From: frank@poiro.ilo.dec.com (Frank O'Neill)
Subject: Help needed with auditing setup
Reply-To: foneill@clada.enet.dec.com
Organization: Digital Equipment Corporation
Date: Wed, 14 Oct 1992 13:11:29 GMT


Hi folks,

	Apologies for my inexperience with AIX, but I am having severe 
	difficulties setting up/checking the status of auditing. I would
	greatly appreciate any help you can give me with the following
	queries:

	1. How is system auditing set up?  You can configure certain classes 
	   for each user in the /etc/security/audit/config file, but what
           events are audited on a system wide basis?

	2. If I do an "audit query", as well as listing the classes defined 
           in my config file, it also lists an ALL class.  What determines
           which events are listed here?  How may this be changed?  Are these 
           the system-wide audit events, or do all the classes combined 
           constitute the system-wide auditing?

	3.  The auditevents subroutine "gets or sets the status of system 
            event auditing".  When I try to get this status using:

                auditevents(AUDIT_GET,&classes,nclasses);

            the list returned in classes seems to be empty and nclasses = 0 
            even though doing an "audit query" returns something like:

# audit query 
auditing on
bin processing off
audit events:
        general - USER_SU,PASSWORD_Change,FILE_Unlink,FILE_Link,FILE_Rename
           :
           :
        ALL - PROC_Create,PROC_Delete,S_ENVIRON_WRITE,S_GROUP_WRITE,S_LIMITS_WRI
TE,S_LOGIN_WRITE,S_PASSWD_READ,S_PASSWD_WRITE,S_USER_WRITE,AUD_CONFIG_WR,USER_SU
,PASSWORD_Change,FILE_Unlink,FILE_Link,FILE_Rename,SRC_Start,SRC_Stop,SRC_Addssy
s,SRC_Chssys,SRC_Delssys,SRC_Addserver,SRC_Chserver,SRC_Delserver,PROC_Execute,P
ROC_RealUID,PROC_AuditID,PROC_RealGID,PROC_AuditState,PROC_AuditClass,PROC_Envir
on,PROC_SetSignal,PROC_Limits,PROC_SetPri,PROC_Setpri,PROC_Privilege,FILE_Open,F
ILE_Read,FILE_Write,FILE_Close,FILE_Owner,FILE_Mode,FILE_Acl,FILE_Privilege,DEV_
Create,MSG_Create,MSG_Read,MSG_Write,MSG_Delete,MSG_Owner,MSG_Mode,SEM_Create,SE
M_Op,SEM_Delete,SEM_Owner,SEM_Mode,SHM_Create,SHM_Open,SHM_Close,SHM_Owner,SHM_M
ode,SENDMAIL_Config,SENDMAIL_ToFile,AT_JobAdd,AT_JobRemove,CRON_JobAdd,CRON_JobR
emove,TCPIP_config,TCPIP_host_id,TCPIP_route,TCPIP_connect,TCPIP_data_out,TCPIP_
data_in,TCPIP_access,TCPIP_set_time,TCPIP_kconfig,TCPIP_kroute,TCPIP_kconnect,TC
PIP_kdata_out,TCPIP_kdata_in,TCPIP_kcreate,CRON_Start,CRON_Finish,DEV_Remove,USE
R_Login

audit objects:
        /etc/security/audit/config:
                 w = AUD_CONFIG_WR
           :
           :
        /etc/security/login.cfg:
                 w = S_LOGIN_WRITE


	4.  I now try to set the status of system auditing, again using
            the auditevents subroutine:

        classes.ae_name = "general";
        classes.ae_list = "PROC_Create";
        classes.ae_len = 13;

        auditevents(AUDIT_SET,&classes,nclasses);

            This seems to completely obliterate all the audit event classes 
            (nclasses again = 0) so that an "audit query" now returns:

# audit query
auditing on
bin processing off
audit events:
        none

audit objects:
        /etc/security/audit/config:
                 w = AUD_CONFIG_WR
            :
            :
        /etc/security/login.cfg:
                 w = S_LOGIN_WRITE


        5.  Where can I find a list of all events which may be validly added 
            to the /etc/security/audit/events file i.e. are valid auditable
            events?

        6.  Is the format of the /etc/security/audit/events file supposed 
            to be like that of other stanza files such as 
            /etc/security/audit/config i.e. should there not be any blank lines
            between successive attiributes such that a blank line will then 
            signify the end of that stanza?  My installed events file was of 
            the form:

auditpr:

* kernel proc events 

*       fork()
        PROC_Create = printf "forked child process %d"

*       exit()
        PROC_Delete = printf "exited child process %d"
           :
           :

            but should this really be like:
auditpr:
        PROC_Create = printf "forked child process %d"
        PROC_Delete = printf "exited child process %d"
           :
           :


        Thanks again if you can help untangle this web for me,

	Frank

--
Frank O'Neill,                    
Digital Equipment Corporation,
Galway, Ireland.
foneill@clada.enet.dec.com
Newsgroups: comp.unix.aix