LJK/Security Reference Manual
Previous Contents Index

ACL

Determine whether auditing for events requested by access control list entries conforms to policy.

Violation reports

Constraint Nature of the violation
ALPROHIBIT ACL security alarms are enabled in violation of policy
ALREQUIRE ACL security alarms are disabled in violation of policy
AUPROHIBIT ACL security audits are enabled in violation of policy
AUREQUIRE ACL security audits are disabled in violation of policy

Description

Use of the qualifier /ENABLE=ACL with the SET AUDIT/ALARM or SET AUDIT/AUDIT command causes the corresponding reporting when any user has requested them. Users make that request by placing a Security Alarm Access Control Entry in the Access Control List of some object (file, global section, etc.).
Default policy Enabling of ACL security alarms and audits is neither prohibited nor required. Customizing Set limits TRUE to establish a general prohibition of or requirement for the enabling of ACL security auditing. Then establish exemptions for any individual nodes which are not to be subjected to the general rule. selector

Limits

Constraint Value Default
ALPROHIBIT FALSE or TRUE FALSE
ALREQUIRE FALSE or TRUE FALSE
AUPROHIBIT FALSE or TRUE FALSE
AUREQUIRE FALSE, TRUE or TRY FALSE

Exemptions

Constraint Value Parameters
ALPROHIBIT FALSE or TRUE <node>
ALREQUIRE FALSE or TRUE <node>
AUPROHIBIT FALSE or TRUE <node>
AUREQUIRE FALSE, TRUE or TRY <node>
Practical considerations Enabling ACL security alarms allows individual users the power to cause the generation of unlimited alarms, potentially swamping more significant alarms from other sources.

Enabling ACL security audits allows individual users the power consume unlimited disk space in the audit logs, but typically does not cause extra work for the security officer.

ALARM

Determine whether operator settings and responsiveness conform to policy.

Violation reports

Constraint Nature of the violation
REPORT No operator terminal is enabled in violation of policy
RESPONSE No operator for the specified class responded, violating policy

Description

Use of the qualifier /ENABLE or /ENABLE=(keyword,...) with the REPLY command enables a terminal for operator interaction for one or more of 24 operator classes.

Tests for this element determine in a slightly invasive manner whether any terminal is enabled for selected operator classes and whether operator responses are received within an acceptable time interval.

For the REPORT constraint "ignore this message" text is sent to the relevant operator. This test will report if the OPCOM process is not set up to send those message to operators. The test (AUDIT, ALARM, REPORT) is quite similar to the test (VMS, OPCOM, REQUIRED) with the following differences:

When using test (AUDIT, ALARM, REPORT) one should choose a selector corresponding to an operator class not in use at the local site.

For the RESPONSE constraint text is sent to the operator designated by the selector and requires an operator response. The response from the target operator shows:

Default policy Enabling of terminals for operator interaction is not required. Customizing Set limit REPORT to be TRUE for the selectors corresponding to the types of operator messages your policy requires to be received. For those selectors on which you wish to also test operator responsiveness, set limit RESPONSE to the maximum number of seconds allowed for a response.

If limit REPORT is set to FALSE, no testing for limit RESPONSE is performed, since no response is possible for a type of operator message that is not enabled at any terminal. selector Limits for this element can take a selector consisting of an operator message type: CENTRAL, PRINTER, TAPES, DISKS, DEVICES, CARDS, NETWORK, CLUSTER, SECURITY, LICENSE, USER1, USER2, USER3, USER4, USER5, USER6, USER7, USER8, USER9, USER10, USER11, USER12.

Thus, each limit can be set once for each possible operator message type. If you do not specify a selector when changing limits, your change applies to all operator message types.

Of the operator message types listed above, the REPLY and SOFTWARE types are not documented (as late as VMS Version 8.3) and by default are not enabled (by REPLY/ENABLE command) or disabled (by the REPLY/DISABLE command).

Of the operator message types listed above, the LICENSE type is not documented (as late as VMS Version 8.3) but by default is enabled (by REPLY/ENABLE command) and disabled (by the REPLY/DISABLE command).

Limits

Constraint Value Default
REPORT FALSE or TRUE FALSE
RESPONSE 0---n 0

Exemptions

Constraint Value Parameters
REPORT FALSE or TRUE <node>
RESPONSE 0---n <node>
Practical considerations Test (AUDIT, ALARM, RESPONSE) interrupts an enabled operator with a message to which they must respond, so it should be used judiciously.

