Re: Secure storage of BSM audit files?

From: Darren Moffat (
Date: 03/07/02

Date: Thu, 7 Mar 2002 11:36:52 -0800 (PST)
From: Darren Moffat <>

>Kludgy solution:
>- Pull audit files at regular intervals of time onto a more secure server,
>and store the files by time-stamps. This way some sort of snap-shot is

The file names already contain a timestamp and hostname.


>Refined questions:
>- Is there a similar way to set-up a effectively append-only file system on
>a remote server?


>- I hear (might be wrong) that BSD supports append-only file systems, is
>there something equivalent for Solaris (maybe via NFS)?

not on Solaris.

>- Is there a way of doing this via NFS?

Yes, just store the audit files on a NFS filesystem in the first place,
the way files are named ensures they are unique.

I would recommend that you use at least AUTH_DH protection of better
yet use Kerberos (with encryption) for the security protection on the
NFS mounts. See the mount_nfs and share_nfs man pages for details.

Darren J Moffat