Auditing in old versions of Linux

Auditing in old versions of Linux

[Mario Chancay]

[-- Attachment #1.1: Type: text/plain, Size: 460 bytes --]

Due to technical and budget constrains, we are not yet able to migrate some old linux boxes to the latest versions but need to configure auditing under the following platforms :

- Red Hat Linux Enterprise AS 3.4, 3.5, 3.6
- Red Hat Linux 4.x

Need advice to confirm if auditing is possible under this versions and also the recommended procedure to install/setup as I understand that the auditd package depends on the kernel version. 

Regards

Mario 


      

[-- Attachment #1.2: Type: text/html, Size: 679 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Auditing in old versions of Linux

[Ray Pittigher]

You can use SNARE.

On 03/30/2010 11:32 AM, Mario Chancay wrote:
> Due to technical and budget constrains, we are not yet able to migrate
> some old linux boxes to the latest versions but need to configure
> auditing under the following platforms :
>
> - Red Hat Linux Enterprise AS 3.4, 3.5, 3.6
> - Red Hat Linux 4.x
>
> Need advice to confirm if auditing is possible under this versions and
> also the recommended procedure to install/setup as I understand that the
> auditd package depends on the kernel version.
>
> Regards
>
> Mario
>

This e-mail and any files transmitted with it may be proprietary and are intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the sender.
Please note that any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of ITT Corporation. The recipient should check this e-mail and any attachments for the presence of viruses. ITT accepts no liability for any damage caused by any virus transmitted by this e-mail.

RE: Auditing in old versions of Linux

[Woodie, Paul E, CIV, DSS]

There is an audit package called Snare, which would make possible
auditing on previous versions of linux.  It worked well.  Unfortunately,
that also required (usually) modified versions of the kernel.  Perhaps
you can find some of those components.  I have not used Snare in quite a
while. 


Paul Woodie, CISSP, IAM

-----Original Message-----
From: linux-audit-bounces@redhat.com
[mailto:linux-audit-bounces@redhat.com] On Behalf Of
linux-audit-request@redhat.com
Sent: Tuesday, March 30, 2010 12:00 PM
To: linux-audit@redhat.com
Subject: Linux-audit Digest, Vol 66, Issue 12
Importance: Low

Send Linux-audit mailing list submissions to
	linux-audit@redhat.com

To subscribe or unsubscribe via the World Wide Web, visit
	https://www.redhat.com/mailman/listinfo/linux-audit
or, via email, send a message with subject or body 'help' to
	linux-audit-request@redhat.com

You can reach the person managing the list at
	linux-audit-owner@redhat.com

When replying, please edit your Subject line so it is more specific than
"Re: Contents of Linux-audit digest..."


Today's Topics:

   1. Auditing in old versions of Linux (Mario Chancay)


----------------------------------------------------------------------

Message: 1
Date: Tue, 30 Mar 2010 08:32:35 -0700 (PDT)
From: Mario Chancay <mario.chancay@yahoo.com>
To: linux-audit@redhat.com
Subject: Auditing in old versions of Linux
Message-ID: <27921.42909.qm@web45214.mail.sp1.yahoo.com>
Content-Type: text/plain; charset="us-ascii"

Due to technical and budget constrains, we are not yet able to migrate
some old linux boxes to the latest versions but need to configure
auditing under the following platforms :

- Red Hat Linux Enterprise AS 3.4, 3.5, 3.6
- Red Hat Linux 4.x

Need advice to confirm if auditing is possible under this versions and
also the recommended procedure to install/setup as I understand that the
auditd package depends on the kernel version. 

Regards

Mario 


      
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://www.redhat.com/archives/linux-audit/attachments/20100330/875002
02/attachment.html>

------------------------------

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit

End of Linux-audit Digest, Vol 66, Issue 12
*******************************************

Re: Auditing in old versions of Linux

[Ray Pittigher]

What kind of auditing and/or lock downs do you use at DSS?

