Securing Files and Verifying File Integrity in Oracle ... · This table describes the commands for monitoring and securing files and directories. ... 8 Securing Files and Verifying

Part No: E37122July 2014

Securing Files and Verifying File Integrityin Oracle® Solaris 11.2

Copyright © 2002, 2014, Oracle and/or its affiliates. All rights reserved.

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws.Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute,exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law forinteroperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:

U.S. GOVERNMENT END USERS. Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation,delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplementalregulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed onthe hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerousapplications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to takeall appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by useof this software or hardware in dangerous applications.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarksof SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is aregistered trademark of The Open Group.

This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliatesare not responsible or and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will notbe responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.

Copyright © 2002, 2014, Oracle et/ou ses affiliés. Tous droits réservés.

Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisationet de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modifier, breveter, transmettre, distribuer,exposer, exécuter, publier ou afficher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à touteingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des fins d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi.

Les informations fournies dans ce document sont susceptibles de modification sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs etvous invite, le cas échéant, à lui en faire part par écrit.

Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilisepour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique:

U.S. GOVERNMENT END USERS. Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation,delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplementalregulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed onthe hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S.Government.

Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destinéà être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadred’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisationdans des conditions optimales de sécurité. Oracle Corporation et ses affiliés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matérielpour ce type d’applications.

Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses affiliés. Tout autre nom mentionné peut correspondre à des marques appartenant à d’autrespropriétaires qu’Oracle.

Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marquesdéposées de SPARC International, Inc. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. UNIXest une marque déposée d’The Open Group.

Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanantde tiers. Oracle Corporation et ses affiliés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, OracleCorporation et ses affiliés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ouservices tiers, ou à leur utilisation.

3

Contents

Using This Documentation .................................................................................. 5

1 Controlling Access to Files ............................................................................. 7Using UNIX Permissions to Protect Files ............................................................ 7

Commands for Viewing and Securing Files .................................................. 7File and Directory Ownership .................................................................... 8UNIX File Permissions ............................................................................. 8Special File Permissions Using setuid, setgid and Sticky Bit ......................... 9Default umask Value ............................................................................... 11File Permission Modes ............................................................................ 12

Using Access Control Lists to Protect UFS Files ................................................. 14Protecting Executable Files From Compromising Security ..................................... 14Protecting Files .............................................................................................. 15

Protecting Files With UNIX Permissions .................................................... 15▼ How to Display File Information ......................................................... 15▼ How to Change the Owner of a File ..................................................... 17▼ How to Change Group Ownership of a File ........................................... 18▼ How to Change File Permissions in Symbolic Mode ................................ 18▼ How to Change File Permissions in Absolute Mode ................................ 19▼ How to Change Special File Permissions in Absolute Mode ...................... 21Protecting Against Programs With Security Risk ......................................... 22▼ How to Find Files With Special File Permissions .................................... 22▼ How to Disable Programs From Using Executable Stacks ......................... 23

2 Verifying File Integrity by Using BART .......................................................... 25About BART ................................................................................................. 25

BART Features ...................................................................................... 25BART Components ................................................................................ 26

About Using BART ........................................................................................ 27BART Security Considerations ................................................................. 27

Contents

4 Securing Files and Verifying File Integrity in Oracle Solaris 11.2 • July 2014

Using BART ......................................................................................... 28▼ How to Create a Control Manifest ....................................................... 28▼ How to Customize a Manifest ............................................................. 30▼ How to Compare Manifests for the Same System Over Time ..................... 31▼ How to Compare Manifests From Different Systems ............................... 33▼ How to Customize a BART Report by Specifying File Attributes ............... 36▼ How to Customize a BART Report by Using a Rules File ......................... 36

BART Manifests, Rules Files, and Reports ......................................................... 37BART Manifest File Format .................................................................... 38BART Rules File Format ........................................................................ 39BART Reporting .................................................................................... 40

Glossary ............................................................................................................. 43

Index .................................................................................................................. 57

Using This Documentation 5

Using This Documentation

■ Overview – Describes how to protect legitimate files, view hidden file permissions, andlocate and prevent the execution of rogue files. Also describes how to verify the integrityof files over time on Oracle Solaris systems.

■ Audience – System administrators.■ Required knowledge – Site security requirements.

Product Documentation Library

Late-breaking information and known issues for this product are included in the documentationlibrary at http://www.oracle.com/pls/topic/lookup?ctx=E36784.

Access to Oracle Support

Oracle customers have access to electronic support through My Oracle Support. Forinformation, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.

Feedback

Provide feedback about this documentation at http://www.oracle.com/goto/docfeedback.

http://www.oracle.com/pls/topic/lookup?ctx=E36784

http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info

http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs

http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs

http://www.oracle.com/goto/docfeedback


Chapter 1 • Controlling Access to Files 7

1 ♦ ♦ ♦ C H A P T E R 1

Controlling Access to Files

This chapter describes how to protect files in Oracle Solaris. The chapter also describes how toprotect the system from files whose permissions could compromise the system.

Note - ZFS is the default OS file system. To protect ZFS files with access control lists (ACLs),see Chapter 7, “Using ACLs and Attributes to Protect Oracle Solaris ZFS Files,” in “ManagingZFS File Systems in Oracle Solaris 11.2 ”.

This chapter covers the following topics:

■ “Using UNIX Permissions to Protect Files” on page 7■ “Protecting Executable Files From Compromising Security” on page 14■ “Protecting Files With UNIX Permissions” on page 15■ “Protecting Against Programs With Security Risk” on page 22

Using UNIX Permissions to Protect Files

You can secure files through UNIX file permissions and through ACLs. Files with sticky bits,and files that are executable, require special security measures.

Commands for Viewing and Securing FilesThis table describes the commands for monitoring and securing files and directories.

TABLE 1-1 Commands for Securing Files and Directories

Command Description Man Page

ls Lists the files in a directory and information about the files. ls(1)

chown Changes the ownership of a file. chown(1)

http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=ZFSADMINftyxi


http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=REFMAN1ls-1

http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=REFMAN1chown-1



Command Description Man Page

chgrp Changes the group ownership of a file. chgrp(1)

chmod Changes permissions on a file. You can use either symbolic mode, which usesletters and symbols, or absolute mode, which uses octal numbers, to changepermissions on a file.

chmod(1)

File and Directory Ownership

Traditional UNIX file permissions can assign ownership to three classes of users:

■ user – The file or directory owner, which is usually the user who created the file. Theowner of a file can decide who has the right to read the file, to write to the file (makechanges to it), or, if the file is a command, to execute the file.

■ group – Members of a group of users.■ others – All other users who are not the file owner and are not members of the group.

The owner of the file can usually assign or modify file permissions. Additionally, the rootaccount can change a file's ownership. To override system policy, see Example 1-2.

A file can be one of seven types. Each type is displayed by a symbol:

- (Minus symbol) Text or program

b Block special file

c Character special file

d Directory

l Symbolic link

s Socket

D Door

P Named pipe (FIFO)

UNIX File Permissions

The following table lists and describes the permissions that you can give to each class of userfor a file or directory.

http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=REFMAN1chgrp-1

http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=REFMAN1chmod-1



TABLE 1-2 File and Directory Permissions

Symbol Permission Object Description

r Read File Designated users can open and read the contents of a file.

Directory Designated users can list files in the directory.

w Write File Designated users can modify the contents of the file or delete the file.

Directory Designated users can add files or add links in the directory. They can alsoremove files or remove links in the directory.

x Execute File Designated users can execute the file, if it is a program or shell script. Theyalso can run the program with one of the exec(2) system calls.

