Monitor Changers in system files in AIX5 2

[adamsd]

Hi,

Is there any monitoring tool to check for any system files modifications or changes for AIX5.1. If anyone knows of anything it will be of great help.

Many thanks
Dexter

 

[AIXSPadmin]

use tcb

 

[adamsd]

Hi,

Is tcb part of AIX5.1 or do I have to download this from somewhere.

Thanks for that.
Dexter

 

[AIXSPadmin]

TCB is the Trusted Computing Base, it is part of the OS but has to be set when the OS is installed, there is no setting it after installation.

 

[cspilman]

Again... The Trusted Computing Base CAN be set after installation "WITHOUT" having to re-install the OS. The bos.rte.security fileset will need to be installed but you can change the setting for enabling/disabling the TCB on the fly with the following one line command:

odmget -q attribute=TCB_STATE PdAt | sed 's/tcb_enabled/tcb_disabled/' | odmchange -o PdAt -q attribute=TCB_STATE

This has been tried and tested. Regards,
Chuck

 

[AIXSPadmin]

Read the documentation from IBM and it states that the Trusted Computing Base has to be set at installation time, which makes since given the concept of TCB.

Given that, what you are proposing is a hack job! Without the benefits of what it is intended for.

This is supposed to be professional advice for peoples questions, not giving someone a band-aid fix who obviously isn't experienced or they would not be asking these questions; and answers like yours can do more harm than good to novice individuals.

 

[aixnusr]

Use the 'audit' feature in AIX for ur purpose.

command is audit start

but u ve to configure it for the files u want by editing /etc/security/audit/config

by default it will not be enabled

 

[adamsd]

thanks guys..
Dexter