From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Kirkwood, David A." Subject: RHELU4 versus RHELU5 Date: Thu, 8 Feb 2007 11:34:51 -0500 Message-ID: <954E3479CC27224785179CA04904214D04E4765A@0668-its-exmp01.us.saic.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============2080381296==" Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l18GZYEb027251 for ; Thu, 8 Feb 2007 11:35:34 -0500 Received: from mclmx.mail.saic.com (mclmx.mail.saic.com [149.8.64.10]) by mx1.redhat.com (8.13.1/8.13.1) with ESMTP id l18GZWvk010874 for ; Thu, 8 Feb 2007 11:35:32 -0500 Received: from 0015-its-ieg01.mail.saic.com ([149.8.64.21] [149.8.64.21]) by mclmx.mail.saic.com for linux-audit@redhat.com; Thu, 8 Feb 2007 11:34:53 -0500 Received: from 0015-its-exbh02.us.saic.com ([10.43.229.22]) by 0015-its-ieg01.mail.saic.com (SMSSMTP 4.0.5.66) with SMTP id M2007020811345205541 for ; Thu, 08 Feb 2007 11:34:52 -0500 Content-class: urn:content-classes:message List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com This is a multi-part message in MIME format. --===============2080381296== Content-class: urn:content-classes:message Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C74B9F.0F1D4088" This is a multi-part message in MIME format. ------_=_NextPart_001_01C74B9F.0F1D4088 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I have not looked at the audit capability on RHELU5, but from the mail on this list I get a sense that it is, from the configuration and review tools significantly different that used in the previous release. First, Is this a correct assumption? I need to get approval to use systems and verify audit capabilities for those systems, but I don't want to have to go through the whole thing all over again. =20 Thanks, David A. Kirkwood SAIC david.a.kirkwood@saic.com kirkwoodd@saic.com Phone: (727) 502-8310 Fax: (727) 822-7776=20 =20 ------_=_NextPart_001_01C74B9F.0F1D4088 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

I have not looked at the audit capability on RHELU5, = but from the mail on this list I get a sense that it is, from the = configuration and review tools significantly different that used in the previous release. = First, Is this a correct assumption? I need to get approval to use systems and = verify audit capabilities for those systems, but I don’t want to have to = go through the whole thing all over again.

 

Thanks,

David A. Kirkwood
SAIC

david.a.kirkwood@saic.com
kirkwoodd@saic.com

Phone: (727) 502-8310
Fax:   (727) 822-7776

 

