Very Computer

by **James Grav** » Thu, 13 Jan 2000 04:00:00

Hello y'all,

I'll soon be placing a couple OpenBSD systems in harm's way (connected
full-time to the Internet). I've never before paid much attention to
intrusion detection and such, but I'm more worried about it now.

At any rate, I've been considering three systems to help me monitor my
Internet-connected systems: OpenBSD's bundled mechanisms (mtree and the
/etc/security script), COPS, and Tripwire.

Except for maybe the Kuang expert system, it seems to me that COPS
doesn't do much more that OpenBSD's /etc/security script. It's also not
clear to me what (if any) extra features that Tripwire provides would be
worth spending cash on. It also doesn't help that Tripwire isn't
supported on the *BSDs either, though it might run under Linux
compatability mode.

So should I just spend time with mtree, or investigate the other
packages? Any suggestions are welcome.

Later,

James Graves

--
_______________________________________________________________________________
http://www.xnet.com/~ansible Rapture. Be Pure. - Blondie

by **WhoCare** » Thu, 13 Jan 2000 04:00:00

JG| So should I just spend time with mtree, or investigate the other
JG| packages? Any suggestions are welcome.

Tripwire 1.2 is free and works on OpenBSD with few modifications.
It can be retrieved from ftp.cert.org and costs nothing...

--
I argue very well. Ask any of my remaining friends. I can win an
argument on any topic, against any opponent. People know this, and
steer clear of me at parties. Often, as a sign of their great respect,
they don't even invite me.

by **Theo de Raad** » Thu, 13 Jan 2000 04:00:00

> I'll soon be placing a couple OpenBSD systems in harm's way (connected
> full-time to the Internet). I've never before paid much attention to
> intrusion detection and such, but I'm more worried about it now.

> At any rate, I've been considering three systems to help me monitor my
> Internet-connected systems: OpenBSD's bundled mechanisms (mtree and the
> /etc/security script), COPS, and Tripwire.

> Except for maybe the Kuang expert system, it seems to me that COPS
> doesn't do much more that OpenBSD's /etc/security script. It's also not
> clear to me what (if any) extra features that Tripwire provides would be
> worth spending cash on. It also doesn't help that Tripwire isn't
> supported on the *BSDs either, though it might run under Linux
> compatability mode.

I would love it if people sat down and finished our mtree, with minor
little tweaks here and there, so that it would be a complete
alternative to tripwire.

(But I'm becoming cynical. I've been mentioning this idea for about 3 years,
and noone's finished it yet).

--

Open Source means some restrictions apply, limits are placed, often quite
severe. Free Software has _no_ serious restrictions. OpenBSD is Free Software.

by **James Grav** » Fri, 14 Jan 2000 04:00:00

Quote:>I would love it if people sat down and finished our mtree, with minor
>little tweaks here and there, so that it would be a complete
>alternative to tripwire.

OK, I'll at least give it a try. What other features would y'all like to
see?

James Graves
--
_______________________________________________________________________________
http://www.xnet.com/~ansible Rapture. Be Pure. - Blondie

by **James Moor** » Sat, 15 Jan 2000 04:00:00

Quote:>I would love it if people sat down and finished our mtree, with minor
>little tweaks here and there, so that it would be a complete
>alternative to tripwire.

>(But I'm becoming cynical. I've been mentioning this idea for about 3 years,
>and noone's finished it yet).

Just out of curiosity, what's wrong with Tripwire?

by **t..** » Sat, 15 Jan 2000 04:00:00

>>I would love it if people sat down and finished our mtree, with minor
>>little tweaks here and there, so that it would be a complete
>>alternative to tripwire.

>>(But I'm becoming cynical. I've been mentioning this idea for about 3 years,
>>and noone's finished it yet).
>Just out of curiosity, what's wrong with Tripwire?

What is its license?

