Red Hat Open Sourced Identity, Policy, Auditing Management Security Framework Tool

Posted on in Categories Linux, RedHat/Fedora Linux, Security last updated March 20, 2008

Red Hat has open-sourced its identity-management and security system to promote its assertion that open-source software provides the most secure infrastructure. From the press release:

Red Hat Certificate System was acquired from AOL three years ago as part of the Netscape technology acquisition. In keeping with our commitment to open source software, today Red Hat has released all of the source code to Red Hat Certificate System. Much of the technology in Red Hat Certificate System was already open source, including the Apache web server, Red Hat Directory Server and the FIPS140-2 level 2 validated NSS cryptographic libraries, but today’s move further demonstrates Red Hat’s belief that the open source development model creates more secure software.

I think the freeIPA project is really good addition. It provides central management of identity, policy, and auditing for Unix and Linux using open-source and open-standards technologies.

freeIPA under Fedora Linux
(Fig. 01: freeIPA running under Fedora Linux [Image Credit freeIPA project])

AIX UNIX: File auditing to track reads and writes changes

Posted on in Categories Monitoring, Security, Sys admin, Troubleshooting, Tuning, UNIX last updated August 12, 2007

I’ve already writing about Linux file auditing to track who made changes to a file. In this article, you will learn how to track several events on AIX with auditing, a major feature of AIX security, and learn how to use auditing to keep track of the read and write operations on a file. Also examine commands, such as ls or istat, to check a file’s time stamp:

AIX UNIX provides easy ways to track the last time a file was accessed. The ls command is one example. But sometimes you want to know who, or which process, accessed the file. You might need such information for debugging or keeping track of important files. You can track information related to read and write operations on a file with the help of auditing.

In AIX, auditing systems are intended to record security-related information and to alert administrators about security breaches. You can customize the configuration and objects files, which are used by the auditing subsystem to keep track of any file you want. You can also use the real-time monitoring feature of auditing to keep track of some processes and files that are being modified randomly by unidentified processes.

AIX File Auditing Howto

FreeBSD Enable Security Port Auditing to Avoid Vulnerabilities With portaudit

Posted on in Categories FreeBSD, Howto, Security, Sys admin, Tip of the day, Tips last updated February 27, 2008

This is new nifty and long term demanded feature in FreeBSD. A port called portaudit provides a system to check if installed ports are listed in a database of published security vulnerabilities. After installation it will update this security database automatically and include its reports in the output of the daily security run. If you get message like as follows

Vulnerability check disabled, database not found

You need install small port called portaudit. From the man page:

portaudit checks installed packages for known vulnerabilities and generates reports including references to security advisories. Its intended audience is system administrators and individual users. portaudit checks installed packages for known vulnerabilities and generates reports including references to security advisories. Its intended audience is system administrators and individual users.

Install portaudit

1) Install port auditing (login as root)
# cd /usr/ports/ports-mgmt/portaudit
Please note that old portaudit port was located at /usr/ports/security/portaudit/.
2) Install portaudit:
# make install clean

===>  WARNING: Vulnerability database out of date, checking anyway
===>  Extracting for portaudit-0.5.12
===>  Patching for portaudit-0.5.12
===>  Configuring for portaudit-0.5.12
===>  Building for portaudit-0.5.12
===>  Installing for portaudit-0.5.12
===>   Generating temporary packing list
===>  Checking if ports-mgmt/portaudit already installed
===>   Compressing manual pages for portaudit-0.5.12
===>   Registering installation for portaudit-0.5.12
===>  Cleaning for portaudit-0.5.12

3) Fetch the database so that port auditing get activated immediately. By default it install a shell script ‘portaudit’ in /usr/local/etc/periodic/security/:
# /usr/local/sbin/portaudit -Fda

auditfile.tbz                                 100% of   47 kB  405 kBps
New database installed.
Database created: Wed Feb 27 06:10:01 CST 2008
0 problem(s) in your installed packages found.


  • -F: Fetch the current database from the FreeBSD servers.
  • -d: Print the creation date of the database.
  • -a: Print a vulnerability report for all installed packages

4) portaudit script automatically get called via FreeBSD’s periodic (cron job) facility. So your database get updated automatically everyday.

Let us assume you would like to install a port called sudo. If it has known vulnerabilities it will not install sudo:
# cd /usr/ports/security/sudo
# make install clean

===>  sudo- has known vulnerabilities:
=> sudo -- local race condition vulnerability.
   Reference: &tt;
=> Please update your ports tree and try again.
*** Error code 1

Stop in /usr/ports/security/sudo.

For more information refer portaudit man page:
$ man portaudit