IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
S 4.26 Regular security checks of the UNIX system
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrators
UNIX operating systems offer various security features as standard. However,
these only work if they are used appropriately. The settings required for this
purpose should be automatically checked by means of tools so that
- it is possible to detect and remedy any inconsistencies within a UNIX
system and
- the System Administrator is able to manage the UNIX operating system by
making optimum use of the existing security mechanisms.
Such checks can be made with programs available in the given UNIX system,
individually developed shell scripts or PD programs. For some UNIX variants,
commercial programs are available as well.
Examples
- pwck
This is one of the standard operating system commands. With this
command, a consistency check is made of the /etc/passwd file. A check is
performed as to whether all required entries have been made, whether there
is a log-in directory for the user, and whether the log-in program is in
existence. Similar functions are provided under Solaris by the logins
command, which enables accounts without passwords to be located.
- grpck
With this command, a consistency check is made of the /etc/group file.
This command is also one of the standard operating system commands. A
check is performed as to whether all required entries have been made,
whether the members of a group are actually included in the user password
file and whether the group number tallies with the number given in that
file.
- tripwire
This program enables integrity checks of files to be carried out. Checksums
of files are created and stored in a database. Various free of charge versions
of tripwire are available.
- cops
This public domain program serves to check the security of UNIX systems,
for example various system settings, access rights, SUID files etc, are
checked and potential security loopholes are identified.
- tiger
This public domain program enables UNIX systems to be checked for
security weaknesses. The program is similar in operation to cops.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Use tools