On 03/30/2010 12:58 PM, Woodie, Paul E, CIV, DSS wrote:
> There is an audit package called Snare, which would make possible
> auditing on previous versions of linux.  It worked well.  Unfortunately,
> that also required (usually) modified versions of the kernel.  Perhaps
> you can find some of those components.  I have not used Snare in quite a
> while.
>
>
> Paul Woodie, CISSP, IAM
>
> -----Original Message-----
> From: linux-audit-bounces@redhat.com
> [mailto:linux-audit-bounces@redhat.com] On Behalf Of
> linux-audit-request@redhat.com
> Sent: Tuesday, March 30, 2010 12:00 PM
> To: linux-audit@redhat.com
> Subject: Linux-audit Digest, Vol 66, Issue 12
> Importance: Low
>
> Send Linux-audit mailing list submissions to
>       linux-audit@redhat.com
>
> To subscribe or unsubscribe via the World Wide Web, visit
>       https://www.redhat.com/mailman/listinfo/linux-audit
> or, via email, send a message with subject or body 'help' to
>       linux-audit-request@redhat.com
>
> You can reach the person managing the list at
>       linux-audit-owner@redhat.com
>
> When replying, please edit your Subject line so it is more specific than
> "Re: Contents of Linux-audit digest..."
>
>
> Today's Topics:
>
>     1. Auditing in old versions of Linux (Mario Chancay)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Tue, 30 Mar 2010 08:32:35 -0700 (PDT)
> From: Mario Chancay<mario.chancay@yahoo.com>
> To: linux-audit@redhat.com
> Subject: Auditing in old versions of Linux
> Message-ID:<27921.42909.qm@web45214.mail.sp1.yahoo.com>
> Content-Type: text/plain; charset="us-ascii"
>
> Due to technical and budget constrains, we are not yet able to migrate
> some old linux boxes to the latest versions but need to configure
> auditing under the following platforms :
>
> - Red Hat Linux Enterprise AS 3.4, 3.5, 3.6
> - Red Hat Linux 4.x
>
> Need advice to confirm if auditing is possible under this versions and
> also the recommended procedure to install/setup as I understand that the
> auditd package depends on the kernel version.
>
> Regards
>
> Mario
>
>
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL:
> <https://www.redhat.com/archives/linux-audit/attachments/20100330/875002
> 02/attachment.html>
>
> ------------------------------
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
>
> End of Linux-audit Digest, Vol 66, Issue 12
> *******************************************
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

--
Ray Pittigher
Software Development Environment Department
--phone 973-284-2275
--pager 973-880-0224
--email raymond.pittigher@itt.com
--wireless email 9738800224@archwireless.net

http://acdnjpvcs/tmtrack/tmtrack.dll for all your SDE Support needs

I'm sure Vista is wonderful. I'm sure XBox is great, too.
A Microsoft person said so.


This e-mail and any files transmitted with it may be proprietary and are intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the sender.
Please note that any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of ITT Corporation. The recipient should check this e-mail and any attachments for the presence of viruses. ITT accepts no liability for any damage caused by any virus transmitted by this e-mail.

Re: Auditing in old versions of Linux

[Steve Grubb]

On Tuesday 30 March 2010 11:32:35 am Mario Chancay wrote:
> Due to technical and budget constrains, we are not yet able to migrate some
> old linux boxes to the latest versions but need to configure auditing
> under the following platforms :
> 
> - Red Hat Linux Enterprise AS 3.4, 3.5, 3.6
> - Red Hat Linux 4.x

Yes it is possible, but the auditing mechanisms are different. Both are common 
criteria certified. One of the requirements for common criteria is auditing.
 
> Need advice to confirm if auditing is possible under this versions and also
> the recommended procedure to install/setup as I understand that the auditd
> package depends on the kernel version. 

That is a longer topic. There are documents available in the cert rpm that may 
be able to help answer how you should set it up.

ftp://ftp.redhat.com/pub/redhat/linux/eal/

-Steve