Date: Fri, 12 Jul 2002 09:55:41 -0500 (CDT) From: hawkeyd@visi.com (D J Hawkey Jr) To: freebsd-security@freebsd.org Subject: Re: Recommendations for filesystem integrity checkers? Message-ID: <200207121455.g6CEtfi78331@sheol.localdomain> In-Reply-To: <3D2EC5A9.2070305_rambo.simx.org@ns.sol.net> References: <20020712065459.GA24030_lupe-christoph.de@ns.sol.net> <3D2EC5A9.2070305_rambo.simx.org@ns.sol.net>
next in thread | previous in thread | raw e-mail | index | archive | help
In article <3D2EC5A9.2070305_rambo.simx.org@ns.sol.net>, listsub@rambo.simx.org writes: > Lupe Christoph wrote: >> Hi! >> >> Which filesystem integrity checkers do people use? I've found ports >> for aide, cksfv, integrit, l5, three versions of tripwire and yafic. >> (Feel free to point me to the ones I overlooked.) I did not find >> ports for fcheck and samhain (found on Debian). >> >> Since I don't have the time to assess them all, I would like to >> tap the collective experience of the FreeBSD security people. >> >> So which do you use, and why? >> >> Thanks for your time, >> Lupe Christoph > > Personally, I use aide. Its lightweight, easy to configure and > automate via scripts and it does exactly I want it to do. Doesn't mtree(8) fulfill the task? I have yet to try it. The nice thing - if it suits - is that it's part of the base OS. I've had good results with Tripwire, but setting the attributes for "dynamic" directories (/var/log in particular) took a little head- scratching. http://www.schlacter.net:8500/public/FreeBSD-STABLE_and_IPFILTER.html was a great aid. > R Dave -- Windows: "Where do you want to go today?" Linux: "Where do you want to go tomorrow?" FreeBSD: "Are you guys coming, or what?" To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200207121455.g6CEtfi78331>