Front cover - IBM Redbooks

password being requested and allowed to continue its boot-up sequence after
the password is entered. Ideally, the security policy for the organization will
establish precedence (security over service agreements).
► Supervisory password: This is a password which prevents an unauthorized
user from booting the server into maintenance mode using installation media
(installation CD, mksysb tape/CD). Booting off of such media allows full
access to files and directories without security restrictions that are in place. A
supervisory password locked system, if the password is lost, will need to be
serviced by IBM in order to unlock it.
► Root password: This is the super-user password which may need to be used
from the time to time. It’s important to be aware of when the root account will
need to be used, and plans should be in place in the organization’s security
implementation to address these instances.
Security weaknesses
Every good AIX system administrator should be aware of systems in the
organization’s IT infrastructure that might have security weaknesses. If a
would-be intruder breaks into a machine located inside the organization’s
network, access may be granted to other machines through permissions set up
between the point of entry machine and other systems in the network.
Some would-be attackers scan networks for certain machine types and certain
versions of operating systems to find one to break into, and they can then use
that point of entry to gain access to all other machines in the network.
9.5.5 Enabling system auditing
Users regularly perform various system actions that will need to be monitored
more closely. By setting up system auditing, it is possible to record
security-relevant information, which can be analyzed to detect potential and
actual violations of the system security policy.
Predefined audit events can be found in the /etc/security/audit/events file.
Automated auditing can be set up using the cron facility to generate regular
reports.
9.5.6 Monitoring files, directories, and programs
Our discussion on hardening would not be complete without looking at the
mechanisms that can be used to monitor access to files, directories, and
executable programs.
Chapter 9. Server hardening 407