* RE: Auditing in old versions of Linux [not found] <mailman.41.1269964815.15431.linux-audit@redhat.com> @ 2010-03-30 16:58 ` Woodie, Paul E, CIV, DSS 2010-03-30 17:03 ` Ray Pittigher 0 siblings, 1 reply; 5+ messages in thread From: Woodie, Paul E, CIV, DSS @ 2010-03-30 16:58 UTC (permalink / raw) To: linux-audit There is an audit package called Snare, which would make possible auditing on previous versions of linux. It worked well. Unfortunately, that also required (usually) modified versions of the kernel. Perhaps you can find some of those components. I have not used Snare in quite a while. Paul Woodie, CISSP, IAM -----Original Message----- From: linux-audit-bounces@redhat.com [mailto:linux-audit-bounces@redhat.com] On Behalf Of linux-audit-request@redhat.com Sent: Tuesday, March 30, 2010 12:00 PM To: linux-audit@redhat.com Subject: Linux-audit Digest, Vol 66, Issue 12 Importance: Low Send Linux-audit mailing list submissions to linux-audit@redhat.com To subscribe or unsubscribe via the World Wide Web, visit https://www.redhat.com/mailman/listinfo/linux-audit or, via email, send a message with subject or body 'help' to linux-audit-request@redhat.com You can reach the person managing the list at linux-audit-owner@redhat.com When replying, please edit your Subject line so it is more specific than "Re: Contents of Linux-audit digest..." Today's Topics: 1. Auditing in old versions of Linux (Mario Chancay) ---------------------------------------------------------------------- Message: 1 Date: Tue, 30 Mar 2010 08:32:35 -0700 (PDT) From: Mario Chancay <mario.chancay@yahoo.com> To: linux-audit@redhat.com Subject: Auditing in old versions of Linux Message-ID: <27921.42909.qm@web45214.mail.sp1.yahoo.com> Content-Type: text/plain; charset="us-ascii" Due to technical and budget constrains, we are not yet able to migrate some old linux boxes to the latest versions but need to configure auditing under the following platforms : - Red Hat Linux Enterprise AS 3.4, 3.5, 3.6 - Red Hat Linux 4.x Need advice to confirm if auditing is possible under this versions and also the recommended procedure to install/setup as I understand that the auditd package depends on the kernel version. Regards Mario -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://www.redhat.com/archives/linux-audit/attachments/20100330/875002 02/attachment.html> ------------------------------ -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit End of Linux-audit Digest, Vol 66, Issue 12 ******************************************* ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Auditing in old versions of Linux 2010-03-30 16:58 ` Auditing in old versions of Linux Woodie, Paul E, CIV, DSS @ 2010-03-30 17:03 ` Ray Pittigher 0 siblings, 0 replies; 5+ messages in thread From: Ray Pittigher @ 2010-03-30 17:03 UTC (permalink / raw) To: Woodie, Paul E, CIV, DSS; +Cc: linux-audit@redhat.com What kind of auditing and/or lock downs do you use at DSS? On 03/30/2010 12:58 PM, Woodie, Paul E, CIV, DSS wrote: > There is an audit package called Snare, which would make possible > auditing on previous versions of linux. It worked well. Unfortunately, > that also required (usually) modified versions of the kernel. Perhaps > you can find some of those components. I have not used Snare in quite a > while. > > > Paul Woodie, CISSP, IAM > > -----Original Message----- > From: linux-audit-bounces@redhat.com > [mailto:linux-audit-bounces@redhat.com] On Behalf Of > linux-audit-request@redhat.com > Sent: Tuesday, March 30, 2010 12:00 PM > To: linux-audit@redhat.com > Subject: Linux-audit Digest, Vol 66, Issue 12 > Importance: Low > > Send Linux-audit mailing list submissions to > linux-audit@redhat.com > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.redhat.com/mailman/listinfo/linux-audit > or, via email, send a message with subject or body 'help' to > linux-audit-request@redhat.com > > You can reach the person managing the list at > linux-audit-owner@redhat.com > > When replying, please edit your Subject line so it is more specific than > "Re: Contents of Linux-audit digest..." > > > Today's Topics: > > 1. Auditing in old versions of Linux (Mario Chancay) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 30 Mar 2010 08:32:35 -0700 (PDT) > From: Mario Chancay<mario.chancay@yahoo.com> > To: linux-audit@redhat.com > Subject: Auditing in old versions of Linux > Message-ID:<27921.42909.qm@web45214.mail.sp1.yahoo.com> > Content-Type: text/plain; charset="us-ascii" > > Due to technical and budget constrains, we are not yet able to migrate > some old linux boxes to the latest versions but need to configure > auditing under the following platforms : > > - Red Hat Linux Enterprise AS 3.4, 3.5, 3.6 > - Red Hat Linux 4.x > > Need advice to confirm if auditing is possible under this versions and > also the recommended procedure to install/setup as I understand that the > auditd package depends on the kernel