local auditing tools

From: Ryan Yagatich (ryany@pantek.com)
Date: 01/03/02 

From: "Ryan Yagatich" <ryany@pantek.com>
To: "focus-linux" <focus-linux@securityfocus.com>
Date: Wed, 2 Jan 2002 18:15:44 -0500

Hello,

I was wondering if anyone knew of any good filesystem
auditing tools.

Running tripwire or some other daemon _at this point_
is out of the question.

What i would like to see is something that did the following:
        Has a ruleset ...
        ... on which services are allowed to listen
                -for incomming connections.
        ... which address classes that are connected are truly
                -who they say they are/are within accepted range
        ... which tests if setuid/setgid are really supposed to
                -be
        ... monitor user accounts for elevated permissions
                -i.e. accounts that are `grep ':0:' /etc/passwd
                -and the such
        and other obvious audit tests that take a lot of text to
        type.

This will be run on many different hosts, primarily RedHat linux,
but there has been some talk in the background about other
distributions being involved as well.

Purpose:
        to save a lot of my time. i dont want to write something
that could potentially be this complex.

thanx in advance

Relevant Pages

  • Re: Using fuse for AFS/DFS (was Re: [OpenAFS-devel] openafs / opendfs collaboration)
    ... >> userland daemon, without any authentication information like for example ... There are two choices for the security model in FUSE. ... The other choice is that the kernel does the normal file mode based ... Obviously in this case the filesystem can still ...
    (Linux-Kernel)
  • Re: modprobe.conf is ignored
    ... Joachim Selke wrote: ... the filesystem to be mounted read-write and then starts the daemon. ... You could use this simple init script as a basis for an ipw3945d ...
    (Fedora)
  • Re: modprobe.conf is ignored
    ... Ric Moore wrote: ... create its pid file. ... filesystem to be mounted read-write and then starts the daemon. ...
    (Fedora)
  • Re: modprobe.conf is ignored
    ... create its pid file (and also my "touch /test" test failes). ... such that a script is started in the background that waits for the ... filesystem to be mounted read-write and then starts the daemon. ...
    (Fedora)
  • Re: Ensuring that a daemon runs as a single instance
    ... >>> What is the correct method that a daemon program should follow to ... >> This is not possible if the daemon keep the pid file open. ... Detach the filesystem from the filesystem hierar- ... Another way would be to mount another file system on the same mount point. ...
    (comp.unix.programmer)