Solaris 10 or 8 Auditing

Hello,
Does ANYBODY know where Sun has hidden the JNI .jar files so that I can make calls to the auditing system from Java??
-tx

Thanks a lot for your response. Is pkg stuff
available on Solaris 10 or just available
on Nevada? Nevada is just the "next" version of Solaris. It's under development.
Like all versions of Solaris so far, it uses the SYSV style 'pkg' stuff.
I installed ubuntu on my laptop. apt is
really cool. I'd like to use pkg to
upgrade the system."Solaris" isn't going to do that.
You can install Nexenta, which combines the OpenSolaris kernel with a Debian/Ubuntu userland. Read the details here:
http://www.gnusolaris.org/
You may also be interested in the Solaris Express Developers Edition. It's a distribution with several development tools added in. It does have (much) higher memory requirements to complete the install, so don't try it on a low-end machine.
http://developers.sun.com/solaris/downloads/solexpdev/
Darren

Similar Messages

Can i use Oracle Database Audit Vault and Oracle Database Firewall on Solaris?

Can i use Oracle Database Audit Vault and Oracle Database Firewall on Solaris?

4195bee8-4db0-4799-a674-18f89aa500cb wrote:
i dont have access to My Oracle Support can u send text or html of document please?
Moderator Action:
No they cannot send you a document that is available only to those with access to MOS.
That would violate the conditions of having such service contract credentials.
Asking someone to violate such privileges is a serious offense and could get that other person's organization banned from all support and all their support contracts cancelled.
Your post is locked.
Your duplicate post that you placed into the Audit Vault forum space has been removed (it had no responses).
This thread which you had placed in the Solaris 10 forum space is moved to the Audit Vault forum space.
That's the proper location for Audit Vault questions.

Repoint Audit database in BO XI 3.1 SP3 running on Solaris Server

Hi,
We need to repoint to new Audit database in Solaris server which is running BO XI 3.1 SP3 .What steps we need to follow to do that? Do we require root privileges for that?
Really appreciate your the help
Regards,
Anshuman

Hi,
you can repoint the Audit DB but you cant move the content of the Audit DB with BO functions. If you want to move the content aswell you have to use DB functions for that. The process would look like:
1. Create the new DB
2. Create the connection to the new DB on the BOE Host
3. Run cmsdbsetup.sh to point the Audit DB to the new DB
4. Import the Audit Universe and configure the Universe connection to point to the new DB
Regards
-Seb.

Solaris 10 with Trusted Extensions - Security Audit Events [short] Descript

{color:#000000}I know that the security audit events and classes in Solaris 10 have changed when viewing these files: audit_class, audit_event, and audit_control with that of the same files for TSOL8. In order to perform an accurate and acceptable review of the audit events, I need to find either a file or document that provides a short description for each of the audit events within each audit class. Can anyone point me in the right direction or a URL? I have tried to search through the Sun docs and have not yielded any results. {color}

been there, done that
The problem is a function of your network definitions. The non-global zones do not have an IP address to match for your global zonename. The error message results from the system established default of the DISPLAY variable failing (DISPLAY=globalzonename:0.0).
To confirm this, login to the global zone as root and "zlogin -S" to the non-global zone. Once there, the command "netstat -r" should show the IP address of the global zone instead of the expected global zonename. (combine this with a look at your output for "ifconfig -a" within the same non-global zones) Another command you should fail with will be the "getent hosts galaxy". Anyway, if you manually set your DISPLAY variable to the "IP Address" of the globalzonename and execute a "dtterm" ... it should work fine.
If it does not violate a security policy, I suggest you add the IP address of the global zone to either the /etc/inet/hosts or /etc/inet/ipnodes file within each non-global zone.

AUDIT action (create, delete, privilege escalation, set and change password from users account and group) users and admins in Solaris 10

Hello.
in Solaris 10 i need auditing process create, delete, privilege escalation, set and change password and etc... from users account and group.
I set settings:
in file syslog.conf:
*.info;mail.none;cron.none;audit.notice            @IP-Remote-syslog-server-SIEM
in file   /etc/security/audit_control:
dir:/var/audit
flags:lo,ad,ex,cc,am,no,fc,fd
minfree:20
naflags:lo
plugin:name=audit_syslog.so;p_flags=lo,ad,ex,cc,am,no
in file   /etc/security/audit_user:
root:lo,ad:no
Now I see in the logs only the fact of a connection via SSH and run processes on behalf of users. Creation. delete users, change passwords for some reason do not is logged.
Many users. For each individual write permissions in the file /etc/security/audit_user not possible, it is likely to forget any new user (or there is a possibility in this file one line to describe the audits for all accounts?)
Where is the mistake?

You are most likely hitting Bug 15779000 user/role/groupadd/mod/del don't audit their use.
And the fix is only available in S11.2.
-- Renaud

Solaris 10, audit -n removing old logfiles.