version. > > Regards > > Mario > > > > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: > <https://www.redhat.com/archives/linux-audit/attachments/20100330/875002 > 02/attachment.html> > > ------------------------------ > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit > > End of Linux-audit Digest, Vol 66, Issue 12 > ******************************************* > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit -- Ray Pittigher Software Development Environment Department --phone 973-284-2275 --pager 973-880-0224 --email raymond.pittigher@itt.com --wireless email 9738800224@archwireless.net http://acdnjpvcs/tmtrack/tmtrack.dll for all your SDE Support needs I'm sure Vista is wonderful. I'm sure XBox is great, too. A Microsoft person said so. This e-mail and any files transmitted with it may be proprietary and are intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the sender. Please note that any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of ITT Corporation. The recipient should check this e-mail and any attachments for the presence of viruses. ITT accepts no liability for any damage caused by any virus transmitted by this e-mail. ^ permalink raw reply [flat|nested] 5+ messages in thread
* Auditing in old versions of Linux
@ 2010-03-30 15:32 Mario Chancay
2010-03-30 16:07 ` Ray Pittigher
2010-03-30 17:20 ` Steve Grubb
0 siblings, 2 replies; 5+ messages in thread
From: Mario Chancay @ 2010-03-30 15:32 UTC (permalink / raw)
To: linux-audit
[-- Attachment #1.1: Type: text/plain, Size: 460 bytes --]
Due to technical and budget constrains, we are not yet able to migrate some old linux boxes to the latest versions but need to configure auditing under the following platforms :
- Red Hat Linux Enterprise AS 3.4, 3.5, 3.6
- Red Hat Linux 4.x
Need advice to confirm if auditing is possible under this versions and also the recommended procedure to install/setup as I understand that the auditd package depends on the kernel version.
Regards
Mario
[-- Attachment #1.2: Type: text/html, Size: 679 bytes --]
[-- Attachment #2: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: Auditing in old versions of Linux 2010-03-30 15:32 Mario Chancay @ 2010-03-30 16:07 ` Ray Pittigher 2010-03-30 17:20 ` Steve Grubb 1 sibling, 0 replies; 5+ messages in thread From: Ray Pittigher @ 2010-03-30 16:07 UTC (permalink / raw) To: Mario Chancay; +Cc: linux-audit@redhat.com You can use SNARE. On 03/30/2010 11:32 AM, Mario Chancay wrote: > Due to technical and budget constrains, we are not yet able to migrate > some old linux boxes to the latest versions but need to configure > auditing under the following platforms : > > - Red Hat Linux Enterprise AS 3.4, 3.5, 3.6 > - Red Hat Linux 4.x > > Need advice to confirm if auditing is possible under this versions and > also the recommended procedure to install/setup as I understand that the > auditd package depends on the kernel version. > > Regards > > Mario > This e-mail and any files transmitted with it may be proprietary and are intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the sender. Please note that any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of ITT Corporation. The recipient should check this e-mail and any attachments for the presence of viruses. ITT accepts no liability for any damage caused by any virus transmitted by this e-mail. ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Auditing in old versions of Linux 2010-03-30 15:32 Mario Chancay 2010-03-30 16:07 ` Ray Pittigher @ 2010-03-30 17:20 ` Steve Grubb 1 sibling, 0 replies; 5+ messages in thread From: Steve Grubb @ 2010-03-30 17:20 UTC (permalink / raw) To: linux-audit On Tuesday 30 March 2010 11:32:35 am Mario Chancay wrote: > Due to technical and budget constrains, we are not yet able to migrate some > old linux boxes to the latest versions but need to configure auditing > under the following platforms : > > - Red Hat Linux Enterprise AS 3.4, 3.5, 3.6 > - Red Hat Linux 4.x Yes it is possible, but the auditing mechanisms are different. Both are common criteria certified. One of the requirements for common criteria is auditing. > Need advice to confirm if auditing is possible under this versions and also > the recommended procedure to install/setup as I understand that the auditd > package depends on the kernel version. That is a longer topic. There are documents available in the cert rpm that may be able to help answer how you should set it up. ftp://ftp.redhat.com/pub/redhat/linux/eal/ -Steve ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2010-03-30 17:20 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <mailman.41.1269964815.15431.linux-audit@redhat.com>
2010-03-30 16:58 ` Auditing in old versions of Linux Woodie, Paul E, CIV, DSS
2010-03-30 17:03 ` Ray Pittigher
2010-03-30 15:32 Mario Chancay
2010-03-30 16:07 ` Ray Pittigher
2010-03-30 17:20 ` Steve Grubb
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.