Less known Solaris features: BART

I'm a member of

Quicksearch

Codenews Search

Disclaimer

The individual owning this blog works for Oracle in Germany. The opinions expressed here are his own, are not necessarily reviewed in advance by anyone but the individual author, and neither Oracle nor any other party necessarily agrees with them.

Navigation

< Less known Solaris features: Auditing | Less known Solaris features: RBAC and Privileges - Part 1: Introduction >

Less known Solaris features: BART

Saturday, February 2. 2008

Apropos auditing. There is a small but cool tool in Solaris. It solves the problem of "No, i haven´t changed anything on the system". It´s called BART, the Basic Audit Reporting Tool. It a really simple tool and it´s really easy to use.

Usage
Okay, let´s assume after some days of work you finally configured all components of your new system. Okay, create a nice place to store the output of the bart tool. After this you start bart for the first time to create the first manifest of your system.

# mkdir /bart-files # bart create -R /etc > /bart-files/etc.control.manifest

The manifest stores all informations about the files. This is the example for the /etc/nsswitch.nisplus:

# cat etc.control.manifest | grep "/nsswitch.nisplus" /nsswitch.nisplus F 2525 100644 user::rw-,group::r--,mask:r--,other:r-- 473976b5 0 3 79e8fd689a5221d1cd059e5077da71b8

Now lets change some files:

# touch /etc/thisisjustatest # chmod 777 /etc/nsswitch.files # echo "#just a test" >> /etc/nsswitch.nisplus

Okay, enough changes. Let´s create a new manifest of the changed /etc. Pipe it to a different file.

# bart create -R /etc > /bart-files/etc.check20080202.manifest

Now we can compare the baseline manifest with the actual manifest.

# cd /bart-files # bart compare etc.control.manifest etc.check20080202.manifest

This command prints all differences between the two manifests and thus the difference between the tow states of the system

/nsswitch.files: mode control:100644 test:100777 acl control:user::rw-,group::r--,mask:r--,other:r-- test:user::rwx,group::rwx,mask:rwx,other:rwx /nsswitch.nisplus: size control:2525 test:2538 mtime control:473976b5 test:47a44862 contents control:79e8fd689a5221d1cd059e5077da71b8 test:3f79176ec352441db11ec8a3d02ef67c /thisisjustatest: add

As i wrote before: A really nice tool.

Want to learn more?
For more information about this tool visit Using the Basic Audit Reporting Tool.

Posted by Joerg Moellenkamp in English at 17:17 | Comments (4) | Trackbacks (0)

Defined tags for this entry: lksf

, solaris

Related entries by tags:

View as PDF: This entry | This month | Full blog

Trackbacks

Trackback specific URI for this entry

bartlog
A while ago i wrote about the Basic Accounting and Reporting tool (BART) as a part LKSF tutorials. Ben Rockwood published a nice script to do automatic runs of BART with logging via syslog: Solaris Automated File Integrity Checking: bartlog.

Weblog: c0t0d0s0.org
Tracked: Jun 25, 11:43

PingBack

Weblog: blog.philipp-michels.de
Tracked: Jul 08, 09:38

Comments

Display comments as (Linear | Threaded)

We use bart to become BSI Grundschutz compliant, but bart is not available on Solaris versions earlier than Solaris 10, so we' still use tripwire on Solaris 9.

http://www.bsi.de/gshb/deutsch/m/m06031.htm

#1 Thorleif Wiik (Homepage) on 2008-02-03 18:22 (Reply)

What about aset(1m),
which has been available
since at least Solaris 2.4?
It appears to include
some tripwire-like
functionality, as well as
different levels of
tighter-than-usual
permissions it can set
(with varying impact).

#1.1 Richard Hamilton on 2008-02-07 11:17 (Reply)

bart...simpson

war spontan mein gedanke beim scannen durch die heldenblogs - heute ist das erlaubt, is fasching

coooool, solaris mit simpsons plugin juhu

c. damulla

#2 christian mueller (Homepage) on 2008-02-08 22:31 (Reply)

http://code.google.com/p/bart-scripts/

-- work in progress, may be useful in daily implementation

#3 BIT (Homepage) on 2008-04-16 10:45 (Reply)

Add Comment

Name
Email
Homepage
In reply to
Comment	E-Mail addresses will not be displayed and will only be used for E-Mail notifications. To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly. Enter the string from the spam-prevention image above: Standard emoticons like :-) and ;-) are converted to images. Enclosing asterisks marks text as bold (word), underscore are made via _word_.
	Remember Information? Subscribe to this entry