System Administration Guide, Volume II
只搜尋這本書
以 PDF 格式下載這本書

Running ASET

60

This chapter describes how to run the Automated Security Enhancement Tool (ASET) to monitor or restrict access to system files and directories.
This is a list of the step-by-step instructions in this chapter.
How to Run ASET Interactivelypage 1232
How to Run ASET Periodicallypage 1234
How to Stop Running ASET Periodicallypage 1235
How to Collect Reports on a Serverpage 1235
For overview information about ASET, see "Automated Security Enhancement Tool (ASET)" on page 1177.

· How to Run ASET Interactively

  1. Become root.

  2. Run ASET interactively by using the aset command.


  # /usr/aset/aset -l  level -d pathname  

In this command,
levelSpecifies the level of security. Valid values are low, medium, or high. The default setting is low. See "ASET Security Levels" on page 1178 for detailed information about security levels.
pathnameSpecifies the working directory for ASET. The default is /usr/aset.
ASET starts running. The execution log message is displayed on the screen, telling you which tasks are being run.

Example--Running ASET Interactively

The following example runs ASET at low security with the default working directory.

  # /usr/aset/aset -l low  
  ======= ASET Execution Log =======  
  ASET running at security level low  
  Machine = jupiter; Current time = 0111_09:26  
  aset: Using /usr/aset as working directory  
  Executing task list ...  
       firewall  
       env  
       sysconf  
       usrgrp  
       tune  
       cklist  
       eeprom  
  All tasks executed. Some background tasks may still be running.  
  Run /usr/aset/util/taskstat to check their status:  
   /usr/aset/util/taskstat [aset_dir]  
  where aset_dir is ASET's operating  
  directory,currently=/usr/aset.  
  When the tasks complete, the reports can be found in:  
   /usr/aset/reports/latest/*.rpt  
  You can view them by:  
   more /usr/aset/reports/latest/*.rpt  

· How to Run ASET Periodically

  1. Become root.

  2. If necessary, set up the time when you want ASET to run periodically.

    You should have ASET run when system demand is light. The PERIODIC_SCHEDULE environment variable in the /usr/aset/asetenv file is used to set up the time for ASET to run periodically. By default, the time is set for midnight every 24 hours.

    If you want to set up a different time, edit the PERIODIC_SCHEDULE variable in the /usr/aset/asetenv file. See "PERIODIC_SCHEDULE Variable" on page 1194 for detailed information about setting the PERIODIC_SCHEDULE variable.

  3. Add an entry to the crontab file using the aset command.


  # /usr/aset/aset -p  

In this command,
-p
Inserts a line in the crontab file that starts ASET running at the time determined by the PERIODIC_SCHEDULE environment variable in the /usr/aset/asetenv file.

Verification--Running ASET Periodically

The following command displays the crontab entry, which enables you to confirm the schedule of when ASET will run.

  # crontab -l root  

· How to Stop Running ASET Periodically

  1. Become root.

  2. Edit the crontab file.


  # crontab -e root  

  1. Delete the ASET entry.

  2. Save the changes and exit.

· How to Collect Reports on a Server

  1. Set up a directory on the server:

    a. Type cd /usr/aset and press Return. b. Type mkdir rptdir and press Return. These two commands create a directory (rptdir) on the server for report collection.

    c. Type cd rptdir and press Return. d. Type mkdir client_rpt and press Return. This creates a subdirectory (client_rpt) for a client. Repeat this step for each client whose reports you need to collect.

    The following example creates the directory all_reports, and the subdirectories pluto_rpt and neptune_rpt.


  mars# cd /usr/aset  
  mars# mkdir all_reports  
  mars# cd all_reports  
  mars# mkdir pluto_rpt  
  mars# mkdir neptune_rpt  

  1. Share the client subdirectories.

    Add the client_rpt directories to the /etc/dfs/dfstab file. The directories should have read/write options.

For example, the following entries in dfstab are shared with read/write permissions.

  share -F nfs -o rw=pluto /usr/aset/all_reports/pluto_rpt  
  share -F nfs -o rw=neptune /usr/aset/all_reports/neptune_rpt  

  1. Type shareall and press Return.

    This makes the resources in the dfstab file available to the clients.

  2. Type the following command on each client:

mount server:/usr/aset/client_rpt          /usr/aset/masters/reports

This mounts the client subdirectory (/usr/aset/client_rpt) from the server to the client, at the mount point, /usr/aset/masters/reports.
  1. Edit the /etc/vfstab file to mount the directory automatically at boot time.

    The following sample entry in /etc/vfstab on neptune lists the directory to be mounted from

    mars, /usr/aset/all_reports/neptune_rpt, and the mount point on neptune, /usr/aset/reports. At boot time, the directories listed in vfstab are automatically mounted.


  mars:/usr/aset/all_reports/neptune.rpt /usr/aset/reports nfs - yes hard