Interesting File Discovery Tool version 0.5
Monday Jul 30, 2007
As promised, I have uploaded version 0.5 of the Interesting File Discovery Tool (or ifd for short). This update includes fixes and enhancements that were contributed by Perley and Joe Moore. Thank you both for your contributions!
The biggest change in this version is the introduction of the -D parameter which enables you to change the program used to calculate the file digests (or fingerprints):
# ./ifd-v0.5.sh -h
./ifd-v0.5.sh - Interesting File Discovery Tool
ifd -[ugnw] [-ds] [-q] [-D cmd] { -c | -l | [Solaris Product Directory] }
-c Collect information from /var/sadm/install/contents
-d Calculate MD5 digest for each file (Solaris 10 only)
-D Command used to calculate file fingerprint
-g Print information on files with the set-gid bit set
-h Display this message
-l Collect information from /var/sadm/pkg
-n Print information on WW directories without sticky bit set
-q Quiet mode. Do not print headers.
-s Validate ELF file signature for each file (Solaris 10 only)
-u Print information on files with the set-uid bit set
-w Print information on world writable files and directories
-? Display this message
This can be useful in cases where you are running the tool on earlier releases of Solaris that do not have the integrated digest command or in cases where you want to use a different algorithm. For example, with this change, you could tell ifd to create SHA-512 fingerprints:
Set-UID Programs
SUNWaccu 4755 root adm 29478dd7ebde1555eaef0987789094cc778794ee73ddcfb0a67c44004f93652f599dd7276342f8113cc4e58f877e883b4687c4ca0f30f0585dd725ddaffeb0b7 /usr/lib/acct/accton
# ./ifd-v0.5.sh -c -D "/usr/bin/digest -a sha512" -d -u
SUNWbip 4555 root bin 95c814f7ff9606e0dc8818b51dacf74e92e5b3af329d66dc6fc8343c20ae741c1cea758568a318713ce6aacb35d1605bd6ee0911cdd2457aa85ceed363d17326 /usr/sbin/ping
SUNWbnuu 4511 root uucp 540f94a7054233498f1925aceef3c69b76300141ef38acc920ae005287db5546a03daef37c19b98149e11a26c7b4da137788e45cf642a3449345f635d8dbf762 /usr/bin/ct
SUNWbnuu 4511 uucp uucp 1754a7f7aaea60f4a1d1ca1915af30bc0157333061c096088bd3b719d008167f603380fae5b417a237cc9fe8c4cdcf524b22c61a471d0a06df5188cabedb475c /usr/bin/uuglist
[...]
Pretty neat. Thanks again to Perley and Joe for their feedback and support! To everyone - give this new version a shot and let me know what you think.
Take care,
Glenn
Technorati Tag: OpenSolaris Solaris security
Posted at 01:14PM Jul 30, 2007 by gbrunett in Solaris 10 Security Tags: opensolaris security software solaris tool-ifd
