Date: Thu, 13 Feb 2003 18:58:32 +0000 From: Trent Nelson <trent@limekiln.vcisp.net> To: Julian Elischer <julian@elischer.org> Cc: freebsd-hackers@freebsd.org, des@freebsd.org, rwatson@freebsd.org Subject: Re: Some "security" questions. Message-ID: <20030213185832.GA63743@limekiln.vcisp.net>
next in thread | raw e-mail | index | archive | help
[ Re-sending due to earlier failure. ]
On Mon, Feb 10, 2003 at 06:03:07PM -0800, Julian Elischer wrote:
>
> Our client wants the following 'features'
> and we'd LIKE to be able to at least say "yes we can do that", even if
> we can also say "but we don't think it's a good idea".
>
>
> 1/ Command logging. We're thinking that a hacked version of the shell
> that logs commands may do what they want, but personally I
> think that if you are going to log things then you really want to
> PROPERLY do it, and log the EXEC commands along with the arguments.
> (sadmin et al. doesn't give arguments, and neither does ktrace)
From a security perspective, this is usually referred to as ``indi-
vidual user accountability''; i.e. the ability to hold users compl-
etely accountable for any actions performed under their account.
The notion of ``auditing'' typically goes hand-in-hand with accoun-
tability in this sense. These are recognised terms in security pu-
blications such as the Information Technology Security Evaluation
Criteria (ITSEC) [1].
I've been involved in generating a security solution that allowed
the software engineers in the US to remotely connect to a live, op-
erational, safety-related control system in London for the purposes
of fault finding and software deployment.
Before our Independent Safety and Technical Assessors would even
consider looking at such a proposal, we had to provide assurance
that every action by any user logged in remotely would always be
traceable and could be reviewed for audit purposes.
We could only permit remote access to the systems running Tru64
UNIX as it was the only OS that provided a fully-featured auditing
sub-system that met ITSEC requirements. Tru64 UNIX will allow you
to log just about any interaction with the system you fancy, from
device access to system calls to command line interaction.
Take a look at Section 10 of Tru64 UNIX Security [2] for more info-
rmation. If acountability and auditing was to be done properly, I
believe *this* is how it should be done.
I've CC'd trustedbsd-audit@trustedbsd.org to this post 'cause I
think this would be right up their ally.
Regards,
Trent.
[1] Information Technology Security Evaluation Criteria
Version 1.2, 28th June, 1991.
(http://www.cesg.gov.uk/assurance/iacs/itsec/documents/formal-docs/media/Itsec.pdf)
[2] Tru64 UNIX -- Security
Version AA-RH95D-TE, June 2001.
(http://www.tru64unix.compaq.com/docs/base_doc/DOCUMENTATION/V51A_PDF/ARH95DTE.PDF)
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030213185832.GA63743>