Sun Solaris Dhcp - Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CONFIGURING DSMS REV 1 Manual

71
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
S S
UN OLARIS
A STRM Sun Solaris DHCP DSM accepts Solaris DHCP events using syslog.
STRM records all relevant events. Before you configure STRM to integrate with
Solaris DHCP, you must:
Log in as root.
Open the
/etc/default/dhcp
Enable logging of DHCP transactions to syslog by adding the following line:
LOGGING_FACILITY=X
Where is the number corresponding to a local syslog facility, for example, a
X
number from 0 to 7.
Save and exit the file.
Open the
/etc/syslog.conf
Forward the system's authentication logs to STRM by adding the following line to
the file:
localX.notice @<IP address>
Where:
is the number chosen in
X
is the IP address of the STRM system. Use tabs instead of spaces
<IP address>
to format the line.
Save and exit the file.
Enter the following command:
kill -HUP 'cat /etc/syslog.pid'
You are now ready to configure the sensor device within the STRM interface. To
configure STRM to receive events from a Solaris device, choose one of the
following options:
If you are using STRM 6.0, select Solaris DHCP Service from the Sensor
•
Device Type drop-down list box.
• If you are using STRM 6.0.1 and above, select Solaris Operating System
DHCP Logs from the Sensor Device Type drop-down list box.
Configuring DSMs Guide
DHCP
file.
file.
Step 3