LJK/Security Reference Manual

LJK/Security Reference Manual

Order Number: LJKS-REF-T030 This software is intended to assist in security assessment of VMS systems. It is not a substitute for a trained professional conducting periodic security assessments, but rather is intended to aid and assist that individual in performing the assessments on a more frequent and thorough basis than would otherwise be possible.

Information generated by this software should be treated on a confidential basis, since it constitutes a list of security vulnerabilities of your computer systems.

Revision/Update Information: Supercedes LJKS-REF-V029

Operating System and Version: VAX/VMS Version 4.2 or higher
MicroVMS Version 4.2 or higher
OpenVMS AXP Version 1.0 or higher

Software Version: LJK/Security T3.0

2008

Copyright ©1988-2008 by LJK Software, 233 Needham Street, Suite 300, Newton, MA 02464-1502

The following are trademarks of LJK Software:

The following are trademarks of Hewlett Packard:

The following is a trademarks of Process Software:

Contents Index

Preface

If you are a first-time reader interested in making productive use of the software as soon as possible, you should concentrate on the Overview Part.

Document Structure

This manual describes LJK/Security software and how it can be used in assessing security of VMS systems.

Overview Part

User Interfaces Part

Tests Part

Site-Specific Customization Part

Appendices

Intended Audience

This manual is for use by those responsible for conducting security assessments of VMS systems using the LJK/Security software.

It is possible to use the manual and run the software without an in-depth knowledge of VMS, but when potential problems are detected, resolution will often require considerable VMS expertise on the part of the LJK/Security user, or consultation with someone else (perhaps in a system management position) who has that expertise.

LJK Software provides telephone support regarding operation of the LJK/Security software and in many cases can offer alternative methods of addressing security problems you detect. But there is often a point where security goals conflict with other goals at your site in such a fashion that considerable system management or system programming effort is required to alleviate the security weakness without unduly burdening ongoing operations. In that situation, you will need local experts with those skills.

Associated Documents

Depending upon the VMS version(s) being run, the user should be familiar with the appropriate VMS security manuals:

For versions of VMS since V6.1 and all non-VAX versions, those documents are also available on CDROMs that came with your VMS software.

Conventions

Within LJK/Security Reference Manual, boldfaced words within normal text paragraphs have specific meanings outlined in the Glossary.

Throughout this document use of the second person ("you") or the term "user" refers to the intended reader of this manual, an individual who has been given appropriate facility-specific identifiers or is otherwise authorized to use LJK/Security as discussed in Section 5.4.

  1. QUICK mode
    With previous versions of LJK/Security it was necessary to modify a policy or to maintain a duplicate policy to switch back and forth between complete assessments and faster assessments that skipped the time-consuming Disk facility.
    Effective with Version 3.0 of LJK/Security, there is a /METHODS=QUICK qualifier available for the command mode RUN and MODIFY ASSESSMENT commands, with corresponding capabilities on the other interfaces. When one selects Quick operations, the assessment will skip the time consuming facilities - the familiar Disk facility and the new Usage facility introduced with Version 3.0 of LJK/Security.
  2. Include certain exemption comments with results
    For all constraints within the CHECKPROT element of the DISK facility, comments from policy exemptions will be included in results from assessment of tributaries. This differs from general case where comments from policy limits are used.
  3. Additional Selector Family - Operator Message Type
    Operator message types are used as selectors for (AUDIT, ALARM, REPORT) and (AUDIT, ALARM, RESPONSE) tests to specify to which operator message type the test pertains.
  4. Audit Tests
    New tests are provided:
  5. Disk Tests
    New tests are provided:
    The following new tests ensure that all files required by your organization standards have their checksums tested for integrity.
  6. PROD Tests
    The PROD facility contains tests for product installation on the system.
  7. Queue Tests
    The QUEUE facility contains tests for batch and print queues on the system.
  8. UAF Tests
    New tests are provided:
  9. Additional Selector Family - facilty-or-pseudofacility
    Facilities or pseudofacilities are used as selectors for (USAGE, ASSESSMENT, *) tests to specify which testing is supposed to have been done at the specified interval.
    Pseudo-facilities Facilities
  10. Usage Tests
    The USAGE facility reads Audit log files and tests data about past use of the machine.
    Exemptions for USAGE tests are based on the combination of:
    1. Node name
    2. Absolute or Earliest time
    An exemption based on an Absolute time exempts any detected violation at exactly that time.
    An exemption based on Earliest time exempts any detected violation earlier than that time. The tests above each take a selector indicating the facility or pseudo-facility about which type of assessment usage is being tested.
    Remaining USAGE tests have no selectors. Percentage of operator actions done by those with higher privilege than just OPER, NETMBX, TMPMBX.
  11. VMS Tests
    New tests are provided:
  12. Changed default for UAF, PRIVLEVEL, ABSOLUTLO
    The LJK/Security default limit for test UAF, PRIVLEVEL, ABSOLUTLO now has a value of Category-None rather than Category-Normal.
  13. Additional Selector value for VMS, SECPOLICY tests
    ALLOWSYMLINKACCESS is a new selector value used to specify that allowing execute access to permit reading attributes on a filename or backlink of symbolic links is either prohibited or required.
  14. Audit entries for Assessment runs
    Use of Identifier as Privilege audit entries will be written to show what facilities and sub-facilities were covered by an assessment. Sub-facilties include:
    Those data are used by the (USAGE, ASSESSMENT, *) tests.
    Along with writing this new audit record, LJK/Security will now suppress detailed audit messages pertaining to each file for which it examines protection information, etc.
  15. Implement SEPARATOR=character keyword for REPORT/SUMMARY
    The indicated character (defaulting to ",") will serve to divide comments into separate indicators for summary purposes, with each fail test counting under both indicators.
  16. Change /SUMMARY output format
    Rather than the previous concatenation of a violation count with a comment (after a space), summary output now intersperses the words "violation(s) of" between the count and the comment.
  17. Report tributary architecture and VMS and LJK/Security versions
    This report in the output header is just for visual confirmation.
  18. Add /SAMPLE=n qualifier for the REPORT command
    This provides information only for the first N violations of a given type. It can be used for reports to managers who want to see typical violations. Those involved in remedial efforts still need the full output in most cases.
  19. /[NO]SORT qualifier on output
    By default, Sort Report output by Facility, Element and Constraint. Failures due to insufficient space will mention /NOSORT as an option.

  20. Better information when VMS process quotas are exceeded

  21. EXIT command
    An EXIT command has been added for subsystem mode, having the same effect as Control/Z.
  22. Example TCP/IP command procedures
    Two example command files are now provided: for use by sites that are unable to run DECnet software. Use of these examples is described in Appendix N, Sending LJK/Security Data Directly over TCP/IP.
  23. Suppression of Detailed Auditing
    On VMS Version 6.0 and later, LJK/Security now suppresses detailed auditing (for instance on each use of privilege) while conducting an assessment on tributary nodes.
  24. Syntax for System Parameter file
    A file specification of "SYSTEM=PARAMETER" can now be used for tests in the (DISK,CHECKPROT) (or (DISK,CHECKSUM) for that matter) facility to indicate the architecture-specific name of the system parameter file.

Next Contents Index