Directory Designated users can open files or execute files in the directory. They also canmake the directory and the directories beneath it current.

- Denied File andDirectory

Designated users cannot read, write, or execute the file.

These file permissions apply to regular files, and to special files such as devices, sockets, andnamed pipes (FIFOs).

For a symbolic link, the permissions that apply are the permissions of the file that the linkpoints to.

You can protect the files in a directory and its subdirectories by setting restrictive filepermissions on that directory. Note, however, that the root role has access to all files anddirectories on the system.

Special File Permissions Using setuid, setgid andSticky Bit

Three special types of permissions are available for executable files and public directories:setuid, setgid, and sticky bit. When these permissions are set, any user who runs thatexecutable file assumes the ID of the owner (or group) of the executable file.

You must be extremely careful when you set special permissions, because special permissionsconstitute a security risk. For example, a user can gain root capabilities by executing a programthat sets the user ID (UID) to 0, which is the UID of root. Also, all users can set specialpermissions for files that they own, which constitutes another security concern.

You should monitor your system for any unauthorized use of the setuid permissionand the setgid permission to gain root capabilities. A suspicious permission grantsownership of an administrative program to a user rather than to root or bin. To search for



and list all files that use this special permission, see “How to Find Files With Special FilePermissions” on page 22.

setuid Permission

When setuid permission is set on an executable file, a process that runs this file is grantedaccess on the basis of the owner of the file. The access is not based on the user who is runningthe executable file. This special permission allows a user to access files and directories that arenormally available only to the owner.

For example, the setuid permission on the passwd command makes it possible for users tochange passwords. A passwd command with setuid permission would resemble the following:

-r-sr-sr-x 1 root sys 56808 Jun 17 12:02 /usr/bin/passwd

This special permission presents a security risk. Some determined users can find a way tomaintain the permissions that are granted to them by the setuid process even after the processhas finished executing.

Note - The use of setuid permissions with the reserved UIDs (0-100) from a program mightnot set the effective UID correctly. Use a shell script, or avoid using the reserved UIDs withsetuid permissions.

setgid Permission

The setgid permission is similar to the setuid permission. The process's effective groupID (GID) is changed to the group that owns the file, and a user is granted access based onthe permissions that are granted to that group. The /usr/bin/mail command has setgidpermissions:

-r-x--s--x 1 root mail 71212 Jun 17 12:01 /usr/bin/mail

When the setgid permission is applied to a directory, files that are created in this directorybelong to the group that owns the directory. The files do not belong to the group to which thecreating process belongs. Any user who has write and execute permissions in the directory cancreate a file there. However, the file belongs to the group that owns the directory, not to thegroup that the user belongs to.

You should monitor your system for any unauthorized use of the setgid permission to gainroot capabilities. A suspicious permission grants group access to such a program to an unusual



group rather than to root or bin. To search for and list all files that use this permission, see“How to Find Files With Special File Permissions” on page 22.

Sticky Bit

The sticky bit is a permission bit that protects the files within a directory. If the directory has thesticky bit set, a file can be deleted only by the file owner, the directory owner, or by a privilegeduser. The root user is an example of a privileged user. The sticky bit prevents a user fromdeleting other users' files from public directories such as /tmp:

drwxrwxrwt 7 root sys 400 Sep 3 13:37 tmp

Be sure to set the sticky bit manually when you set up a public directory on a TMPFS filesystem. For instructions, see Example 1-5.

Default umask Value

When you create a file or directory, you create it with a default set of permissions. The systemdefaults are open. A text file has 666 permissions, which grants read and write permission toeveryone. A directory and an executable file have 777 permissions, which grants read, write,and execute permission to everyone. Typically, users override the system defaults in their shellinitialization files, such as .bashrc and .kshrc.user. An administrator can also set defaults inthe /etc/profile file.

The value that the umask command assigns is subtracted from the default. This process hasthe effect of denying permissions in the same way that the chmod command grants them. Forexample, the chmod 022 command grants write permission to group and others. The umask 022command denies write permission to group and others.

The following table shows some typical umask values and their effect on an executable file.

TABLE 1-3 umask Settings for Different Security Levels

Level of Security umask Setting Permissions Disallowed

Permissive (744) 022 w for group and others

Moderate (751) 026 w for group, rw for others

Strict (740) 027 w for group, rwx for others

Severe (700) 077 rwx for group and others

For more information about setting the umask value, see the umask(1) man page.

http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=REFMAN1umask-1



File Permission Modes

The chmod command enables you to change the permissions on a file. You must be root or theowner of a file or directory to change its permissions.

You can use the chmod command to set permissions in either of two modes:

■ Absolute Mode – Use numbers to represent file permissions. When you changepermissions by using the absolute mode, you represent permissions for each triplet by anoctal mode number. Absolute mode is the method most commonly used to set permissions.

■ Symbolic Mode – Use combinations of letters and symbols to add permissions or removepermissions.

The following table lists the octal values for setting file permissions in absolute mode. You usethese numbers in sets of three to set permissions for owner, group, and other, in that order. Forexample, the value 644 sets read and write permissions for owner, and read-only permissionsfor group and other.

TABLE 1-4 Setting File Permissions in Absolute Mode

Octal Value File Permissions Set Permissions Description

0 --- No permissions

1 --x Execute permission only

2 -w- Write permission only

3 -wx Write and execute permissions

4 r-- Read permission only

5 r-x Read and execute permissions

6 rw- Read and write permissions

7 rwx Read, write, and execute permissions

The following table lists the symbols for setting file permissions in symbolic mode. Symbolscan specify whose permissions are to be set or changed, the operation to be performed, and thepermissions that are being assigned or changed.

TABLE 1-5 Setting File Permissions in Symbolic Mode

Symbol Function Description

u who User (owner)



Symbol Function Description

g who Group

o who Others

a who All

= operator Assign

+ operator Add

- operator Remove

r permissions Read

w permissions Write

x permissions Execute

l permissions Mandatory locking, setgid bit is on, group execution bit is off

s permissions setuid or setgid bit is on

t permissions Sticky bit is on, execution bit for others is on

The who operator permissions designations in the function column specify the symbols thatchange the permissions on the file or directory.

who Specifies whose permissions are to be changed.

operator Specifies the operation to be performed.

permissions Specifies what permissions are to be changed.

You can set special permissions on a file in absolute mode or symbolic mode. However, youmust use symbolic mode to set or remove setuid permissions on a directory. In absolute mode,you set special permissions by adding a new octal value to the left of the permission triplet. SeeExample 1-5. The following table lists the octal values for setting special permissions on a file.

TABLE 1-6 Setting Special File Permissions in Absolute Mode

Octal Value Special File Permissions

1 Sticky bit

2 setgid

4 setuid

Using Access Control Lists to Protect UFS Files


Using Access Control Lists to Protect UFS Files

Traditional UNIX file protection provides read, write, and execute permissions for the threeuser classes: file owner, file group, and other. In a UFS file system, an access control list (ACL)provides better file security by enabling you to do the following:

■ Define file permissions for the file owner, the group, other, specific users and groups■ Define default permissions for each of the preceding categories

Note - For ACLs in the ZFS file system and ACLs on NFSv4 files, see Chapter 7, “Using ACLsand Attributes to Protect Oracle Solaris ZFS Files,” in “Managing ZFS File Systems in OracleSolaris 11.2 ”.

For example, if you want everyone in a group to be able to read a file, you can simply grantgroup read permissions on that file. However, if you want only one person in the group to beable to write to that file, you can use an ACL.

