Thanx for the assistance wtih VMS security questions in general - VMS

This is a discussion on Thanx for the assistance wtih VMS security questions in general - VMS ; Good Morning, Thanx to the folks that provided usefull information. Some of your feedback was quite helpfull, and much appreciated. My requirements for research were fairly broad: (1) The capability to generate and compare mathematical hash's of files and/or directories; ...

+ Reply to Thread
Results 1 to 5 of 5

Thread: Thanx for the assistance wtih VMS security questions in general

  1. Thanx for the assistance wtih VMS security questions in general

    Good Morning,

    Thanx to the folks that provided usefull information. Some of your
    feedback was quite helpfull, and much appreciated. My requirements
    for research were fairly broad: (1) The capability to generate and
    compare mathematical hash's of files and/or directories; (2) the
    ability to store system specific configuration meta-data and compare;
    (3) the ability to store ACL meta-data and compare. Exactly WHAT
    files, directories, etc...to monitor and comply with the requirements
    against was not specified. Thus my questions.

    "TripWire" (to the best of my understanding) is both a commercial
    product offering, and a SourceForge Open Source tool that has the
    capability of computing, storing and comparing a mathematical hash of
    a file, directory of BLOB object.

    Not so many thanx to the folks that superior attitude, thinly veiled
    as knowledge. It is this behavior that gives the technologist such a
    bad reputation to the business side of the house.


  2. Re: Thanx for the assistance wtih VMS security questions in general

    rfc2307@gmail.com wrote:
    > Good Morning,
    >
    > Thanx to the folks that provided usefull information. Some of your
    > feedback was quite helpfull, and much appreciated. My requirements
    > for research were fairly broad: (1) The capability to generate and
    > compare mathematical hash's of files and/or directories; (2) the
    > ability to store system specific configuration meta-data and compare;
    > (3) the ability to store ACL meta-data and compare. Exactly WHAT
    > files, directories, etc...to monitor and comply with the requirements
    > against was not specified. Thus my questions.
    >
    > "TripWire" (to the best of my understanding) is both a commercial
    > product offering, and a SourceForge Open Source tool that has the
    > capability of computing, storing and comparing a mathematical hash of
    > a file, directory of BLOB object.
    >
    > Not so many thanx to the folks that superior attitude, thinly veiled
    > as knowledge. It is this behavior that gives the technologist such a
    > bad reputation to the business side of the house.
    >



    Since you explained exactly none of this in your original post, I
    think the superior attitude was entirely appropriate.

    --
    John Santos
    Evans Griffiths & Hart, Inc.
    781-861-0670 ext 539

  3. Re: Thanx for the assistance wtih VMS security questions in general

    John Santos wrote:
    > rfc2307@gmail.com wrote:
    >
    >> Good Morning,
    >>
    >> Thanx to the folks that provided usefull information. Some of your
    >> feedback was quite helpfull, and much appreciated. My requirements
    >> for research were fairly broad: (1) The capability to generate and
    >> compare mathematical hash's of files and/or directories; (2) the
    >> ability to store system specific configuration meta-data and compare;
    >> (3) the ability to store ACL meta-data and compare. Exactly WHAT
    >> files, directories, etc...to monitor and comply with the requirements
    >> against was not specified. Thus my questions.
    >>
    >> "TripWire" (to the best of my understanding) is both a commercial
    >> product offering, and a SourceForge Open Source tool that has the
    >> capability of computing, storing and comparing a mathematical hash of
    >> a file, directory of BLOB object.
    >>
    >> Not so many thanx to the folks that superior attitude, thinly veiled
    >> as knowledge. It is this behavior that gives the technologist such a
    >> bad reputation to the business side of the house.
    >>

    >
    >
    > Since you explained exactly none of this in your original post, I
    > think the superior attitude was entirely appropriate.
    >


    I think it would have been approriate to provide this link:
    How To Ask Questions The Smart Way
    http://catb.org/~esr/faqs/smart-questions.html


  4. Re: Thanx for the assistance wtih VMS security questions in general

    In article <39288283-1d6f-4af5-a87f-694ab5af9197@e23g2000prf.googlegroups.com>, rfc2307@gmail.com writes:

    > Thanx to the folks that provided usefull information. Some of your
    > feedback was quite helpfull, and much appreciated. My requirements
    > for research were fairly broad: (1) The capability to generate and
    > compare mathematical hash's of files and/or directories; (2) the
    > ability to store system specific configuration meta-data and compare;


    As you saw from the checklists at the URLs I posted, LJK/Security
    does those two steps.

    > (3) the ability to store ACL meta-data and compare. Exactly WHAT
    > files, directories, etc...to monitor and comply with the requirements
    > against was not specified. Thus my questions.


    Devising general rules for ACL contents is a tough task, whereas
    simply recording the values and looking for changes is trivial
    (SHOW SECURITY/OUTPUT=, followed by DIFFERENCES ).

    What files are worthy of your consideration depends entirely on the
    use to which the target system is put. For a production system,
    hashes of all executable image should remain invariant as should
    hashes of all command procedures. For a development system, that
    would be an intolerable set of rules.

    But looking for changes in files is really useless on a VMS system
    unless you have first taken care of all the possible configuration
    errors that might enable an unauthorized person to make changes.

    > "TripWire" (to the best of my understanding) is both a commercial
    > product offering, and a SourceForge Open Source tool that has the
    > capability of computing, storing and comparing a mathematical hash of
    > a file, directory of BLOB object.


    I have never heard of someone using that on VMS. Perhaps someone else
    has.

  5. Re: Thanx for the assistance wtih VMS security questions in general

    rfc2307@gmail.com wrote:
    >
    > Good Morning,
    >
    > Thanx to the folks that provided usefull information. Some of your
    > feedback was quite helpfull, and much appreciated. My requirements
    > for research were fairly broad: (1) The capability to generate and
    > compare mathematical hash's of files and/or directories; (2) the
    > ability to store system specific configuration meta-data and compare;
    > (3) the ability to store ACL meta-data and compare. Exactly WHAT
    > files, directories, etc...to monitor and comply with the requirements
    > against was not specified. Thus my questions.
    >
    > "TripWire" (to the best of my understanding) is both a commercial
    > product offering, and a SourceForge Open Source tool that has the
    > capability of computing, storing and comparing a mathematical hash of
    > a file, directory of BLOB object.
    >
    > Not so many thanx to the folks that superior attitude, thinly veiled
    > as knowledge. It is this behavior that gives the technologist such a
    > bad reputation to the business side of the house.


    As Larry pointed out, without knowing what "Tripwire" might be, it was a
    crap-shoot at best how to answer such a question.

    Best to make sure "everyone" knows what you're talking about by offering
    the definition or, at the very least, enough supporting context for
    someone to draw a reasonably intelligent inference.

    David J Dachtera
    (formerly dba) DJE Systems

+ Reply to Thread