The tool of UNIX、Linux command operation audit「WEEDS UNIX-Trace」
「I want to audit operation record of release server.」
「I want to audit that various vender how to operate meaningful release server.」
「I want to prove in charge of systems's innocence.」
「I can't audit even though acquiring operation log by Script-File.」
Customers who manage UNIX、Linux server have a trouble such things.
Even though IT-control of J-sox law、controlling meaningful operation server of company. WEEDS UNIX-Trace solves appropriately such issue.
The issue of audit UNIX、Linux
UNIX、Linux server audit has following issue and not operate easily.
・Even though acquiring log Script-File atttached OS, define another name command by Alias and environment variable
and actual operation is not clear.
・Logs acquired by Script-File is difficult to audit by human eyes.
（Can't even follow command ）
・Can't audit even if acquiring a list of command without throughly trained in UNIX command.
（Can't judge what is ）
・「wtmp」saved OS,「log off day of time is unclear 」、「output command 」
can't endure audit
・OS existing log「history」is「command excecution tiime is unclear」、
「unclear when log-in 」、「To acquire only log-in 」etc、
can't endure audit.
So that, the point is that solving problem above,and it is indispesable for appropriate audit.
What is WEEDS UNIX-Trace
WEEDS UNX-Trace acquire logs of server operation （command,parameter,result of normal outputting）, restore log-repository data base encrypted.
Logs analyzed and processed by WEEDS UNIX-Trace are transformed immediately log-repository server, and loaded log DataBase. Logs are managed by WEEDS Log-Repository Manager on log repository manager and generate audit report and maintenance log (punctual avoiding, backup, restoring)
Log of WEEDS UNIX-Trace outputted by server intended audit. Delete (in case of normally) after execution of analyze and process and not to strain server intended audit
To acquire all command/parameter/the result of excecution
WEEDS UNX-Trace acquire the result of command, parameter,Alias command, environmental variable execution for acquiring logs endured audit.
Can't judge command and parameter actually ooperated until such function are implemented.
Many companies acquire UNIX、Liunx server operation record by Script-File. However, Script-File make us above fellow by human eyes.
Intervention by manpower can't fulfill correspondence of system, it has risk leaked auditing（operational rest).
Comparision Script-File and WEEDS UNIX-Trace
Compare UNIX、Linux OS attached Script-File and WEEDS UNIX-Trace make clear.
「What see」for audit is meaningful
From of the point of view“Divulging information”, to always follow 「what is show」old-logs is meningful.
access from UNIX server to data base, personal information and securecy information easily, it is possible that taking note the view on the screen and throw out them.
WEEDS UNIX-Trace acquire the result command execution, it can audit that operator show what, and see what.
WEEDS UNIX-Trace Guardian option
To guard abusive command and parameter in real time.
WEEDS UNX-Trace has inhibit feature which blocks command as Guardian option.
・To avoid any thing (open, delete, execution) for file specific files.
・There is combination of command and parameter specific user should not use.
・To alert in real time even if using command.
These are possible.
WEEDS UNIX-Trace can judge that log hooked execute because of acquiring commmand and parameter by shell hooked. It is possible to compare audit command previously registered, avoid executing command and alert（to syslog）
To manage easily without creating userID to OS
It seems that there are many companies which have a trouble, because they should create user ID as usage for audit.
・Actually put specific user ID to heavy use
・For audit, increasing user ID make managing ID trobouled.
For such companies, WEEDS UNIX-Trace generate unique user ID and mange differ from OS user ID.
WEEDS UNIX-Trace acquires command and parameter shell hooked, inhibit command execution. It is possible to compare audit command previously registered and parameter, avoid executing command and alert（to syslog）
The point of UNIX server system audit
WEEDS UNIX-Trace acquire all operation record, always confirm operational record trace past, what coping in daily audit.
As following chart, applying operation when server, operate after permitting.
We WEEDS consider that when such operation is assumed, ①～⑤audit should be executed.
①Operation from OS permitted
There are many companies obligate operate named OS in case of operating server.
And, it seems that comapany audit only named OS, audited in rare cases. If grasping OS user ID and password, you can operate other than named OS. （server console etc.）
Incase of operation other than named OS, the situation “left no trace”is caution needed（auditing impossible）
And even if, office-rule limits access to server,in case of the situation network,it is possible of access hacking as much as he likes.
If accessing other than named OS, assuming what can in this situation and avoid them.
not only office rule and access limited,
１．record access which IP
２．this IP is permitted access
audit above is critical.
It seems to check applying operation, however, audit operation named OS.
②log in/ log off management
It is critical to audit when log in and log off server.
To grasp only log-in and can’t acquire log-off in rare case, product
Impossible grasping when operation ended means that left possibility impropriety operation executed and equal not to audit.
Normally, in case of server operation by maintenance etc.「when・who・ from where・ until when・what」written operation offered is necessary.
Should doubt server without applying operation as innatural operation not only as offense. It is critical that management of log-in and log-off which is trace when who access server for auditing operation other than such applying operation.
③Checking operational apply system
Checking automatically these contents and operational log save audit cost and audit automatically. For this reason, not audit leaked and dependence and execute audit that operation spplied is same as command operation.
④Countermeasure information leaked from log
As former clause said, UNIX command has personal information and secret information as a case may be.
For example. if accessing DataBase from UNIX server, and refering information which include personal information, posting personal information as the result of command, and consult information of server password file and all sorts of setted easily
To hold these logs simply cause preposterous results which is “information leaked from logs”. To hold log encrypted is necessary.
So that outputting unconsidered logs is a danger because that log will be security whole.
Countermeasure of this is
１．To prohibit Script
２．To prohibit generating log of terminal simulater.
３．To detect what IP packet is sniffered.
４．To limit operation PC on server.
such things can be considered.
⑤Audit operational time
To operate server innecessary, it cause injustice operation.
Not only copy of data and printing but take note information on screen cause information leaked.
In this case, not lefting trace of leaked information.
It is critical that lead auditing operation appropriate time by auditing not to consult idle information for operation, step out while log-in and promote increase non service hours.
Product specification
| Effect installed | Internal control（IT ）、Control authority corresponded、Law protecting personal information corresponded, Internal control system corresponded,Pmark,ISMS corresponded |
|
| Agent Module | OS corresponded | After AIX4.3.3・After RedHat Linux3・After Sun Solaris 7 HP-UX 11i ・After Miracle Linux・After Cent OS ※Immediate corresponding other UNIX is possible by poting |
| Server loaded | Server loaded is minute amount for monitoring log-in shell outputting. | |
| Log | The item acquiring log | Log-in day of time, log-off day of time,Log-in user ID, command ・Entry P parameter・result outputted（All of Standard I/O）,Alias command, Definitionen viromental variable command, shell executed internal command,FTP connection operation command , Telnet connection operation command |
| Encryption | generate access log with unique encryption | |
| Transformatted | Agent （Normally 1～3 times ／day） | |
| Log quantity | 1kb／Command（Transformatted by operation quantity, normal-outputting quantity. ） | |
| Licence system | server（OS）unit | |
| Price | open（it has volume discounted ） | |
.jpg)
.jpg)