mtree vs tripwire
Adrian Filipi
adrian+freebsd-security at ubergeeks.com
Thu Jan 15 22:09:23 PST 2004
On Wed, 14 Jan 2004, D J Hawkey Jr wrote:
> On Jan 14, at 07:09 PM, Jesper Louis Andersen wrote:
> >
> > > This might seem really naive, but can mtree be used effectively as
> > > a native-to-core-OS tripwire equivalent? Would it be as efficient in
> > > terms of time-to-run and resource requirements?
> >
> > Pro: distributed with base
> > Con: Only available for *BSD architectures as far as my knowledge goes.
>
> I'm aware of both, yes; hence my question. FreeBSD is all I'm dealing
> with, where my question is concerned.
>
> Is your reply from personal experience, or is it the same "Hey, it
> could..." as is my question? If the former, would you elaborate on the
> implementation details?
>
> Thanks,
> Dave
The company I just left makes a security appliance, and we
developed an mtree-based IDS. As others have mentioned, raw mtree and diff
as-is leaves a lot to be desired. It's just not very conveneint.
That being said, its works great now that we wrapped it all up in
some wrapper scripts.
Adrian
--
[ adrian at ubergeeks.com ]
More information about the freebsd-security
mailing list