NetNews Usenet Archive 1992 #19/NN_1992_19.iso/spool/comp/os/vms/14591

Internet Message Format | 1992-09-03 | 15.8 KB

Path: sparky!uunet!spool.mu.edu!uwm.edu!linac!att!ucbvax!TOTO.LAAFB.AF.MIL!SHUTTERS_WC
From: [e-mail]
Newsgroups: comp.os.vms
Subject: Answers about image accounting
Message-ID: <[e-mail]>
Date: 3 Sep 92 16:47:00 GMT
Sender: [e-mail]
Distribution: world
Organization: The Internet
Lines: 342

I wish to express my heartfelt thanks to all the following people who responded
to my question concerning image accounting on our VAXen.

Carl J Lydick
Stephen Tihor
Bob Marshall
Arne Vajhxj
Isaac Traxler
Jerry Leichter
Dan Neff

After reading and considering all the responses, I think we will turn image
accounting off.

A compilation of all received responses is below.

--------------------------------------------------------------------------------
From: Carl J Lydick <[e-mail]>

In article <[e-mail]>, you write:
>A question for all you INFO-VAXers.
>
>Since time immemorial, the VAXen here at our site have been performing image
>accounting.  Recently we have come into a bit if a disk space crunch; it was
>suggested that we could save a lot of disk space if we turned off image
>accounting.  I am evaluating that suggestion, primarily from a security
>standpoint.
>
>Basic facts concerning our system:
>
>- It services military personnel, so security is important.
>- We do not "charge" organizations for computer time or images activated.
>- We do perform fairly comprehensive security auditing.
>
>My questions:
>
>1.  How useful would image accounting records be in the case of a breach in
>system security?  I have noted that even the ACCOUNTING/FULL report does not
>show a whole lot of useful information about what was actually being done by
>the activated image.

Image accounting records don't tell you a whole lot about security breaches.
There are only a few situations in which they might be useful:
    1)  Someone uses one of the standard DEC utilities (e.g., SDA,
        AUTHORIZE, etc.) when they shouldn't.  Accounting records can't
        tell whether they actually DID anything with these utilities, just
        that they used them.
    2)  You've found a suspect image on your system (e.g., somebody's
        patched a privileged image so as to subvert it) and you want to
        know what account[s] actually try to use the subverted image.

>2.  Is there any way to get further information about a specific image
>activation that was recorded by image accounting?  If more specific information
>cannot be obtained about the various accounting entries, I can't see the point
>in creating them.

The point in creating image accounting records usually isn't security, it's
system tuning.  You can enable image accounting for a short period of time,
then look at the accounting records and find out what images are heavily used
and therefore should be put in a special place on a disk and/or INSTALLed.
--------------------------------------------------------------------------------

From: [e-mail] (Stephen Tihor)

For security purposes image accounting can be replaced by paranoid mode auditing
but that is even a larger use of space.   What you get from iamge account is
(assuming the accounting file was not tampered with):

hacked into account XXX
XXX ran LOGINOUT
XXX ran DIRECTORY
XXX ran DELETE
--------------------------------------------------------------------------------

From: Bob Marshall O/67-92 B/561 x65737
      <[e-mail]>

In article <[e-mail]>, you write:
>Since time immemorial, the VAXen here at our site have been performing image
>accounting.  Recently we have come into a bit if a disk space crunch

Gee, what a surprise when you have image accounting enabled!

; it was
>suggested that we could save a lot of disk space if we turned off image
>accounting.

Definitely. I've never heard of anyone turning on image accounting
permanently.

>I am evaluating that suggestion, primarily from a security standpoint.

You'd be better off using the VMS audit analysis tools to do this. I won't
go into all the details here since they are in the security manual.
Briefly, though, what you will have to do is identify the particular
images in which you interested in securing; the manuals can help you
with this.

If you are interested in gathering pure accounting data for the usage of
certain software products, you should identify the particular images
of interest and INSTALL them with the /ACCOUNTING switch. E.g.,

$ INSTALL
INSTALL> ADD FORTRAN.EXE/ACCOUNTING

Then you can use the ACCOUNTING/TYPE=IMAGE command to get image utilization
information for the selected images. In fact, you could maybe even use this
technique to satisfy your security requirements. But the audit analysis
tools are better, since they will also record *FAILED* attempts to access
a specified image (e.g., AUTHORIZE).
--------------------------------------------------------------------------------

From: Arne Vajhxj <[e-mail]>

> Since time immemorial, the VAXen here at our site have been performing image
> accounting.  Recently we have come into a bit if a disk space crunch; it was
> suggested that we could save a lot of disk space if we turned off image
> accounting.

