Hi,
Another approach (which I have already mentioned to Patrick)
is to use the DSLINE TRACE option, and I do not know if anyone
uses it for this purpose.
You have a logon udc which invokes DSLINE to the target machine
with the trace option enabled, and the tracefiles built in a special
account .
The awkward bit is in having a friendly playback program to allow
you to review the log files, otherwise its just a bit of MPEX and Sec/3000.
This technique was implemented at the last site I worked at, and it
worked very well indeed.
Mike Fitzwilliam was the author, and he may have posted some
details to the list a couple of years ago.
Regards,
Tad.
Internet
From: [log in to unmask] on 16/02/2000 16:07 GMT
Pour : HP3000-L
cc :
ccc: Tad BOCHAN
Objet : Re: Logging and Security on HP3000
Along these lines Black Box sells a "modem spliter" that does the same
thing. We have used it to have two consoles for each system. One at the
system and one in the area where the operators work.
Carl McNamee
Systems Administrator
Billing Concepts
-----Original Message-----
From: Johnson, Tracy [mailto:[log in to unmask]]
Sent: Wednesday, February 16, 2000 8:28 AM
To: [log in to unmask]
Subject: Re: Logging and Security on HP3000
Quick and dirty method:
Manufacture an eavesdrop cable and hook it up as follows:
CPU (DB-25) PC with Reflection Modem
PIN (Logging Bottom to Disc) (DB-25)
PIN (DB-25) PIN
2 ------------------- 3 ------------------- 2
3 ------------------- 2 ------------------- 3
7 --------------------7 ------------------- 7
All other modem pinouts:
x ----------------------------------------- x
Dump your disc output to the Auditors frequently.
The above was tested in 1986 with using an
HP2382A (father of HP150) terminal to screen
only (the HP2382 had no printer port. I might
be hazy on the pinouts, trial and error should
fix it.
This would be a good use for old x86 PCs you
haven't been able to get rid of. Or if you're
short on space you can stack old laptops with the
cover opened all the way flat. Or find some old
"Brick" PCs without a monitor.
Instead of Reflection you may substitute Minisoft/92
for les$ or QCTerm for free.
Even better, if you can find some old Kaypro's you
could substitue CP/M to receive input on the
serial port.
Tracy M. Johnson
TRW Automotive Electronics
Sensors & Components
-----Original Message-----
From: Tom [mailto:[log in to unmask]]
Sent: Wednesday, February 16, 2000 12:08 AM
To: [log in to unmask]
Subject: Re: Logging and Security on HP3000
"J. Patrick Lindley" wrote:
>
> I'm looking for a way to monitor and log every keystroke performed on
> our dialup lines for our HP3000. We already use Security/3000 by VESOFT
> to prevent unauthorized access, but because we are financial institution
> it has become necessary to track every single keystroke so we can prove
> to our auditors that source code, JCL, and other items are changed by
> authorized personnel. Is there any such beast of a program (or
> hardware) out there that will do this?
I think Reflections has a LOG to Disk function that will record every
byte appearing on the screen. I don't know if they have a
Modem-monitoring function.
> I may also have to implement something like this for the operators since
> the nature of their jobs requires them to have access to things on the
> system but this access gives them the ability (albeit they have to know
> what to do first) to read/modify things they shouldn't.
You can turn logging for File Opens and Closes. That's a start. IMAGE
Logging will tell you all the DBDELETE/DBPUT/DBUPDATEs that occur.
>
> One last thing: would someone recommend a system log
> formatting/reporting tool that works better and easier than HP's
> LOGTOOL?
MPEX by VESoft has a LISTLOG Function:
%VEAUDIT LISTLOG LOGON @.@;BEGIN=2/15/2000
%VEAUDIT LISTLOG CONSOLE @.@;BEGIN=2/15/2000
> Thanx in advance.
>
> --------------------------------------------------
> J. Patrick Lindley
> Data Center Manager
> SAFE Credit Union
> [log in to unmask]
-----------------------------------------------------------------------------
This message is confidential; its contents do not constitute a
commitment by Paribas except where provided for in a written agreement
between you and Paribas. Any unauthorised disclosure, use or
dissemination, either whole or partial, is prohibited. If you are not
the intended recipient of the message, please notify the sender
immediately.
Ce message est confidentiel ; son contenu ne représente en aucun cas un
engagement de la part de Paribas sous réserve de tout accord conclu par
écrit entre vous et Paribas. Toute publication, utilisation ou
diffusion, même partielle, doit être autorisée préalablement. Si vous
n'êtes pas destinataire de ce message, merci d'en avertir immédiatement
l'expéditeur.
|