If one wanted to use test (AUDIT, ALARM, RESPONSE) in support of certain external rule sets (such as NIST 800-53 control AU-5(2)) that are aimed at security functions, it is better to specify only the SECURITY selector, providing a single message to which the SECURITY operator must respond, rather than multiple messages to which 24 separate operator responses are required.

ARCHIVE

Determine whether use of an additional audit file destination conforms to policy.

Violation reports

Constraint Nature of the violation
ALPROHIBIT Security alarms are archived in violation of policy
ALREQUIRE Security alarms are not archived in violation of policy
AUPROHIBIT Security audits are archived in violation of policy
AUREQUIRE Security audits are not archived violation of policy
FLUSH Audit archive flush interval exceeds policy maximum
LOCATION Audit archive file is in an improper location

Description

The SET AUDIT/ARCHIVE command can be used to establish a secondary audit log file, such as one on a different node. Tests in this element determine whether those settings conform to policy.
Default policy Use of an additional audit log file is neither prohibited nor required. The flush interval is not tested. Customizing Set A* limits TRUE to establish a general prohibition of or requirement for writing records to an additional audit file.

Set flush limit to specify a particular maximum interval for flushing those records to the additional (archive) audit file.

Set location limit to specify the proper location for the additional audit file. selector

Limits

Constraint Value Default
ALPROHIBIT FALSE or TRUE FALSE
ALREQUIRE FALSE, TRUE or TRY FALSE
AUPROHIBIT FALSE or TRUE FALSE
AUREQUIRE FALSE, TRUE or TRY FALSE
FLUSH delta-time +00:00:00.00
LOCATION Any filespec *

Exemptions

Constraint Value Parameters
ALPROHIBIT FALSE or TRUE <node>
ALREQUIRE FALSE, TRUE or TRY <node>
AUPROHIBIT FALSE or TRUE <node>
AUREQUIRE FALSE, TRUE or TRY <node>
FLUSH delta-time <node>
LOCATION Any filespec <node>
Practical considerations Per-node exemptions are required for off-node archive files, since the audit server will attempt to open a file in exclusive mode, which would conflict with any other node set with the same file specification.

AUDILLFOR

Determine whether enabling of alarms or audits for ill-formed audit events conforms to policy.

Violation reports

Constraint Nature of the violation
ALPROHIBIT Ill-formed audit security alarms are enabled in violation of policy
ALREQUIRE Ill-formed audit security alarms are disabled in violation of policy
AUPROHIBIT Ill-formed audit security audits are enabled in violation of policy
AUREQUIRE Ill-formed audit security audits are disabled in violation of policy

Description

Use of the qualifier /ENABLE=AUDIT=ILLFORMED with the SET AUDIT/ALARM or SET AUDIT/AUDIT command causes the corresponding reporting when an ill-formed call to cause an audit is made by an internal VMS component.
Default policy Enabling of Ill-formed audit security alarms and audits is neither prohibited nor required. Customizing Set limits TRUE to establish a general prohibition of or requirement for the enabling of Ill-formed audit security alarms or audits. Then establish exemptions for any individual nodes which are not to be subjected to the general rule. selector

Limits

Constraint Value Default
ALPROHIBIT FALSE or TRUE FALSE
ALREQUIRE FALSE, TRUE or TRY FALSE
AUPROHIBIT FALSE or TRUE FALSE
AUREQUIRE FALSE, TRUE or TRY FALSE

Exemptions

Constraint Value Parameters
ALPROHIBIT FALSE or TRUE <node>
ALREQUIRE FALSE, TRUE or TRY <node>
AUPROHIBIT FALSE or TRUE <node>
AUREQUIRE FALSE, TRUE or TRY <node>
Practical considerations The corresponding audits and alarms are enabled on VMS by default, and cause no extra burden on a properly running system.

AUDIT

Determine whether auditing for events resulting from the SET AUDIT command conforms to policy.

Violation reports

Constraint Nature of the violation
ALPROHIBIT Audit security alarms are enabled in violation of policy
ALREQUIRE Audit security alarms are disabled in violation of policy
AUPROHIBIT Audit security audits are enabled in violation of policy
AUREQUIRE Audit security audits are disabled in violation of policy

Description

Use of the qualifier /ENABLE=AUDIT with the SET AUDIT/ALARM or SET AUDIT/AUDIT command causes the corresponding reporting when the SET AUDIT command is used.