I have a bit of a strange problem. We are running Solaris 10 on a number of systems.
Auditing is enabled on all systems and we use audit -n to rotate the log files on the hour.
On one system this works fine and each time we do a audit -n it renames the active file to a timestamped version and creates a new active audit file.
However on the other when we do audit -n (either in cron or manaually) it renames the current active one to a timestamped file. Creates a new current audit file. But within 10 seconds the old audit file dissappears.
Is there anything that would cause audit -n to behave in this manner and remove the old audit file after rotation?
Thanks in advance.
Darren

Try running audit -v /path/to/audit_control (probably /etc/security) and make sure if the syntax is ok. Are the flags in audit_control the same for both systems? Does the file system where the audit files are deposited have any kind of quota applied to it? I'm sure you've checked these things - just trying to come up with some ideas.

Solaris/SAP Memory Analysis/Audit

Experts,
We have a landscape that is only a couple of years old, but seeing some paging and buffer issues. We are running in a solaris/Oracle environment, and I was wanting to do some memory analysis, or a memory audit to make sure that we had everything configured correctly.
Memory is not really my stong suit, so if any of you have some handy resources that you dont mind sharing, I would like to research and better understand.
Our Prod Landscape is this:
Sun e2900 (#1) 8cpu (multicore) 64g
Global Zone - Ecc 600 ASCS /Oracle 10.2 Cluster (Slave)
Local zone - BI 7 CI+DB
Local Zone - XI 7 CI+DB
Sun e2900 (#2) 8cpu (multicore) 64g
Global Zone - Ecc 600 ASCS /Oracle 10.2 Cluster (Master)
Local zone - ECC CI
Qty 3 - Sun V490 (#1, #2, #3) 4cpu (Multicore) 16g
Global Zone - OS only
Local zone - ECC APP
Local zone - BI APP
Local zone - XI APP
I have the performance tuning book, and have been studying up on buffers and parameters. But first mainly looking to research how memory is assigned, where, and determine if any changes need to be made, or there is memory room to increase buffers.
Thank you.
Phillip

Apologies. I was struggling with how exactly to articulate the question. And even more with how to go about determining where we are with our memory both inside and outside of SAP. With Solaris you have Zones (containers), projects, oracle, sap, user environment settings, etc. All of which have an impact on memory, either from consumption, or limitation of memory (projects and user environment settings.)
I have looked at ST02, and we do see swaps of greater that 10k, however, before increasing the buffers, I'm trying to determine what memory we have available, and where the current memory is being used.
Our response times are not absurd. We hover around 800 - 1000 ms. Our CPU is average less than 15% util. But I think there is room for improvement/tuning on our memory and buffers, because performance does degrade over a period of weeks without an app restart.
Thank you for your response, and the help link. I am reviewing it now.
Best Regards,
Phil May
Edited by: Phil May on Sep 11, 2009 9:52 AM

Sun Solaris 2 OS vs Audition 3

Hi folks, just a newbie question please if I may ask will Audition 3 run on Sun Solaris 2 operating system or is it exclusive to Microsoft products?
I am considering moving from Vista Ultimate 64 to Solaris 2 because 1: it's free, 2: it's fast, 3: it can use my 8GB RAM whereas Vista 64 can't or doesn't know how to; everything is just SO slow, and I need speed to get my work done.
Thanks.
Ian Samson
[email protected]

Okay, so I am a real novice here. This is what I put to Sun Solaris:
My behemoth PC "Brutus" has two 500 GB HDDs, 8GB RAM, two Intel DuoCore2
3.xGHz processors, and Windows is painfully slow. If I were to download
Sun's Solaris 2 for x64 systems, is it like a Unix machine that runs
extremely quickly? Microsoft doesn't need amateur users writing them and
bugging them with user questions, they have far more important matters to
consider, such as this new Solaris 2 operating system from Sun Microsystems.
This is going to challenge Microsoft's OS realm, particularly since it is
free to download and install and use. The challenge is also there with Sun's
OpenOffice.org 3.1 release just installed today. I cannot afford Microsoft's
ever increasing prices for operating systems.
What is my learning curve going to be from running DOS 2.0 to Vista Ultimate
64, by changing to Sun Solaris 2, and will that mean I have to rid all 5
machines in my home network of Windows operating systems and move everything
onto Solaris if the hardware can take it? I simply do not have more than 24
hours in my day and it's already overstretched. I need a solution now, will
Adobe Audition 3.0.1 run on Sun Solaris 2, or can I reinstall Vista into a
Solaris "box" so that Adobe Audition thinks it is in a Windows Environment,
and Windows thinks it's in control, but in fact they are all running in a
little Solaris "box" on the PC?
2009/5/11 SteveG(AudioMasters) <[email protected]>

Audit useradd and userdel on solaris..

