Create a SMF security violation for failures on BPX.SUPERUSER so installations can use it to detect possible hacks or attacks.

Please refer to case: TS017997103 for additional information

Our intent was to audit the usage of the "su" command, and subsequent access granted once a user has switched user. Primarily we want to audit the "su" to ROOT userid. Thinking we could audit the usage of the BPX.SUPERUSER but found that currently, with AUDIT ALL set, only successes are logged in the SMF records. No where in the SMF security records could we find failures being recorded.

I understand that this functionality might be exploited to create a Denial of Service (DOS) attack. However not logging also has risk, as a hack or attack might go undetected. Perhaps something could be developed that so many failures be logged and the logging stopped until the attack is over. I'm not entirely sure what this should look like but the current functionality leaves much to be desired, and we need to have some way to AUDIT this possible exposure.

BTW, we did explore other log files to accomplish our objective. For one SYSLOGD log files were explored but found they also did not contain failures.

Idea priority

Medium

Post comment

By clicking the "Post Comment" or "Submit Idea" button, you are agreeing to the IBM Ideas Portal Terms of Use.
Do not place IBM confidential, company confidential, or personal information into any field.

Shape the future of IBM!

Search existing ideas

Post your ideas

Specific links you will want to bookmark for future use

Create a SMF security violation for failures on BPX.SUPERUSER so installations can use it to detect possible hacks or attacks.

Please enter your email address

RELATED IDEAS

Create a SMF security violation for failures on BPX.SUPERUSER so installations can use it to detect possible hacks or attacks.