Default policy Enabling of Audit security alarms and audits is required. Customizing Set limit ALREQUIRE FALSE to remove the requirement for the enabling of Audit security alarms.

Set limit ALPROHIBIT TRUE to prohibit the enabling of Audit security alarms on versions of VMS prior V6.0. On VMS V6.0 and later there is no way to disable the auditing of the SET AUDIT command. If you are running mixed versions of VMS and want to prohibit the auditing of SET AUDIT on whatever versions where it is possible, set limit AUPROHIBIT to the value TRY. selector

Limits

Constraint Value Default
ALPROHIBIT FALSE, TRUE or TRY FALSE
ALREQUIRE FALSE or TRUE TRUE
AUPROHIBIT FALSE, TRUE or TRY FALSE
AUREQUIRE FALSE, TRUE or TRY TRUE

Exemptions

Constraint Value Parameters
ALPROHIBIT FALSE, TRUE or TRY <node>
ALREQUIRE FALSE or TRUE <node>
AUPROHIBIT FALSE, TRUE or TRY <node>
AUREQUIRE FALSE, TRUE or TRY <node>
Practical considerations The recording of Audit events is essential to verify the completeness of other events which are recorded.

AUTHENT

Determine whether enabling of alarms or audits for authentication events conforms to policy.

Violation reports

Constraint Nature of the violation
ALPROHIBIT Authentication security alarms are enabled in violation of policy
ALREQUIRE Authentication security alarms are disabled in violation of policy
AUPROHIBIT Authentication security audits are enabled in violation of policy
AUREQUIRE Authentication security audits are disabled in violation of policy

Description

The corresponding auditing is not supported as of VMS V7.3.
Default policy Enabling of Authentication security alarms and audits is neither prohibited nor required. Customizing Set limits TRUE to establish a general prohibition of or requirement for the enabling of Authentication security alarms or audits. Then establish exemptions for any individual nodes which are not to be subjected to the general rule. selector

Limits

Constraint Value Default
ALPROHIBIT FALSE or TRUE FALSE
ALREQUIRE FALSE, TRUE or TRY FALSE
AUPROHIBIT FALSE or TRUE FALSE
AUREQUIRE FALSE, TRUE or TRY FALSE

Exemptions

Constraint Value Parameters
ALPROHIBIT FALSE or TRUE <node>
ALREQUIRE FALSE, TRUE or TRY <node>
AUPROHIBIT FALSE or TRUE <node>
AUREQUIRE FALSE, TRUE or TRY <node>
Practical considerations As of V7.3 VMS does not provide a method to enable auditing or alarms for these events.

AUTHORIZE

Determine whether auditing for user authorization changes conforms to policy.

Violation reports

Constraint Nature of the violation
ALPROHIBIT Authorize security alarms are enabled in violation of policy
ALREQUIRE Authorize security alarms are disabled in violation of policy
AUPROHIBIT Authorize security audits are enabled in violation of policy
AUREQUIRE Authorize security audits are disabled in violation of policy

Description

Use of the qualifier /ENABLE=AUTHORIZATION with the SET AUDIT/ALARM or SET AUDIT/AUDIT command causes the corresponding reporting when standard utilities such as LOGIN, AUTHORIZE and SET PASSWORD are used to change authorization information.
Default policy Enabling of Authorize security alarms is neither prohibited nor required.

Enabling of Authorize security audits is required. Customizing Set limits TRUE to establish a general prohibition of or requirement for the enabling of Authorize security auditing. Then establish exemptions for any individual nodes which are not to be subjected to the general rule. selector

Limits

Constraint Value Default
ALPROHIBIT FALSE or TRUE FALSE
ALREQUIRE FALSE or TRUE FALSE
AUPROHIBIT FALSE or TRUE FALSE
AUREQUIRE FALSE, TRUE or TRY TRY

Exemptions

Constraint Value Parameters
ALPROHIBIT FALSE or TRUE <node>
ALREQUIRE FALSE or TRUE <node>
AUPROHIBIT FALSE or TRUE <node>
AUREQUIRE FALSE, TRUE or TRY <node>
Practical considerations Bear in mind that authorization security events include password changes by individual users, creating alarms for events which are typically not controlled by system administrators.

For authorization security events, using audits rather than alarms is more practical for most situations.

Previous Next Contents Index