Solaris Security Guide

This document provides a list of configuration changes which enhance the security of a Sun SolarisTM (SunOS 5.X) system.

Source : http://www.sabernet.net/papers/Solaris.html

Auditing

1. Enable the Basic Security Module (BSM): 
   /etc/security/bsmconv
2. Configure the classes of events to log in /etc/security/audit_control: 
   dir:/var/audit
   flags:lo,ad,pc,fc,fd,fm
   naflags:lo,ad
   #
   #   lo - login/logout events
   #   ad - administrative actions: mount, exportfs, etc.
   #   pc - process operations: fork, exec, exit, etc.
   #   fc - file creation
   #   fd - file deletion
   #   fm - change of object attributes: chown, flock, etc.
   #
3. Create /etc/security/newauditlog.sh: 
   #!/sbin/sh
   #
   # newauditlog.sh - Start a new audit file and expire the old logs
   #
   AUDIT_EXPIRE=30
   AUDIT_DIR="/var/audit"
   
   
   /usr/sbin/audit -n
   
   
   cd $AUDIT_DIR # in case it is a link
   /usr/bin/find . $AUDIT_DIR -type f -mtime +$AUDIT_EXPIRE \
       -exec rm {} > /dev/null 2>&1 \;
4. Run the script nightly from cron: 
   chmod 500 /etc/security/newauditlog.sh
   /usr/bin/crontab -e root
   0 0 * * * /etc/security/newauditlog.sh
5. The audit files generated are not human readable. The praudit(1M) command can be used to convert audit data into several ASCII formats.