The accounting files are growing more than without image accounting.
The relative overhead depends on the ration between image-activations
and process-creations.

But please note, that image accounting also takes performance. It is often
recommended only to put image accouting on specific images (via INSTALL) instead
of a general approach.

>             I am evaluating that suggestion, primarily from a security
> standpoint.
>
> Basic facts concerning our system:
>
> - It services military personnel, so security is important.
> - We do not "charge" organizations for computer time or images activated.
> - We do perform fairly comprehensive security auditing.
>
> My questions:
>
> 1.  How useful would image accounting records be in the case of a breach in
> system security?  I have noted that even the ACCOUNTING/FULL report does not
> show a whole lot of useful information about what was actually being done by
> the activated image.

Well - you can what images they have been using !  Usefull ?  Depends !

Consider a breakin using:

DIRECTORY.EXE
SHOW.EXE

and a breakin using:

FORTRAN.EXE
LINK.EXE
whatsoever.EXE

and a breakin using:

AUTHORIZE.EXE
INSTALL.EXE

which one will make you most worried ?

> 2.  Is there any way to get further information about a specific image
> activation that was recorded by image accounting?  If more specific information
> cannot be obtained about the various accounting entries, I can't see the point
> in creating them.

Probably not. VMS is a rather secure OS and designed for not allowing anyone
to get so far, that this breakin-intrusion is relevant.

A few ideas:
  - You can put security alarms on special sensitive data-file, so you can
    log all accesses to them (both failure and success).
  - You can monitor the output to terminal with a WATCH utility, if you
    have a suspect (I do not think it would be effeicient to implement a
    automatic logging of all interactive sessions).
--------------------------------------------------------------------------------

From: Isaac Traxler -- LSU VAX Systems Programmer <[e-mail]>

    Image accounting can at least tell you whaty they have run.

    But seriously, I have the same problem on a different scale.  I run an
8800 & 30+ workstations in a student environment and have always had a disk
space problem.  Believe me, security on a student accessed machine is a big
problem.  Recently some of the students started trying to breakin to other
peoples systems.  The only way I could track this was to turn outgoping TELNET
logging on.  This created a new disk space hog.  Since breakin complaints from
other system managers sometimes take a week or so to get here, I was facing yet
another disk space consumer and nowhere to put it.  My solution was to analyze
the output file and condense the messages.  This reduced the output size by
two-thids.  I now keep 1 week of raw messages and 3 weeks of condensed messages.
    I am in the process of doing the same thing for the Operator.log.  Since
I have a number of audits enabled, my Operator.Log gets rather large and
perusing it on a daily basis to make sure nothing really bad is going on takes a
good bit of time.  My first cut at dividing up the Operator.log and condensing
it reduced my perusal time by over 50% without any loss of useful information.
In other words, there are lots of things in log files that are not needed and
they can be squeezed out.
    Now for your immediate problem.  The following suggestions come to mind:
1) Staart new accounting files more oftem (maybe daily) and back off the older
ones to tapekeeping maybe a weeks worth of accounting online.  This is a real
operational pain and may not be what you want.
2) Write code to process accounting records, extract what you want and then blow
away the original accounting files.  Sounds ugly buit can be done.  One of my
other part-time projects is to process our accounting records and to send
reformatted accounting system to the IBM so they can charge users.  I have been
using Fortran and its not to bad, once you figure the record structure out.  The
back of the accounting manual is right but sure could use a little more text
explaining stuff.
3) Use the accounting utility to translate the raw records into formatted text
stored in a file and then write code to process the formatted output.  A pain,
but many people currently do this for Authorize and Disk Quota output (including
me).
4) Disable image accounting and just not know certain facts (the mode I am
forced into).  You can use the audit functions to log a lot of nifty information
(Of course that info uses disk space also).

    If I can be of any help, please let me know.  I realize all of the
answers that don't lose information require programming which brings maintenance
along with it.  As with all things, problems can be solved with hardware,
software or some combination of both (but you always have to have more of
something).  The good news is that DEC knows that people process the output of
their programs (Authorize, Disk Quota, Operator.Log, Accounting, etc.) and they
try to hold changes to a minimum.
--------------------------------------------------------------------------------

From: Jerry Leichter <[e-mail]>

    Since time immemorial, the VAXen here at our site have been performing
    image accounting.  Recently we have come into a bit if a disk space
    crunch; it was suggested that we could save a lot of disk space if we
    turned off image accounting.  I am evaluating that suggestion,
    primarily from a security standpoint.

