🚀 go-pugleaf

In article <1992Aug19.082759.1@zodiac.rutgers.edu>, leichter@zodiac.rutgers.edu writes:
> Terry Poot complains that the default configuration of the audit server makes
> the system unbootable if the audit log fills.
> 
> This is really due to the DOD!  The audit server was designed around the DOD
> secure system requirements as part of reaching C2 certification back in VMS
> V4.5, or whichever version was actually certified.  A major requirement is
> that all security-relevant actions be logged - and as part of that that the
> system refuse to run when it cannot write log entries.  (I believe the certi-
> fication actually included an exception because, if the log was being written
> to a hard-copy device, it was possible for the system to continue if the
> output device ran out of paper!)
> 
> Now, you can say that this feature should only be there if you ask for it.
> However, the certification requirements must be met on the system AS IT
> WOULD BE INSTALLED "OUT OF THE BOX".  Given the past history of systems that
> are secure if you set them up right - but never seem to actually get set up
> right - this is a wise policy.  Unfortunately, it means imposing a real
> inconvenience on people who DON'T want this level of auditing.

I would be interested in where in the criteria it states that the requirements
must be met on a system "out of the box". I have worked with security on the
Unisys 1100/2200 security as part of the USE [user group] working group. I have
never seen any requirement that a certified system must work out of the box.The
certification is on a specific hardware configuration, software product mix and
software configuration. There is no requirement that non-certified systems must
work out of the box and I have never seen any requirement that a certified 
system work out of the box. 

One of the problems we encountered on the Unisys implementation [and it looks 
like DEC does the same thing] is that decisions have been made on the basis 
of that magic rating without any real regard for its usefulness in the real
world. 

We have a similar requirement for auditing at the B1 level but when we 
configure the OS, we can choose the level of the audit as well as the objects
audited. We also have the ability to choose the action if the audit trail is
not able to write [the default is to not audit but you can choose to take a
stop in this case.] At least Unisys gave you the choice on how much security
to include and explicit instructions on what needs to be included for running
at a certified level. I agree with Terry that there is NO EXCUSE for the 
default configuration resulting in an eventual system halt. IMHO, the one 
mandatory requirement of any security system is the ability to configure it to
a site's unique requirements PERIOD. I want the ability to make a reasoned 
choice as to the degree of security and the ability to tailor the system to
reflect that need in an easy-to-use way. The system should be supplied with
defaults that will allow the system to run without running out of things and
having documented easy restrictions to prevent 'easy' cracking of that system
out of the box. [all accounts have passwords and the system accounts such as
FIELD are disabled when installed. Part of the initial system boot/startup
script will query and use a user-supplied password for SYSTEM]. From this
starting point, the vendor will supply a security manual and scripts which will
allow me to tailor the system to provide the level of security I deem necessary
without any second-guessing by the system. 

-- 
Richard H. Miller                 Email: rick@bcm.tmc.edu
Asst. Dir. for Technical Support  Voice: (713)798-3532
Baylor College of Medicine        US Mail: One Baylor Plaza, 302H
                                           Houston, Texas 77030