For more information about ACLs on UFS file systems, see System Administration Guide:Security Services for the Oracle Solaris 10 release.

Protecting Executable Files From Compromising Security

Programs read and write data on the stack. Typically, they execute from read-only portions ofmemory that are specifically designated for code. Some attacks that cause buffers on the stackto overflow try to insert new code on the stack and cause the program to execute it. Removingexecute permission from the stack memory prevents these attacks from succeeding. That is,most programs can function correctly without using executable stacks.

64-bit processes always have non-executable stacks. By default, 32-bit SPARC processes haveexecutable stacks. The noexec_user_stack variable enables you to specify whether the stacksof 32-bit processes are executable.

Once this variable is set, programs that attempt to execute code on their stack are sent aSIGSEGV signal. This signal usually results in the program terminating with a core dump. Suchprograms also generate a warning message that includes the name of the offending program, theprocess ID, and the real UID of the user who ran the program. For example:

a.out[347] attempt to execute code on stack by uid 555

The message is logged by the syslog daemon when the syslog kern facility is set to noticelevel. This logging is set by default in the syslog.conf file, which means that the messageis sent to both the console and the /var/adm/messages file. For more information, see thesyslogd(1M) and syslog.conf(4) man pages.




http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=REFMAN1Msyslogd-1m

http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=REFMAN4syslog.conf-4

Protecting Files


The syslog message is useful for observing potential security problems. The message alsoidentifies valid programs that depend upon executable stacks that have been prevented fromcorrect operation by setting the noexec_user_stack variable. If you do not want any messageslogged, then set the log variable, noexec_user_stack_log, to zero in the /etc/system file.Even though messages are not being logged, the SIGSEGV signal can continue to cause theexecuting program to terminate with a core dump.

Programs can explicitly mark or prevent stack execution. The mprotect function in programsexplicitly marks the stack as executable. For more information, see the mprotect(2) manpage. A program compiled with -M /usr/lib/ld/map.noexstk makes the stack non-executableregardless of the system-wide setting.

Protecting Files

The following procedures protect files with UNIX permissions, locate files with security risks,and protect the system from compromise by these files.

Protecting Files With UNIX Permissions

The following task map points to procedures that list file permissions, change file permissions,and protect files with special file permissions.

Task For Instructions

Display file information. “How to Display File Information” on page 15

Change local file ownership. “How to Change the Owner of a File” on page 17

“How to Change Group Ownership of a File” on page 18

Change local file permissions. “How to Change File Permissions in Symbolic Mode” on page 18

“How to Change File Permissions in Absolute Mode” on page 19

“How to Change Special File Permissions in Absolute Mode” on page 21

How to Display File Information

Display information about all the files in a directory by using the ls command.

http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=REFMAN2mprotect-2

How to Display File Information


Type the following command to display a long listing of all files in the currentdirectory.

% ls -la

-l Displays the long format that includes user ownership, group ownership,and file permissions.

-a Displays all files, including hidden files that begin with a dot (.).

For all options to the ls command, see the ls(1) man page.

Example 1-1 Displaying File Information

In the following example, a partial list of the files in the /sbin directory is displayed.

% cd /sbin

% ls -ltotal 4960

-r-xr-xr-x 1 root bin 12756 Dec 19 2013 6to4relay

lrwxrwxrwx 1 root root 10 Dec 19 2013 accept -> cupsaccept

-r-xr-xr-x 1 root bin 38420 Dec 19 2013 acctadm

-r-xr-xr-x 2 root sys 70512 Dec 19 2013 add_drv

-r-xr-xr-x 1 root bin 3126 Dec 19 2013 addgnupghome

drwxr-xr-x 2 root bin 37 Dec 19 2013 amd64

-r-xr-xr-x 1 root bin 2264 Dec 19 2013 applygnupgdefaults

-r-xr-xr-x 1 root bin 153 Dec 19 2013 archiveadm

-r-xr-xr-x 1 root bin 12644 Dec 19 2013 arp

.

.

.

Each line displays information about a file in the following order:

■ Type of file – For example, d. For list of file types, see “File and DirectoryOwnership” on page 8.

■ Permissions – For example, r-xr-xr-x. For description, see “File and DirectoryOwnership” on page 8.

■ Number of hard links – For example, 2.■ Owner of the file – For example, root.■ Group of the file – For example, bin.■ Size of the file, in bytes – For example, 12644.■ Date the file was created or the last date that the file was changed – For example, Dec 19

2013.■ Name of the file – For example, arp.


How to Change the Owner of a File


How to Change the Owner of a File

Before You Begin If you are not the owner of the file or directory, you must be assigned the Object AccessManagement rights profile. To change a file that is a public object, you must assume the rootrole.

For more information, see “Using Your Assigned Administrative Rights” in “Securing Usersand Processes in Oracle Solaris 11.2 ”.

1. Display the permissions on a local file.

% ls -l example-file-rw-r--r-- 1 janedoe staff 112640 May 24 10:49 example-file

2. Change the owner of the file.

# chown stacey example-file

3. Verify that the owner of the file has changed.

# ls -l example-file-rw-r--r-- 1 stacey staff 112640 May 26 08:50 example-file

To change permissions on NFS-mounted files, see Chapter 5, “Commands for ManagingNetwork File Systems,” in “Managing Network File Systems in Oracle Solaris 11.2 ”.

Example 1-2 Enabling Users to Change the Ownership of Their Own Files

Security Consideration – You need a good reason to change the setting of the rstchownvariable to zero. The default setting prevents users from listing their files as belonging to othersso as to bypass space quotas.

In this example, the value of the rstchown variable is set to zero in the /etc/system file. Thissetting enables the owner of a file to use the chown command to change the file's ownership toanother user. This setting also enables the owner to use the chgrp command to set the groupownership of a file to a group that the owner does not belong to. The change goes into effectwhen the system is rebooted.

set rstchown = 0

For more information, see the chown(1) and chgrp(1) man pages.

http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=OSSUPrbactask-28


http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=SVNFSrfsrefer-1

http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=SVNFSrfsrefer-1

http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=REFMAN1chown-1

http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=REFMAN1chgrp-1

How to Change Group Ownership of a File


How to Change Group Ownership of a File



1. Change the group ownership of a file.

% chgrp scifi example-file

For information about setting up groups, see Chapter 1, “About User Accounts and UserEnvironments,” in “Managing User Accounts and User Environments in Oracle Solaris 11.2 ”.

2. Verify that the group ownership of the file has changed.

% ls -l example-file-rw-r--r-- 1 stacey scifi 112640 June 20 08:55 example-file

Also see Example 1-2.

How to Change File Permissions in SymbolicMode

In the following procedure, a user changes permissions on a file that the user owns.

1. Change permissions in symbolic mode.

% chmod who operator permissions filename

who Specifies whose permissions are to be changed.

operator Specifies the operation to be performed.

permissions Specifies what permissions are to be changed. For the list of validsymbols, see Table 1-5.

filename Specifies the file or directory.

2. Verify that the permissions of the file have changed.

% ls -l filename



http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=ADUSRuserconcept-97366

http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=ADUSRuserconcept-97366

How to Change File Permissions in Absolute Mode


Note - If you are not the owner of the file or directory, you must be assigned the Object AccessManagement rights profile. To change a file that is a public object, you must assume the rootrole.

Example 1-3 Changing Permissions in Symbolic Mode

In the following example, the owner removes read permission others.

% chmod o-r example-file1

the following example, the owner adds read and execute permissions for user, group, andothers.

% chmod a+rx example-file2

In the following example, the owner adds read, write, and execute permissions for groupmembers.

