Re: [gentoo-security] tripwire policy generator

[Andrew Gaffney]

Michel Wilson wrote:
> On Thu, Mar 25, 2004 at 10:32:05AM -0600, Andrew Gaffney wrote:
>
>>Michel Wilson wrote:
>>I tried to write a Perl script to do this, but I ran into problems. Of
>>course, that was when I'd only been using Perl for 3 months. I'd probably
>>be able to do it better now. One thing I was having problems with was
>>binaries that had been prelinked. If you run prelink a certain way, it can
>>give you the MD5SUM of the original binary, which is what portage does when
>>unmerging a package. It didn't always work right for me, though. Maybe I'll
>>try again.
>
> Well, as you said, it is possible to get the original md5sum, so the
> integrity-checker should be able to do this as well.

I'm probably gonna start on a rewrite of my scanner that can handle a non-prelinked system 
just fine. When that's working, I'll add in prelink support. Something like:

if($portagefilemd5 ne $justcheckedmd5) {
   $prelinkmd5 = `prelink --md5 $currentfile`;
   chomp $prelinkmd5;
   if($prelinkmd5 ne $portagefilemd5) {
     print "MODIFIED FILE: $currentfile\n";
   }
}

>>>The major advantage of this integrated system would be that the integrity
>>>information can be automatically updated if the user installs a new
>>>package. Normally, with Tripwire, system maintenance is a nuisance. Every
>>>time a new package is installed, Tripwire will generate false alarms.
>>>Or, at least, when I used it it did, because I always forgot to update
>>>the database...
>>
>>That's the problem with using tripwire on a Gentoo system. It's meant for a
>>system that doesn't change, which obviously isn't Gentoo. What if someone
>>compromises your system after your last run of tripwire (not the updater)
>>and before when you emerge a package and update the database. The
>>compromise would go unnoticed.
>
> Good point. Well, then we should check the package before upgrading it,
> or check each file before we overwrite it with a new file. The first is
> probably the easiest, but then there might be a very theoretical chance
> that a file is overwritten which didn't belong to the old version of the
> package. I don't know if such a situation would ever happen, though.

Should it really be this difficult to get something like tripwire to work properly? Gentoo 
needs a custom tripwire-ish program that can take advantage of portage's MD5SUM's and 
mtime's on all installed files. A scanner could even be added to portage as a FEATURE. 
While a program like this wouldn't catch intrusions involving non-portage-installed data 
files, it would catch any replaced/modified binaries/scripts. Although, there would need 
to be a configuration option to disable warnings on files in /etc since those are usually 
modified after they are installed by portage. Or even better, there could be an option to 
the program that would scan for changes in /etc and update portage's MD5SUM of the files.

-- 
Andrew Gaffney
Network Administrator
Skyline Aeronautics, LLC.
636-357-1548


--
gentoo-security@g.o mailing list