18.07.2013 Views

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Auditing on the<br />

<strong>Sidewinder</strong> <strong>G2</strong><br />

Auditing on the <strong>Sidewinder</strong> <strong>G2</strong><br />

Auditing is one <strong>of</strong> the most important features on the <strong>Sidewinder</strong> <strong>G2</strong>.<br />

The <strong>Sidewinder</strong> <strong>G2</strong> generates audit each time the <strong>Sidewinder</strong> <strong>G2</strong> or<br />

any <strong>Sidewinder</strong> <strong>G2</strong> service is stopped or started. Audit is also<br />

generated when any <strong>of</strong> the <strong>Sidewinder</strong> <strong>G2</strong>’s audit facilities are<br />

modified. Other relevant audit information that is captured includes<br />

identification and authentication attempts (successful and failed),<br />

network communication (including the presumed addresses <strong>of</strong> the<br />

source and destination subject), administrative connections (such as<br />

changing to the srole), and modifications to your security policy or<br />

system configuration (including all administrator activity, such as<br />

changing the system time).<br />

The <strong>Sidewinder</strong> <strong>G2</strong>’s audit facilities also monitor the state <strong>of</strong> log files<br />

to minimize the risk <strong>of</strong> lost data. Log files are compressed, labelled,<br />

and stored on a daily basis, and a new “current” log file is created.<br />

Using this mechanism, no audit data is lost during the storage<br />

transition.<br />

The amount <strong>of</strong> available audit storage space is monitored very closely<br />

on the <strong>Sidewinder</strong> <strong>G2</strong> via the rollaudit and logcheck utilities to<br />

monitor the log file size and rotate log files as needed. (For<br />

information on using rollaudit, see “Rollaudit cron jobs” on page A-16.<br />

For information on using the logcheck utility, refer to the logcheck<br />

man page.)<br />

There are three main components to the <strong>Sidewinder</strong> <strong>G2</strong> audit process:<br />

auditd—This is the audit logging daemon. This daemon listens to<br />

the <strong>Sidewinder</strong> <strong>G2</strong> audit device and writes the information to log<br />

files. The log files provide a complete record <strong>of</strong> audit events that<br />

can be viewed by an administrator. auditd sends all audit data to<br />

a binary file called /var/log/audit.raw.<br />

Note: You configure this daemon by editing the /etc/sidewinder/auditd.conf file.<br />

In this file, you can specify that auditd append the host names <strong>of</strong> the source and<br />

destination IP addresses to the audit event. By default, this option is turned <strong>of</strong>f in the<br />

/etc/sidewinder/auditd.conf file. When turned on, IP addresses are resolved using<br />

the non-blocking resolver, nbresd.<br />

auditbotd—The <strong>Sidewinder</strong> <strong>G2</strong> uses a process called the<br />

auditbot (referred to as alarms in the Admin Console) which also<br />

runs as a daemon (auditbotd). This daemon listens to the audit<br />

device and gathers the security-relevant information it finds. The<br />

auditbot process looks for specific types <strong>of</strong> events that are defined<br />

in the /etc/sidewinder/audit_filters.conf file.<br />

Monitoring, Auditing, and Reporting 18-5

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!