% chmod g=rwx example-file3

How to Change File Permissions in AbsoluteMode

In the following procedure, a user changes permissions on a file that the user owns.

1. Change permissions in absolute mode.

% chmod nnn filename

nnn Specifies the octal values that represent the permissions for the fileowner, file group, and others, in that order. For the list of valid octalvalues, see Table 1-4.


How to Change File Permissions in Absolute Mode


Note - If you use the chmod command to change file or directory permissions on objects thathave existing ACL entries, the ACL entries might change as well. The exact changes aredependent upon the chmod permission operation changes and the file system's aclmode andaclinherit property values.

For more information, see Chapter 7, “Using ACLs and Attributes to Protect Oracle Solaris ZFSFiles,” in “Managing ZFS File Systems in Oracle Solaris 11.2 ”.


% ls -l filename

Note - If you are not the owner of the file or directory, you must be assigned the Object AccessManagement rights profile. To change a file that is a public object, you must assume the rootrole.

Example 1-4 Changing Permissions in Absolute Mode

In the following example, the administrator changes the permissions of a directory that is opento the public from 744 (read, write, execute; read-only; and read-only) to 755 (read, write,execute; read and execute; and read and execute).

# ls -ld public_dirdrwxr--r-- 1 jdoe staff 6023 Aug 5 12:06 public_dir

# chmod 755 public_dir

# ls -ld public_dirdrwxr-xr-x 1 jdoe staff 6023 Aug 5 12:06 public_dir

In the following example, the file owner changes the permissions of an executable shell scriptfrom read and write to read, write, and execute.

% ls -l my_script-rw------- 1 jdoe staff 6023 Aug 5 12:06 my_script

% chmod 700 my_script

% ls -l my_script-rwx------ 1 jdoe staff 6023 Aug 5 12:06 my_script



How to Change Special File Permissions in Absolute Mode


How to Change Special File Permissions inAbsolute Mode



1. Change special permissions in absolute mode.

% chmod nnnn filename

nnnn Specifies the octal values that change the permissions on the file ordirectory. The leftmost octal value sets the special permissions on thefile. For the list of valid octal values for special permissions, see Table1-6.


Note - When you use the chmod command to change the file group permissions on a filewith ACL entries, both the file group permissions and the ACL mask are changed to the newpermissions. Be aware that the new ACL mask permissions can change the permissions foradditional users and groups who have ACL entries on the file. Use the getfacl command tomake sure that the appropriate permissions are set for all ACL entries. For more information,see the getfacl(1) man page.


% ls -l filename

Example 1-5 Setting Special File Permissions in Absolute Mode

In the following example, the administrator sets the setuid permission on the dbprog file.

# chmod 4555 dbprog

# ls -l dbprog-r-sr-xr-x 1 db staff 12095 May 6 09:29 dbprog

In the following example, the administrator sets the setgid permission on the dbprog2 file.

# chmod 2551 dbprog2

# ls -l dbprog2-r-xr-s--x 1 db staff 24576 May 6 09:30 dbprog2



http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=REFMAN1getfacl-1

How to Find Files With Special File Permissions


In the following example, the administrator sets the sticky bit on the public_dir directory.

# chmod 1777 public_dir

# ls -ld public_dirdrwxrwxrwt 2 jdoe staff 512 May 15 15:27 public_dir

Protecting Against Programs With Security Risk

The following task map points to procedures that find risky executables on the system, and thatprevent programs from exploiting an executable stack.

Task Description For Instructions

Find files with special permissions. Locates files with the setuid bit set, but thatare not owned by the root user.

“How to Find Files With Special FilePermissions” on page 22

Prevent executable stack from overflowing. Prevents programs from exploiting anexecutable stack.

“How to Disable Programs From UsingExecutable Stacks” on page 23

Prevent logging of executable stack messages. Turns off logging of executable stackmessages.

Example 1-7

How to Find Files With Special File Permissions

This procedure locates potentially unauthorized use of the setuid and setgid permissions onprograms. A suspicious executable file grants ownership to a user rather than to root or bin.

Before You Begin You must assume the root role. For more information, see “Using Your AssignedAdministrative Rights” in “Securing Users and Processes in Oracle Solaris 11.2 ”.

1. Find files with setuid permissions by using the find command.

# find directory -user root -perm -4000 -exec ls -ldb {} \; >/tmp/filename

find directory Checks all mounted paths starting at the specified directory, which can beroot (/), /usr, /opt, and so on.

-user root Displays files owned only by root.

-perm -4000 Displays files only with permissions set to 4000.

-exec ls -ldb Displays the output of the find command in ls -ldb format. See thels(1) man page.




How to Disable Programs From Using Executable Stacks


/tmp/filename Is the file that contains the results of the find command.

For more information, see the find(1).

2. Display the results in /tmp/filename.

# more /tmp/filename

For background information, see “setuid Permission” on page 10.

Example 1-6 Finding Files With setuid Permissions

The output from the following example shows that a user in a group called rar has made apersonal copy of /usr/bin/rlogin, and has set the permissions as setuid to root. As a result,the /usr/rar/bin/rlogin program runs with root permissions.

After investigating the /usr/rar directory and removing the /usr/rar/bin/rlogin command,the administrator archives the output from the find command.

# find /usr -user root -perm -4000 -exec ls -ldb {} \; > /var/tmp/ckprm

# cat /var/tmp/ckprm-rwsr-xr-x 1 root sys 28000 Jul 14 14:14 /usr/bin/atq

-rwsr-xr-x 1 root sys 32364 Jul 14 14:14 /usr/bin/atrm

-r-sr-xr-x 1 root sys 41432 Jul 14 14:14 /usr/bin/chkey

-rwsr-xr-x 1 root bin 82804 Jul 14 14:14 /usr/bin/cdrw

-r-sr-xr-x 1 root bin 8008 Jul 14 14:14 /usr/bin/mailq

-r-sr-sr-x 1 root sys 45348 Jul 14 14:14 /usr/bin/passwd

-rwsr-xr-x 1 root bin 37724 Jul 14 14:14 /usr/bin/pfedit

-r-sr-xr-x 1 root bin 51440 Jul 14 14:14 /usr/bin/rcp

---s--x--- 1 root rar 41592 Jul 24 16:14 /usr/rar/bin/rlogin

-r-s--x--x 1 root bin 166908 Jul 14 14:14 /usr/bin/sudo

-r-sr-xr-x 4 root bin 24024 Jul 14 14:14 /usr/bin/uptime

-r-sr-xr-x 1 root bin 79488 Jul 14 14:14 /usr/bin/xlock

# mv /var/tmp/ckprm /var/share/sysreports/ckprm

How to Disable Programs From Using ExecutableStacks

For a description of the security risks of 32-bit executable stacks, see “Protecting ExecutableFiles From Compromising Security” on page 14.


1. Edit the /etc/system file, and add the following lines:

http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=REFMAN1find-1



How to Disable Programs From Using Executable Stacks


# pfedit /etc/system...

set noexec_user_stack=1

set noexec_user_stack_log=1

2. Reboot the system.

# reboot

Example 1-7 Disabling the Logging of Executable Stack Messages

In this example, the administrator disables logging of executable stack messages, then rebootsthe system.