    Basic facts concerning our system:

    - It services military personnel, so security is important.
    - We do not "charge" organizations for computer time or images
        activated.
    - We do perform fairly comprehensive security auditing.

    My questions:

    1.  How useful would image accounting records be in the case of a
    breach in system security?  I have noted that even the ACCOUNTING/FULL
    report does not show a whole lot of useful information about what was
    actually being done by the activated image.

    2.  Is there any way to get further information about a specific image
    activation that was recorded by image accounting?  If more specific
    information cannot be obtained about the various accounting entries, I
    can't see the point in creating them.

While I could imagine some rare circumstances in which it might be useful (if
you knew, after the fact, that some process had been run by an intruder, you
can at least check what images it had run), in general image accounting is
there for purposes like charging and statistics gathering, not security.
The actual accounting packet for an image accounting entry is documented in
the Accounting Utility manual.  What's in there is a full identification of
the process (including "privileges held by the process", but it isn't clear
whether this is the authorized, enabled, or current privilege mask); a snap-
shot of resources used so far by the process; and the full file spec of the
image file.  As far as I can tell, all the information available will be
displayed by a /FULL display of the record.

While you can tell, but examining successive records for a given process, how
much CPU time, how many disk I/O's, and so on the image used, at least
approximately, there's no information to be had about WHAT it did with those
resources.  (BTW, I say "approximately" because the record is written at image
rundown, and simply summarizes total process resource usage, not incremental
usage.  If a process ran image A, then played around in DCL for a while, then
ran image B, you'd be able to determine resource usage after A and after B,
hence total usage between the time A completed and the time B completed; but
you would have not way to determine how much of the usage occured while B was
active, and how much was due to mucking around in DCL.  Since it's quite
possible to do things like examine and update SYSUAF.DAT from DCL (if you have
the appropriate access to the file, of course), image accounting is inherently
unable to give you any real picture of what is going on within a phase of the
process's life that is as critical to security as any other.

You can get much more useful information by setting alarm ACL's on sensitive
files.

I suppose the real bottom line is:  If you have a security problem, every
bit of information is potentially useful.  The question is, how much are you
willing to pay for this information, knowing that it is likely to have rather
limited usefulness?  The tradeoff is inherently very site dependent.

(I know of one site that insists on full image accounting so that reports on
image usage statistics can be sent to upper-level managers who have been
receiving analogous reports from their IBM mainframes since time immemorial.
As far as anyone can tell, no one ever looks at these reports.)
--------------------------------------------------------------------------------

From: raxco!dan.dnet![e-mail] (Dan Neff)

RE: Questions about VMS image accounting

> .
> .
> .
>
> My questions:
>
> 1.  How useful would image accounting records be in the case of a breach in
> system security?  I have noted that even the ACCOUNTING/FULL report does not
> show a whole lot of useful information about what was actually being done by
> the activated image.

  It could be helpful in determining the extent and perhaps the location of any
damage/compromise that occurred. Ie: if AUTHORIZE was run, then you might want
to restore an older version of sysuaf.dat. Or an application program, where you
know (or can find) the target files.

>
>
> 2.  Is there any way to get further information about a specific image
> activation that was recorded by image accounting?  If more specific information
> cannot be obtained about the various accounting entries, I can't see the point
> in creating them.
>
  Not really. I agree. I recommend replacing IMAGE accounting with security
alarms - refer to the "Guide to VMS System Security" to implement ACE's and the
Audit Server. You will need to define an ACE for each image that a user can run-
but in a secure environment, you want to keep a rein on what users can access
anyway. This results in a binary trail on the audit file that occupies less
disk space than ACCOUNTNG.dat and you can also have it generate an Operator
message which gives you a better chance of doing something while they are logged
in, rather than the next day. You'll still need to manage your disk consumption,
however.
--------------------------------------------------------------------------------



Capt Chris Shutters, Air Force Space    | [e-mail]
Command, Falcon AFB, CO (719)-550-2618  | [e-mail]
All opinions are my own - nobody else likes them!
Two bits, four bits, six bits, a buck; come on cheerleaders, give us a cheer!