guardium/. That may be more than you want, but it is comprehensive and very secure. In addition, it is a single method for securing all your various DBMS's and databases. You won't have to rig different techniques for each DBMS. Cheers, Dick Snoke ASL Solution Architect IBM - Channel Works (404) 487-1595 until May 14, 2012 (404) 238-5831 after May 13, 2012 *** Note the new number *** dsnoke@us.ibm.com From: "MICHAL KIEK" <michal.kiek@gmail.com> To: ids@iiug.org, Date: 05/07/2012 11:45 AM Subject: Re: How to determine auditing on/off [27001] Sent by: ids-bounces@iiug.org Ad.1 not a problem - Monitoring Agent will search in all files. Ad.2 not a problem for me/Agent Ad.3 I think it's obvious for all DB's, as I said it's security monitoring. That means if HD operator notice an alert /Audit Conf Changed/ he will check if that operation was scheduled. If yes - alert gonna be canceled, if not then it maight be a potential attack. Ad.4 I think the answer is in Ad.3 . Monitoring Agent (software) has access to logs. Using yours metaphore - I want to secure DB against burglar in police officer's uniform. Thanks for your help! The second part of your answer was really helpful! Best regards Michal ******************************************************************************* Forum Note: Use "Reply" to post a response in the discussion forum.