# cat /etc/systemset noexec_user_stack=1

set noexec_user_stack_log=0

# reboot

See Also For more information, read the following:

■ https://blogs.oracle.com/gbrunett/entry/solaris_non_executable_stack_overview■ https://blogs.oracle.com/gbrunett/entry/solaris_non_executable_stack_continued■ https://blogs.oracle.com/gbrunett/entry/solaris_non_executable_stack_concluded

https://blogs.oracle.com/gbrunett/entry/solaris_non_executable_stack_overview

https://blogs.oracle.com/gbrunett/entry/solaris_non_executable_stack_continued

https://blogs.oracle.com/gbrunett/entry/solaris_non_executable_stack_concluded

Chapter 2 • Verifying File Integrity by Using BART 25

2 ♦ ♦ ♦ C H A P T E R 2

Verifying File Integrity by Using BART

This chapter describes the file integrity tool, BART. BART is a command-line tool that enablesyou to verify the integrity of files on a system over time. This chapter covers the followingtopics:

■ “About BART” on page 25■ “About Using BART” on page 27■ “BART Manifests, Rules Files, and Reports” on page 37

About BART

BART is a file integrity scanning and reporting tool that uses cryptographic-strength checksumsand file system metadata to determine changes. BART can help you detect security breachesor troubleshoot performance issues on a system by identifying corrupted or unusual files.Using BART can reduce the costs of administering a network of systems by easily and reliablyreporting discrepancies in the files that are installed on deployed systems.

BART enables you to determine what file-level changes have occurred on a system, relative toa known baseline. You use BART to create a baseline or control manifest from a fully installedand configured system. You can then compare this baseline with a snapshot of the system at alater time, generating a report that lists file-level changes that have occurred on the system afterit was installed.

BART Features

BART uses simple syntax that is both powerful and flexible. The tool enables you to trackfile changes on a given system over time. You can also track file differences between similarsystems. Such comparisons can help you locate corrupted or unusual files, or systems whosesoftware is out of date.Additional benefits and uses of BART include the following:

About BART


■ You can specify which files to monitor. For example, you can monitor localcustomizations, which can assist you in reconfiguring software easily and efficiently.

■ You can troubleshoot system performance issues.

BART Components

BART creates two main files, a manifest and a comparison file, or report. An optional rules fileenables you to customize the manifest and report.

BART Manifest

A manifest is a file-level snapshot of a system at a particular time. The manifest containsinformation about attributes of files, which can include some uniquely identifying information,such as a checksum. Options to the bart create command can target specific files anddirectories. A rules file can provide more fine-grained filtering, as described in “BART RulesFile” on page 27.

Note - By default, BART catalogs all ZFS file systems under the root (/) directory. Other filesystem types, such as NFS or TMPFS file systems, and mounted CD-ROMs are cataloged.

You can create a manifest of a system immediately after an initial Oracle Solaris installation.You can also create a manifest after configuring a system to meet your site's security policy.This type of control manifest provides you with a baseline for later comparisons.

A baseline manifest can be used to track file integrity on the same system over time. It can alsobe used as a basis for comparison with other systems. For example, you could take a snapshotof other systems on your network and then compare those manifests with the baseline manifest.Reported file discrepancies indicate what you need to do to synchronize the other systems withthe baseline system.

For the format of a manifest, see “BART Manifest File Format” on page 38. To createa manifest, use the bart create command, as described in “How to Create a ControlManifest” on page 28.

BART Report

A BART report lists per-file discrepancies between two manifests. A discrepancy is a change toany attribute for a given file that is cataloged for both manifests. Additions or deletions of fileentries are also considered discrepancies.

About Using BART


For a useful comparison, the two manifests must target the same file systems. You must alsocreate and compare the manifests with the same options and rules file.

For the format of a report, see “BART Reporting” on page 40. To create a report, use thebart compare command, as described in “How to Compare Manifests for the Same SystemOver Time” on page 31.

BART Rules File

A BART rules file is a file that you create to filter or target particular files and file attributes forinclusion or exclusion. You then use this file when creating BART manifests and reports. Whenyou compare manifests, the rules file aids in flagging discrepancies between the manifests.

Note - When you create a manifest by using a rules file, you must use the same rules file tocreate the comparison manifest. You must also use the rules file when comparing the manifests.Otherwise, the report would list many invalid discrepancies.

Using a rules file to monitor specific files and file attributes on a system requires planning.Before you create a rules file, decide which files and file attributes to monitor on the system.

As a result of user error, a rules file can also contain syntax errors and other ambiguousinformation. If a rules file has errors, these errors are also reported.

For the format of a rules file, see “BART Rules File Format” on page 39 and thebart_rules(4) man page. To create a rules file, see “How to Customize a BART Report byUsing a Rules File” on page 36.

About Using BART

The bart command is used to create and compare manifests. Any user can run this command.However, users can only catalog and monitor files that they have permission to access. So, usersand most roles can usefully catalog the files in their home directory, but the root account cancatalog all files, including system files.

BART Security Considerations

BART manifests and reports are readable by anyone. If BART output might contain sensitiveinformation, take appropriate measures to protect the output. For example, use options thatgenerate output files with restrictive permissions or place output files in a protected directory.

http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=REFMAN4bart-rules-4

How to Create a Control Manifest


Using BART

Task Description For Instructions

Create a BART manifest. Generates a list of information about every file that isinstalled on a system.

“How to Create a ControlManifest” on page 28

Create a custom BART manifest. Generates a list of information about specific files thatare installed on a system.

“How to Customize aManifest” on page 30

Compare BART manifests. Generates a report that compares changes to a systemover time.

Or, generates a report that compares one or severalsystems to a control system.

“How to Compare Manifestsfor the Same System OverTime” on page 31

“How to Compare Manifests FromDifferent Systems” on page 33

(Optional) Customize a BARTreport.

Generates a custom BART report in one of the followingways:

■ By specifying attributes■ By using a rules file

“How to Customize a BARTReport by Specifying FileAttributes” on page 36

“How to Customize a BART Report byUsing a Rules File” on page 36


This procedure explains how to create a baseline, or control, manifest for comparison. Use thistype of manifest when you are installing many systems from a central image. Or, use this typeof manifest to run comparisons when you want to verify that the installations are identical. Formore information about control manifests, see “BART Manifest” on page 26. To understandthe format conventions, see Example 2-1.

Note - Do not attempt to catalog networked file systems. Using BART to monitor networkedfile systems consumes large resources to generate manifests of little value.


1. After customizing your Oracle Solaris system to your site's securityrequirements, create a control manifest and redirect the output to a file.

# bart create options > control-manifest





-R Specifies the root directory for the manifest. All paths specified by therules are interpreted relative to this directory. All paths reported in themanifest are relative to this directory.

-I Accepts a list of individual files to be cataloged, either on the commandline or read from standard input.

-r Is the name of the rules file for this manifest. A - argument reads therules file from standard input.

-n Turns off content signatures for all regular files in the file list. Thisoption can be used to improve performance. Or, you can use this optionif the contents of the file list are expected to change, as in the case ofsystem log files.

2. Examine the contents of the manifest.

For an explanation of the format, see Example 2-1.

3. (Optional) Protect the manifest.

One way to protect system manifests is to place them in a directory that only the root accountcan access.

# mkdir /var/adm/log/bartlogs# chmod 700 /var/adm/log/bartlogs# mv control-manifest /var/adm/log/bartlogs

Choose a meaningful name for the manifest. For example, use the system name and date thatthe manifest was created, as in mach1-120313.

Example 2-1 Explanation of the BART Manifest Format

In this example, an explanation of the manifest format follows the sample output.

