Re: Security Audit Journal receiver

["David Morris" <David.Morris@xxxxxxxxxxxxx>]

Rob,

With all of those system administrators the only way I can come up with
to protect your log is to sign the messages as they are produced.
Sending them to another system in that case could protect you from
someone destroying the i5 system to cover their tracks.

David Morris

>>> rob@xxxxxxxxx 1/17/2005 6:29:23 AM >>>
I would have to say that duplicating the audit journal machines to a 
Wintel box is probably not a very secure idea.  I am not just "bashing

Windows".  Here, we have 3 people who know the QSECOFR passwords.  The
VP 
of IS, the gal who does the bulk of the day-to-day security, and me. 
However, every one of our technicians know the windows administrator 
passwords.  Either there is just so much that requires that level, or,

like the programmer who always cries they need *ALLOBJ we have not
figured 
out how to work within Window's confines.  If your situation is
anything 
like ours, then you would have too many people to collaborate.  Oh, and

every one of our i5 administrators also has administrator level access
in 
Windows.  With EIM and the drive to reduce costs I just don't see this

getting any more compartmentalized.
Linux here is normally an afterthought.  Whoever needs to work on that

gets Godlike authority to it.

Rob Berendt
-- 
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com