------_=_NextPart_001_01C74B9F.0F1D4088-- --===============2080381296== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============2080381296==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stephen Smalley Subject: Re: RHELU4 versus RHELU5 Date: Thu, 08 Feb 2007 11:38:41 -0500 Message-ID: <1170952721.11912.292.camel@moss-spartans.epoch.ncsc.mil> References: <954E3479CC27224785179CA04904214D04E4765A@0668-its-exmp01.us.saic.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from mx2.redhat.com (mx2.redhat.com [10.255.15.25]) by int-mx2.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l18Ggvsl016511 for ; Thu, 8 Feb 2007 11:42:57 -0500 Received: from jazzdrum.ncsc.mil (zombie.ncsc.mil [144.51.88.131]) by mx2.redhat.com (8.13.1/8.13.1) with ESMTP id l18GgtRQ021129 for ; Thu, 8 Feb 2007 11:42:56 -0500 In-Reply-To: <954E3479CC27224785179CA04904214D04E4765A@0668-its-exmp01.us.saic.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "Kirkwood, David A." Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Thu, 2007-02-08 at 11:34 -0500, Kirkwood, David A. wrote: > I have not looked at the audit capability on RHELU5, but from the mail > on this list I get a sense that it is, from the configuration and > review tools significantly different that used in the previous > release. First, Is this a correct assumption? I need to get approval > to use systems and verify audit capabilities for those systems, but I > don=E2=80=99t want to have to go through the whole thing all over again= . Do you mean RHEL 4 vs. RHEL 5 (i.e. two successive releases of RHEL)? Or RHEL 4 Update 4 vs. RHEL 4 Update 5 (i.e. two successive updates for RHEL 4)? --=20 Stephen Smalley National Security Agency From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Kirkwood, David A." Subject: RE: RHELU4 versus RHELU5 Date: Thu, 8 Feb 2007 12:06:17 -0500 Message-ID: <954E3479CC27224785179CA04904214D04E476BE@0668-its-exmp01.us.saic.com> References: <954E3479CC27224785179CA04904214D04E4765A@0668-its-exmp01.us.saic.com> <1170952721.11912.292.camel@moss-spartans.epoch.ncsc.mil> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l18H6nHG006320 for ; Thu, 8 Feb 2007 12:06:49 -0500 Received: from mclmx.mail.saic.com (mclmx.mail.saic.com [149.8.64.10]) by mx1.redhat.com (8.13.1/8.13.1) with ESMTP id l18H6hJX031815 for ; Thu, 8 Feb 2007 12:06:43 -0500 Content-class: urn:content-classes:message In-Reply-To: <1170952721.11912.292.camel@moss-spartans.epoch.ncsc.mil> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Stephen Smalley Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com I was referring to the differences between RHEL update 4 and RHEL update 5 but the question is probably better posed as: Is the auditing used in RHEL4 update 4 a dead end with respect to either RHEL4 update 5 or RHEL5? The reason for the question is that I need to write some scripts or graphical programs to tie some of the pieces together to construct meaningful auditablity for disjoint items. If I have to do this all over again, are the items going to be the same or completely different or somewhat the same? I can use the system as it is now, but I would have to run many ausearches and / or aureports with different parameters to get the information I want. When I need to look at 10's of systems, it is much easier to consolidate everything into a combined output and view the whole thing. But if the auditing is going to change, I will delay this part and put up with doing the systems individually until things are stable. I'm not being a critic, just trying to allocate my time efficiently. Thanks,=20 David A. Kirkwood -----Original Message----- From: linux-audit-bounces@redhat.com [mailto:linux-audit-bounces@redhat.com] On Behalf Of Stephen Smalley Sent: Thursday, February 08, 2007 11:39 AM To: Kirkwood, David A. Cc: linux-audit@redhat.com Subject: Re: RHELU4 versus RHELU5 On Thu, 2007-02-08 at 11:34 -0500, Kirkwood, David A. wrote: > I have not looked at the audit capability on RHELU5, but from the mail > on this list I get a sense that it is, from the configuration and > review tools significantly different that used in the previous > release. First, Is this a correct assumption? I need to get approval > to use systems and verify audit capabilities for those systems, but I > don't want to have to go through the whole thing all over again. Do you mean RHEL 4 vs. RHEL 5 (i.e. two successive releases of RHEL)? Or RHEL 4 Update 4 vs. RHEL 4 Update 5 (i.e. two successive updates for RHEL 4)? --=20 Stephen Smalley National Security Agency -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: RHELU4 versus RHELU5 Date: Thu, 8 Feb 2007 12:23:35 -0500 Message-ID: <200702081223.36051.sgrubb@redhat.com> References: <954E3479CC27224785179CA04904214D04E4765A@0668-its-exmp01.us.saic.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <954E3479CC27224785179CA04904214D04E4765A@0668-its-exmp01.us.saic.com> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: "Kirkwood, David A." List-Id: linux-audit@redhat.com On Thursday 08 February 2007 11:34, Kirkwood, David A. wrote: > I have not looked at the audit capability on RHELU5, but from the mail > on this list I get a sense that it is, from the configuration and review > tools significantly different that used in the previous release. There are a lot of updates. RHEL4U5 will be using the 1.0.15 release. This was announced: https://www.redhat.com/archives/linux-audit/2006-November/msg00033.html > First, Is this a correct assumption? U4 was 1.0.14, U5 will be 1.0.15. There's not a huge difference between them, look at the changelog/announcement. But there are improvements and some new capabilities. -Steve From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: RHELU4 versus RHELU5 Date: Thu, 8 Feb 2007 12:33:09 -0500 Message-ID: <200702081233.09973.sgrubb@redhat.com> References: <954E3479CC27224785179CA04904214D04E4765A@0668-its-exmp01.us.saic.com> <1170952721.11912.292.camel@moss-spartans.epoch.ncsc.mil> <954E3479CC27224785179CA04904214D04E476BE@0668-its-exmp01.us.saic.com> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <954E3479CC27224785179CA04904214D04E476BE@0668-its-exmp01.us.saic.com> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: "Kirkwood, David A." List-Id: linux-audit@redhat.com On Thursday 08 February 2007 12:06, Kirkwood, David A. wrote: > Is the auditing used in RHEL4 update 4 a dead end with respect to either > RHEL4 update 5 or RHEL5? Within RHEL4, they are very much the same. But some improvements with each release. Between RHEL4 & 5, the user interfaces at the program level are the same. The audit utilities understand the same parameters, audit.rules has the same syntax, etc. The API at the library level has changed somewhat due to new capabilities in RHEL5 and the kernel. > The reason for the question is that I need to write some scripts or > graphical programs to tie some of the pieces together to construct > meaningful auditablity for disjoint items. If I have to do this all over > again, are the items going to be the same or completely different or > somewhat the same? Between RHEL4 & 5 they are mostly the same. I'd have to know exactly what you are trying to do to answer it, but we've worked hard to preserve the same command set. IOW, "audit -w /etc/shadow -p wa" runs on each platform. The audit records are slightly different format, but contain nearly the same information. > I can use the system as it is now, but I would have to run many ausearches > and / or aureports with different parameters to get the information I want. > When I need to look at 10's of systems, it is much easier to consolidate > everything into a combined output and view the whole thing. This is the area that we are working in right now. RHEL4U5 has a realtime interface which can be used for log aggregation. We are starting to turn attention to that and should start fleshing something out in the coming weeks. -Steve