# bart create! Version 1.1

! HASH SHA256

! Saturday, September 07, 2013 (22:22:27)

# Format:

#fname D size mode acl dirmtime uid gid

#fname P size mode acl mtime uid gid

#fname S size mode acl mtime uid gid

#fname F size mode acl mtime uid gid contents

#fname L size mode acl lnmtime uid gid dest

#fname B size mode acl mtime uid gid devnode

#fname C size mode acl mtime uid gid devnode

/ D 1024 40755 user::rwx,group::r-x,mask:r-x,other:r-x

3ebc418eb5be3729ffe7e54053be2d33ee884205502c81ae9689cd8cca5b0090 0 0

.

How to Customize a Manifest


.

.

/zone D 512 40755 user::rwx group::r-x,mask:r-x,other:r-x 3f81e892

154de3e7bdfd0d57a074c9fae0896a9e2e04bebfe5e872d273b063319e57f334 0 0

.

.

.

Each manifest consists of a header and file entries. Each file entry is a single line, depending onthe file type. For example, for each file entry in the preceding output, type F specifies a file andtype D specifies a directory. Also listed is information about size, content, user ID, group ID,and permissions. File entries in the output are sorted by the encoded versions of the file namesto correctly handle special characters. All entries are sorted in ascending order by file name. Allnonstandard file names, such as those that contain embedded newline or tab characters, quotethe nonstandard characters before sorting.

Lines that begin with ! supply metadata about the manifest. The manifest version line indicatesthe manifest specification version. The hash line indicates the hash mechanism that was used.For more information about the SHA256 hash that is used as a checksum, see the sha2(3EXT)man page.

The date line shows the date on which the manifest was created, in date form. See the date(1)man page. Some lines are ignored by the manifest comparison tool. Ignored lines includemetadata, blank lines, lines that consist only of white space, and comments that begin with #.

How to Customize a Manifest

You can customize a manifest in one of the following ways:

■ By specifying a subtreeSpecifying an individual subtree is an efficient way to monitor changes to selected,important files, such as all files in the /etc directory.

■ By specifying a file nameSpecifying a file name is an efficient way of monitoring particularly sensitive files, such asthe files that configure and run a database application.

■ By using a rules fileBy using a rules file to create and compare manifests gives you the flexibility to specifymultiple attributes for more than one file or subtree. From the command line, you canspecify a global attribute definition that applies to all files in a manifest or report. From arules file, you can specify attributes that do not apply globally.


http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=REFMAN3Dsha2-3ext

http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=REFMAN1date-1



How to Compare Manifests for the Same System Over Time


1. Determine which files to catalog and monitor.

2. Create a custom manifest by using one of the following options:

■ By specifying a subtree:

# bart create -R subtree

■ By specifying a file name or file names:

# bart create -I filename...

For example:

# bart create -I /etc/system /etc/passwd /etc/shadow

■ By using a rules file:

# bart create -r rules-file

3. Examine the contents of the manifest.

4. (Optional) Save the manifest in a protected directory for future use.

For an example, see Step 3 in “How to Create a Control Manifest” on page 28.

Tip - If you used a rules file, save the rules file with the manifest. For a useful comparison, youmust run the comparison with the rules file.

How to Compare Manifests for the Same SystemOver TimeBy comparing manifests over time, you can locate corrupted or unusual files, detect securitybreaches, and troubleshoot performance issues on a system.


1. Create a control manifest of the files to monitor on the system.

# bart create -R /etc > control-manifest



3. At a later time, prepare an identical manifest to the control manifest.



How to Compare Manifests for the Same System Over Time


# bart create -R /etc > test-manifest

4. Protect the second manifest.

# mv test-manifest /var/adm/log/bartlogs

5. Compare the two manifests.

Use the same command-line options and rules file to compare the manifests that you used tocreate them.

# bart compare options control-manifest test-manifest > bart-report

6. Examine the BART report for oddities.

Example 2-2 Tracking File Changes for the Same System Over Time

This example shows how to track the changes in the /etc directory over time. This type ofcomparison enables you to locate important files on the system that have been compromised.

■ Create a control manifest.

# cd /var/adm/logs/manifests

# bart create -R /etc > system1.control.090713

! Version 1.1

! HASH SHA256


# Format:








/.cpr_config F 2236 100644 owner@:read_data/write_data/append_data/read_xattr/wr

ite_xattr/read_attributes/write_attributes/read_acl/write_acl/write_owner/synchr

onize:allow,group@:read_data/read_xattr/read_attributes/read_acl/synchronize:all

ow,everyone@:read_data/read_xattr/read_attributes/read_acl/synchronize:allow

4e271c59 0 0 3ebc418eb5be3729ffe7e54053be2d33ee884205502c81ae9689cd8cca5b0090

/.login F 1429 100644 owner@:read_data/write_data/append_data/read_xattr/write_x

attr/read_attributes/write_attributes/read_acl/write_acl/write_owner/synchronize

:allow,group@:read_data/read_xattr/read_attributes/read_acl/synchronize:allow,ev

eryone@:read_data/read_xattr/read_attributes/read_acl/synchronize:allow

4bf9d6d7 0 3 ff6251a473a53de68ce8b4036d0f569838cff107caf1dd9fd04701c48f09242e

.

.

How to Compare Manifests From Different Systems


.

■ Later, create a test manifest by using the same command-line options.

# bart create -R /etc > system1.test.101013

Version 1.1

! HASH SHA256

! Monday, October 10, 2013 (10:10:17)

# Format:








/.cpr_config F 2236 100644 owner@:read_data/write_data/append_data/read_xattr/wr

ite_xattr/read_attributes/write_attributes/read_acl/write_acl/write_owner/synchr

onize:allow,group@:read_data/read_xattr/read_attributes/read_acl/synchronize:all

ow,everyone@:read_data/read_xattr/read_attributes/read_acl/synchronize:allow

4e271c59 0 0 3ebc418eb5be3729ffe7e54053be2d33ee884205502c81ae9689cd8cca5b0090

.

.

.

■ Compare the manifests.

# bart compare system1.control.090713 system1.test.101013

/security/audit_class

mtime 4f272f59

The output indicates that the modification time on the audit_class file has changed since thecontrol manifest was created. If this change is unexpected, you can investigate further.

How to Compare Manifests From DifferentSystemsBy comparing manifests from different systems, you can determine if the systems are installedidentically or have been upgraded in synch. For example, if you customized your systems toa particular security target, this comparison finds any discrepancies between the manifest thatrepresents your security target, and the manifests from the other systems.


1. Create a control manifest.





# bart create options > control-manifest

For the options, see the bart(1M) man page.



3. On the test system, use the same bart options to create a manifest.

# bart create options > test1-manifest


5. To perform the comparison, copy the manifests to a central location.

For example:

# cp control-manifest /net/test-server/var/adm/logs/bartlogs

If the test system is not an NFS-mounted system, use sftp or another reliable means to copy themanifests to a central location.

6. Compare the manifests and redirect the output to a file.

# bart compare control-manifest test1-manifest > test1.report


Example 2-3 Identifying a Suspect File in the /usr/bin Directory

This example compares the contents of the /usr/bin directory on two systems.

■ Create a control manifest.

# bart create -R /usr/bin > control-manifest.090713

! Version 1.1

! HASH SHA256


# Format:








/2to3 F 105 100555 owner@:read_data/read_xattr/write_xattr/execute/read_attribut

es/write_attributes/read_acl/write_acl/write_owner/synchronize:allow,group@:read

http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=REFMAN1Mbart-1m



_data/read_xattr/execute/read_attributes/read_acl/synchronize:allow,everyone@:re

ad_data/read_xattr/execute/read_attributes/read_acl/synchronize:allow 4bf9d261 0

2 154de3e7bdfd0d57a074c9fae0896a9e2e04bebfe5e872d273b063319e57f334

/7z F 509220 100555 owner@:read_data/read_xattr/write_xattr/execute/read_attribu

tes/write_attributes/read_acl/write_acl/write_owner/synchronize:allow,group@:rea

d_data/read_xattr/execute/read_attributes/read_acl/synchronize:allow,everyone@:r

ead_data/read_xattr/execute/read_attributes/read_acl/synchronize:allow 4dadc48a 0

2 3ecd418eb5be3729ffe7e54053be2d33ee884205502c81ae9689cd8cca5b0090

...