Hello Folks,
How can i enable auditing of useradd and userdel on solaris..
i work for a siem vendor and need to capture the message id generated for these actions..
Any help appreciated..
Thanks

Thanks Soorya,
form what i have read over the internet, that flag captures everything except useradd and userdel..
Can you confirm setting that flag will indeed capture these 2 activities?
Many Thanks

Step by step procedure for implementing User auditing in Solaris 10

we have no.of users who use either SSH terminals and Java Desktop Environment through Xbrowser through network.
We would like to know what are all the files being accessed by logged in users and what are all the changes being done, if any....
Earlier, we have enabled "script" command to get invoked automatically in ~/.bash_profile. At this stage, users are not able to get Java Desktop through xbrowser. Hence, dropped this option.
Please suggest to get rid of this script problem or some better solution through Audit logging.
Thanks in advance.

In my experience, its very rare for people to write step-by-step lists here, this is a forum which is excellent for general questions and technical problems, but, since most people who answer posts here do it in their spare time, its rare with detailed instructions of things which is rather well documented in the manual..
Having said that, the things you asks for is actually documented, have a look at:
http://docs.sun.com/app/docs/doc/816-4557/audittm-1?l=en&q=audit&a=view
.7/M.

Enabling Audit Trail (Oracle 9i Solaris 9)

Hi Guys,
On my initialization parameters Audit Trail = False. How do I change this parameter to true / Set it to true in the init.ora file.
Thank you.

Maran has given the answer to you. I suggest you read the concept guide and admin guide from Oracle for sure as these all are covered there in gory details.
Find them here
Admin Guide
Concept Guide
Aman....

Solaris 9 Oracle 9i (Audit Information)

Hi Guys.
Where can I view the audited information. I have set the audit_trail=true.
Thanx.

Please read up on the AUDIT command in the sql reference manual.
Please also run
select *
from dict
where table_name like '%AUDIT%'
There is information in your database you know, you don't need to rush to this forum for everything.
It is also recommended NOT to use the subject for platform and version information.
For version information, also '9i' is insufficient, as '9i' is a marketing label.
Sybrand Bakker
Senior Oracle DBA

Simple to use Solaris Auditing Software

Is there a simple to use auditing software that will allow me to audit user activity such as failed logins, account lockouts, succefull logins, etc..
I am aware of the SMC Log Viewer but wondered if there was another application or even a seperate 3rd party utility?
Thanks a million,
John

My coin to this - a standard answer.
Hi
There are two structures of DVDs
• Data-DVD - as burned from DeskTop/Finder
• Video-DVD - to be played on a DVD-Player - Needs a program that can do this
One can in iMovie - Export as QuickTime .mov and save this via DeskTop/Finder onto a DVD - BUT this will only play on a Computer and if it is a Window-PC this needs to download QT-player or VLC-player.
But no DVD-player for TV can play back this.
To get a Video-DVD then You need
• iDVD (not from Apple any more) - or -
• DVD Studio Pro (not from Apple any more) - or -
• FinalCut Pro-X (can do simple Video-DVDs) - or -
• Burn - http://www.digital-digest.com/software/Burn.html - FREE - but very PLAIN - no fancy things at all.
• Roxio Toast™ 11 Pro - Fairly advanced - and costs a bit - still very Good and lot's of great tool's included. (I love it) - Can also back convert home made DVDs to an editable mode in an OK quality. With BD-component also capable to do sort of Blu-Ray DVDs.
Yours Bengt W

Enabling Audit Trail (Oracle 10g Solaris 9)

Hi Guys,
How can I enable the above, not familiar with 10g.
Thank you.

Not familiar with Oracle doc ?
http://download.oracle.com/docs/cd/B19306_01/server.102/b14200/statements_4007.htm#SQLRF01107
Nicolas.

Auditing file server setup issues - nfs permissions

I have half-dozen Solaris 10 workstations requiring Solaris Auditing enabled and audit files saved. I used a spare Solaris 10 system with 2-72GB disks and formatted 2nd disk for entired 72GB. I shared out the 72GB partition on this system and modified /etc/security/audit_control on a test Solaris 10 W/S to use the shared-out partition on Audit file server as primary audit directory. Following directions in Solaris 10 Admin Gde I chmod -R 750 the mount pt using the 72GB partition before sharing out the partition. However, all client W/S's that I enable Auditing would not use the 72GB partition on file server until I went back and chmod 777 the partition and rebooting file server. Also, on any client that I have enabled Auditng to use nfs-mounted 72GB partion on file server I cannot as a non-root user issue a "df -k" command without getting error:
df: cannot statvfs /var/audit/fmaud.1/files: Permission denied
Is this normal or did I miss a chmod step or two in setting up Audit clients and/or Audit file server?

The roundcube db schema needs to setup manually. See /usr/share/webapps/roundcube/INSTALL
Also, from your /etc/webapps/postfixadmin/config.inc.php:
$CONF['domain_path'] = 'NO';
$CONF['domain_in_mailbox'] = 'YES';
$CONF['maildir_name_hook'] = 'NO';
..which results in /var/mail/vmail/[email protected]
From your dovecot.conf
mail_home = /var/mail/vmail/%d/%u
...which results in /var/mail/vmail/domain.com/user
That doesn't fit together.

Solaris 10 or 8 Auditing

Similar Messages

Maybe you are looking for