--

by **t..** » Sat, 15 Jan 2000 04:00:00

>>I would love it if people sat down and finished our mtree, with minor
>>little tweaks here and there, so that it would be a complete
>>alternative to tripwire.
>OK, I'll at least give it a try. What other features would y'all like to
>see?

To start with, try cryptographic checksums for each file? But if you
read the above again, '...complete alternative to tripwire.', you could
probably understand what is being suggested here.

--

by **James Grav** » Sat, 15 Jan 2000 04:00:00

>To start with, try cryptographic checksums for each file? But if you
>read the above again, '...complete alternative to tripwire.', you could
>probably understand what is being suggested here.

.... ooookay. I must be missing something here. You can use MD5
instead of a checksum just by specifying md5digest as a keyword when you
run mtree. In fact, you can use MD5, SHA1, RMD160, and checksum all at
once if you have that kind of spare time. Or did you mean something else
entirely?

It's also not clear to me what else Tripwire does that we really need.
I'm sure it has nicer reports and such. And it appears that the
handling of the specification files is better and with more features (for
example it'll encrypt it for you automatically). For the specs, I'm
planning to use removable media instead.

Reporting and such aren't that important to me (a diff of old vs. new is
fine). Is mtree + /etc/security missing any other basic functions that
Tripwire has?

James
--
_______________________________________________________________________________
http://www.xnet.com/~ansible Rapture. Be Pure. - Blondie

by **t..** » Sat, 15 Jan 2000 04:00:00

>>To start with, try cryptographic checksums for each file? But if you
>>read the above again, '...complete alternative to tripwire.', you could
>>probably understand what is being suggested here.
>.... ooookay. I must be missing something here. You can use MD5
>instead of a checksum just by specifying md5digest as a keyword when you
>run mtree. In fact, you can use MD5, SHA1, RMD160, and checksum all at
>once if you have that kind of spare time. Or did you mean something else
>entirely?
>It's also not clear to me what else Tripwire does that we really need.
>I'm sure it has nicer reports and such. And it appears that the
>handling of the specification files is better and with more features (for
>example it'll encrypt it for you automatically). For the specs, I'm
>planning to use removable media instead.
>Reporting and such aren't that important to me (a diff of old vs. new is
>fine). Is mtree + /etc/security missing any other basic functions that
>Tripwire has?

Current mtree, last I checked, does nothing to verify that the binaries are
the same. I've not used tripwire myself, so I can't compare what it does to
what current /etc/security + mtree does ...

The problem with md5 is that you can purposefully make binaries with
alterior motives have the same md5. Thus my suggestion of sha1, or something
similar. This is why ports has added sha1 to the tree as a check on the
downloaded source.
--

by **Adam Rogoys** » Sun, 16 Jan 2000 04:00:00

: The problem with md5 is that you can purposefully make binaries with
: alterior motives have the same md5. Thus my suggestion of sha1, or something
: similar.

How is this different from the keyword sha1digest in the current mtree?

Adam

by **Slawek Za** » Mon, 24 Jan 2000 04:00:00

> The problem with md5 is that you can purposefully make binaries with
> alterior motives have the same md5.

That's very interesting. Where did you get this from ?? Any examples ?
--
"XML is basically the subset of SGML
that Microsoft's developers could understand." Dan Lyke

Very Computer

Security Scanning: COPS vs. Tripwire vs. built-in?

Security Scanning: COPS vs. Tripwire vs. built-in?

Security Scanning: COPS vs. Tripwire vs. built-in?

Security Scanning: COPS vs. Tripwire vs. built-in?

Security Scanning: COPS vs. Tripwire vs. built-in?

Security Scanning: COPS vs. Tripwire vs. built-in?

Security Scanning: COPS vs. Tripwire vs. built-in?

Security Scanning: COPS vs. Tripwire vs. built-in?

Security Scanning: COPS vs. Tripwire vs. built-in?

Security Scanning: COPS vs. Tripwire vs. built-in?

Security Scanning: COPS vs. Tripwire vs. built-in?

Security Scanning: COPS vs. Tripwire vs. built-in?