■ Create an identical manifest for each system that you want to compare with the controlsystem.

# bart create -R /usr/bin > system2-manifest.101013

! Version 1.1

! HASH SHA256

! Monday, October 10, 2013 (10:10:22)

# Format:








/2to3 F 105 100555 owner@:read_data/read_xattr/write_xattr/execute/read_attribut

es/write_attributes/read_acl/write_acl/write_owner/synchronize:allow,group@:read

_data/read_xattr/execute/read_attributes/read_acl/synchronize:allow,everyone@:re

ad_data/read_xattr/execute/read_attributes/read_acl/synchronize:allow 4bf9d261 0

2 154de3e7bdfd0d57a074c9fae0896a9e2e04bebfe5e872d273b063319e57f334

...

■ Copy the manifests to the same location.

# cp control-manifest.090713 /net/system2.central/bart/manifests

■ Compare the manifests.

# bart compare control-manifest.090713 system2.test.101013 > system2.report

/su:

gid control:3 test:1

/ypcat:

mtime control:3fd72511 test:3fd9eb23

The output indicates that the group ID of the su file in the /usr/bin directory is not the sameas that of the control system. This information might indicate that a different version of thesoftware was installed on the test system. Because the GID is changed, the more likely reason isthat someone has tampered with the file.

How to Customize a BART Report by Specifying File Attributes


How to Customize a BART Report by SpecifyingFile Attributes

This procedure is useful to filter the output from existing manifests for specific file attributes.


1. Determine which file attributes to check.

2. Compare two manifests that contain the file attributes to be checked.

For example:

# bart compare -i lnmtime,mtime control-manifest.121513 \

test-manifest.010514 > bart.report.010514

Use a comma in the command-line syntax to separate each file attribute.


How to Customize a BART Report by Using aRules File

By using a rules file, you can customize a BART manifest for particular files and file attributesof interest. By using different rules files on default BART manifests, you can run differentcomparisons for the same manifests.


1. Determine which files and file attributes to monitor.

2. Create a rules file with the appropriate directives.

3. Create a control manifest with the rules file that you created.

# bart create -r myrules1-file > control-manifest



5. Create an identical manifest on a different system, at a later time, or both.





BART Manifests, Rules Files, and Reports


# bart create -r myrules1-file > test-manifest

6. Compare the manifests by using the same rules file.

# bart compare -r myrules1-file control-manifest test-manifest > bart.report


Example 2-4 Using a Rules File to Customize BART Manifests and the Comparison Report

The following rules file directs the bart create command to list all attributes of the files in the/usr/bin directory. In addition, the rules file directs the bart compare command to report onlysize and content changes in the same directory.

# Check size and content changes in the /usr/bin directory.

# This rules file only checks size and content changes.

# See rules file example.

IGNORE all

CHECK size contents

/usr/bin

■ Create a control manifest with the rules file that you created.

# bart create -r usrbinrules.txt > usr_bin.control-manifest.121013

■ Prepare an identical manifest whenever you want to monitor changes to the /usr/bindirectory.

# bart create -r usrbinrules.txt > usr_bin.test-manifest.121113

■ Compare the manifests by using the same rules file.

# bart compare -r usrbinrules.txt usr_bin.control-manifest.121013 \

usr_bin.test-manifest.121113

■ Examine the output of the bart compare command.

/usr/bin/gunzip: add

/usr/bin/ypcat:

delete

The preceding output indicates that the /usr/bin/ypcat file was deleted, and the /usr/bin/gunzip file was added.


This section describes the format of files that BART uses and creates.



BART Manifest File Format

Each manifest file entry is a single line, depending on the file type. Each entry begins withfname, which is the name of the file. To prevent parsing problems from special charactersembedded in file names, the file names are encoded. For more information, see “BART RulesFile Format” on page 39.

Subsequent fields represent the following file attributes:

type Type of file with the following possible values:■ B for a block device node■ C for a character device node■ D for a directory■ F for a file■ L for a symbolic link■ P for a pipe■ S for a socket

size File size in bytes.

mode Octal number that represents the permissions of the file.

acl ACL attributes for the file. For a file with ACL attributes, this containsthe output from acltotext.

uid Numerical user ID of the owner of this entry.

gid Numerical group ID of the owner of this entry.

dirmtime Last modification time, in seconds, since 00:00:00 UTC, January 1, 1970,for directories.

lnmtime Last modification time, in seconds, since 00:00:00 UTC, January 1, 1970,for links.

mtime Last modification time, in seconds, since 00:00:00 UTC January 1, 1970,for files.

contents Checksum value of the file. This attribute is only specified for regularfiles. If you turn off context checking, or if checksums cannot becomputed, the value of this field is -.

dest Destination of a symbolic link.



devnode Value of the device node. This attribute is for character device files andblock device files only.

For more information, see the bart_manifest(4) man page.

BART Rules File Format

Rules files are text files that consist of lines that specify which files are to be included in themanifest and which file attributes are to be included in the manifest or the report. Lines thatbegin with #, blank lines, and lines that contain white space are ignored by the tool.The input files have three types of directives:

■ Subtree directive, with optional pattern matching modifiers■ CHECK directive■ IGNORE directive

EXAMPLE 2-5 Rules File Format

<Global CHECK/IGNORE Directives>

<subtree1> [pattern1..]

<IGNORE/CHECK Directives for subtree1>




<IGNORE/CHECK Directives for subtree2, subtree3, subtree4>

Note - All directives are read in order. Later directives can override earlier directives.

A subtree directive must begin with an absolute pathname, followed by zero or more patternmatching statements.

BART Rules File Attributes

The CHECK and IGNORE statements define which file attributes to track or ignore. The metadatathat begins each manifest lists the attribute keywords per file type. See Example 2-1.

The all keyword indicates all file attributes.

http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=REFMAN4bart-manifest-4



BART Quoting Syntax

The rules file specification language that BART uses is the standard UNIX quoting syntax forrepresenting nonstandard file names. Embedded tab, space, newline, or special characters areencoded in their octal forms to enable the tool to read file names. This nonuniform quotingsyntax prevents certain file names, such as those containing an embedded carriage return, frombeing processed correctly in a command pipeline. The rules specification language allowsthe expression of complex file name filtering criteria that would be difficult and inefficient todescribe by using shell syntax alone.

For more information, see the bart_rules(4) man page.

BART Reporting

In default mode, a BART report checks all the files installed on the system, with the exceptionof modified directory timestamps (dirmtime):

CHECK all

IGNORE dirmtime

If you supply a rules file, then the global directives of CHECK all and IGNORE dirmtime, in thatorder, are automatically prepended to the rules file.

BART Output

The following exit values are returned:

0 Success

1 Nonfatal error when processing files, such as permission problems

>1 Fatal error, such as an invalid command-line option

The reporting mechanism provides two types of output: verbose and programmatic:

■ Verbose output is the default output and is localized and presented on multiple lines.Verbose output is internationalized and is human-readable. When the bart comparecommand compares two system manifests, a list of file differences is generated.The structure of the output is as follows:

filename attribute control:control-val test:test-val

http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=REFMAN4bart-rules-4



filename Name of the file that differs between the control manifest and thetest manifest.

attribute Name of the file attribute that differs between the manifeststhat are compared. The control-val precedes the test-val. Whendiscrepancies for multiple attributes occur in the same file, eachdifference is noted on a separate line.

