LJK/Security Reference Manual
Previous Contents Index

STOP

Stop the collection of security data from tributary nodes.

Format

$ LJK/SECURITY STOP -

assessment-name


or

LJKS„ STOP -

assessment-name

Command Qualifiers Defaults
None. None.

restrictions

Parameters

assessment-name

Name of the assessment.

Description

Stop the collection of security data from tributary nodes.

This does not affect future scheduled future runs of the specified assessment. That is accomplished with the CANCEL command.

Qualifiers

None.

Example


$ LJK/SECURITY STOP MY_SPECIAL

Stop current collection of assessment MY_SPECIAL from remote nodes.

Tests

For a complete list of automatic tests performed by LJK/Security, read:

Chapter 6
LJK/Security Automatic Tests

This chapter lists each of the tests that can be performed by LJK/Security for the Automatic method.

Specification of tests

Each LJK/Security test is specified by a set of three names: facility, element, and constraint.

  1. Facility
    Section of VMS or layered product being tested. 1
  2. Element
    Particular parameter or security-relevant item being tested.
  3. Constraint
    Exact condition being tested (value too low, value too high, etc.).

Modification mechanism

As explained in Section 1.4.4 and Chapter 7, the two policy items associated with individual tests are limits and exemptions. The exact method for making a modification depends on which interface you are using, as described elsewhere in this manual:

Items which can be modified

Using the appropriate modification technique, the following policy items can be modified for individual tests:

  1. Value
    For a limit, this is a standard against which comparison is made on the tributary node.
    For an exemption, this is a relaxed standard against which suspected violations are compared on the master node. If an aspect of the tributary node violates a limit when compared on the tributary node but then is allowed by an exemption on the master node, no violation is reported. In some cases, evaluation of exemptions may take place on the tributary node to reduce the amount of violation data which must be transferred.
  2. Parameters (only for exemptions)
    For an exemption, these specify under what condition the exemption will apply. The first parameter is always the (possibly wildcarded) node name. The meaning of the second parameter differs according to the facility to which the test belongs:
    1. DEVICE tests
      the device name (possibly wildcarded)
    2. DISK tests
      the volume name or file specification (possibly wildcarded)
      File specifications can also be in the form of:
      • AUDIT_LOG=SECURITY (or any other VMS-supported Audit Log)
        The specified filespec for the named audit log (usually SECURITY)
      • SYSTEM=PARAMETER
        Specifies in an architecture-independent fashion, the architecture-specific VMS system parameter file (VAX=SYS$SYSTEM:VAXVMSSYS.PAR, AXP=SYS$SYSTEM:ALPHAVMSSYS.PAR).
      • FILE=<filespec>
        This is just a more verbose way of specifying a filespec
      • LOGICAL,DEFAULT
        The logical name is used with the default file specification indicated
    3. TERM tests
      the device name (possibly wildcarded)
    4. UAF tests
      the username (possibly wildcarded)
    5. USAGE tests
      absolute or earliest time ("1-Mar-2005:21:35:15.00" or "<=1-Mar-2005:21:35:15.00")
    6. QUEUE tests
      the queue name (possibly wildcarded)
  3. Selector (optional, but only for certain tests)
    For certain tests (listed in the next section), a selector specifies a subdivision of the test on a further basis.

Use of selectors

Certain test values are actually multi-valued based on an additional variable called a selector:

For more information on the effect of a selector, see the description of the individual tests later in this chapter.

Note

1 Names may or may not correspond to VMS facility names.

2 The LICENSE type of operator message is not documented in the VMS documentation as late as V8.3.

6.1 ACC Tests

Tests in the ACC facility deal with use of VMS Accounting features on a machine.

Exemptions are based on node name.

In establishing a policy for the ACC facility, it is important to be aware of the interaction between VMS Accounting controls. Five of the controls select types of processes for which accounting records are to be written:

But those five controls are effective only in combination with one or both of the following controls, specifying the types of accounting records to be written: Independent of the interaction between those seven controls, three other controls act independently to govern the writing of specific types of accounting records: The interaction between the first two groups of controls listed is one which historically has not been understood by many VMS system managers. That lack of understanding has been exploited by successful attackers to hide the fact that they have gained privileged access to a machine.

The node name in an exemption for the ACC facility can include standard VMS wildcard characters (% and *).

BATCH

Determine whether generation of Batch process termination accounting records conforms to policy.

Violation reports

Constraint Nature of the violation
PROHIBITED Batch accounting is enabled in violation of policy
REQUIRED Batch accounting is disabled in violation of policy

Description

Use of the qualifier /ENABLE=BATCH with the SET ACCOUNTING command causes process or image termination records for batch jobs to be written to the VMS accounting file (only if /ENABLE=IMAGE or /ENABLE=PROCESS has also been specified).

Default policy

Enabling of batch accounting is required

Customizing

Set limit REQUIRED to be FALSE to remove the general requirement that batch accounting be enabled

Selector

Limits

Constraint Value Default
PROHIBITED FALSE or TRUE FALSE
REQUIRED FALSE or TRUE TRUE

Exemptions

Constraint Value Parameters
PROHIBITED FALSE or TRUE <node>
REQUIRED FALSE or TRUE <node>

Practical considerations

Accounting records provide more information regarding resource usage that logout security alarms.

DETACHED

Determine whether generation of detached process termination accounting records conforms to policy.

Violation reports

Constraint Nature of the violation
PROHIBITED Detached accounting is enabled in violation of policy
REQUIRED Detached accounting is disabled in violation of policy

Description

Use of the qualifier /ENABLE=DETACHED with the SET ACCOUNTING command causes process or image termination records for detached jobs to be written to the VMS accounting file (only if /ENABLE=IMAGE or /ENABLE=PROCESS has also been specified).

Default policy

Enabling of detached accounting is required

Customizing

Set limit REQUIRED to be FALSE to remove the general requirement that detached accounting be enabled

Selector

Limits

Constraint Value Default
PROHIBITED FALSE or TRUE FALSE
REQUIRED FALSE or TRUE TRUE

Exemptions

Constraint Value Parameters
PROHIBITED FALSE or TRUE <node>
REQUIRED FALSE or TRUE <node>

Practical considerations

Accounting records provide more information regarding resource usage that logout security alarms.

IMAGE

Determine whether generation of image termination accounting records conforms to policy.

Violation reports

Constraint Nature of the violation
PROHIBITED Image accounting is enabled in violation of policy
REQUIRED Image accounting is disabled in violation of policy

Description

Use of the qualifier /ENABLE=IMAGE with the SET ACCOUNTING command causes image termination records to be written to the VMS accounting file.

Default policy

Enabling of image accounting is neither prohibited nor required

Customizing

Set limit REQUIRED to be TRUE to add a general requirement that image accounting be enabled

Selector

Limits

Constraint Value Default
PROHIBITED FALSE or TRUE FALSE
REQUIRED FALSE or TRUE FALSE

Exemptions

Constraint Value Parameters
PROHIBITED FALSE or TRUE <node>
REQUIRED FALSE or TRUE <node>

Practical considerations

Recording image termination accounting records greatly increases the disk space needed for the accounting file.

Previous Next Contents Index