Following is an example of attribute differences for the /etc/passwd file. The outputindicates that the size, mtime, and contents attributes have changed.

/etc/passwd:

size control:74 test:81

mtime control:3c165879 test:3c165979

contents control:daca28ae0de97afd7a6b91fde8d57afa

test:84b2b32c4165887355317207b48a6ec7

■ Programmatic output is generated with the -p option to the bart compare command. Thisoutput is suitable for programmatic manipulation.The structure of the output is as follows:

filename attribute control-val test-val [attribute control-val test-val]*

filename Same as the filename attribute in the default format

attribute control-valtest-val

A description of the file attributes that differ between the controland test manifests for each file

For a list of attributes that are supported by the bart command, see “BART Rules FileAttributes” on page 39.

For more information, see the bart(1M) man page.

http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=REFMAN1Mbart-1m


Glossary 43

Security Glossary

AccessControl List(ACL)

An access control list (ACL) provides finer-grained file security than traditional UNIX fileprotection provides. For example, an ACL enables you to allow group read access to a file,while allowing only one member of that group to write to the file.

adminprincipal

A user principal with a name of the form username/admin (as in jdoe/admin). An adminprincipal can have more privileges (for example, to change policies) than a regular userprincipal. See also principal name, user principal.

AES Advanced Encryption Standard. A symmetric 128-bit block data encryption technique. TheU.S. government adopted the Rijndael variant of the algorithm as its encryption standard inOctober 2000. AES replaces user principal encryption as the government standard.

algorithm A cryptographic algorithm. This is an established, recursive computational procedure thatencrypts or hashes input.

applicationserver

See network application server.

asynchronousaudit event

Asynchronous events are the minority of system events. These events are not associated withany process, so no process is available to be blocked and later woken up. Initial system bootand PROM enter and exit events are examples of asynchronous events.

audit files Binary audit logs. Audit files are stored separately in an audit file system.

audit policy The global and per-user settings that determine which audit events are recorded. The globalsettings that apply to the audit service typically affect which pieces of optional information areincluded in the audit trail. Two settings, cnt and ahlt, affect the operation of the system whenthe audit queue fills. For example, audit policy might require that a sequence number be part ofevery audit record.

audit trail The collection of all audit files from all hosts.

authenticatedrights profile

A rights profile that requires the assigned user or role to type a password before executing anoperation from the profile. This behavior is similar to sudo behavior. The length of time thatthe password is valid is configurable.

authentication The process of verifying the claimed identity of a principal.

authenticator


authenticator Authenticators are passed by clients when requesting tickets (from a KDC) and services (froma server). They contain information that is generated by using a session key known only by theclient and server, that can be verified as of recent origin, thus indicating that the transaction issecure. When used with a ticket, an authenticator can be used to authenticate a user principal.An authenticator includes the principal name of the user, the IP address of the user's host, anda time stamp. Unlike a ticket, an authenticator can be used only once, usually when access to aservice is requested. An authenticator is encrypted by using the session key for that client andthat server.

authorization 1. In Kerberos, the process of determining if a principal can use a service, which objects theprincipal is allowed to access, and the type of access that is allowed for each object.

2. In user rights management, a right that can be assigned to a role or user (or embedded in arights profile) for performing a class of operations that are otherwise prohibited by securitypolicy. Authorizations are enforced at the user application level, not in the kernel.

basic set The set of privileges that are assigned to a user's process at login. On an unmodified system,each user's initial inheritable set equals the basic set at login.

Blowfish A symmetric block cipher algorithm that takes a variable-length key from 32 bits to 448 bits.Its author, Bruce Schneier, claims that Blowfish is optimized for applications where the keydoes not change often.

client Narrowly, a process that makes use of a network service on behalf of a user; for example, anapplication that uses rlogin. In some cases, a server can itself be a client of some other serveror service.

More broadly, a host that a) receives a Kerberos credential, and b) makes use of a service that isprovided by a server.

Informally, a principal that makes use of a service.

clientprincipal

(RPCSEC_GSS API) A client (a user or an application) that uses RPCSEC_GSS-securednetwork services. Client principal names are stored in the form of rpc_gss_principal_tstructures.

clock skew The maximum amount of time that the internal system clocks on all hosts that are participatingin the Kerberos authentication system can differ. If the clock skew is exceeded between any ofthe participating hosts, requests are rejected. Clock skew can be specified in the krb5.conf file.

confidentiality See privacy.

consumer In the Cryptographic Framework feature of Oracle Solaris, a consumer is a user of thecryptographic services that come from providers. Consumers can be applications, end users,or kernel operations. Kerberos, IKE, and IPsec are examples of consumers. For examples ofproviders, see provider.

credential An information package that includes a ticket and a matching session key. Used to authenticatethe identity of a principal. See also ticket, session key.

GSS-API

Glossary 45

credentialcache

A storage space (usually a file) that contains credentials that are received from the KDC.

cryptographicalgorithm

See algorithm.

DES Data Encryption Standard. A symmetric-key encryption method developed in 1975 andstandardized by ANSI in 1981 as ANSI X.3.92. DES uses a 56-bit key.

deviceallocation

Device protection at the user level. Device allocation enforces the exclusive use of a device byone user at a time. Device data is purged before device reuse. Authorizations can be used tolimit who is permitted to allocate a device.

device policy Device protection at the kernel level. Device policy is implemented as two sets of privileges ona device. One set of privileges controls read access to the device. The second set of privilegescontrols write access to the device. See also policy.

Diffie-Hellmanprotocol

Also known as public key cryptography. An asymmetric cryptographic key agreement protocolthat was developed by Diffie and Hellman in 1976. The protocol enables two users to exchangea secret key over an insecure medium without any prior secrets. Diffie-Hellman is used byKerberos.

digest See message digest.

DSA Digital Signature Algorithm. A public key algorithm with a variable key size from 512 to 4096bits. The U.S. Government standard, DSS, goes up to 1024 bits. DSA relies on SHA1 for input.

ECDSA Elliptic Curve Digital Signature Algorithm. A public key algorithm that is based on ellipticcurve mathematics. An ECDSA key size is significantly smaller than the size of a DSA publickey needed to generate a signature of the same length.

effective set The set of privileges that are currently in effect on a process.

flavor Historically, security flavor and authentication flavor had the same meaning, as a flavorthat indicated a type of authentication (AUTH_UNIX, AUTH_DES, AUTH_KERB).RPCSEC_GSS is also a security flavor, even though it provides integrity and privacy servicesin addition to authentication.

forwardableticket

A ticket that a client can use to request a ticket on a remote host without requiring the client togo through the full authentication process on that host. For example, if the user david obtainsa forwardable ticket while on user jennifer's machine, david can log in to his own machinewithout being required to get a new ticket (and thus authenticate himself again). See alsoproxiable ticket.

FQDN Fully qualified domain name. For example, central.example.com (as opposed to simplydenver).

GSS-API The Generic Security Service Application Programming Interface. A network layer thatprovides support for various modular security services, including the Kerberos service.

hardening


GSS-API provides for security authentication, integrity, and privacy services. See alsoauthentication, integrity, privacy.

hardening The modification of the default configuration of the operating system to remove securityvulnerabilities that are inherent in the host.

hardwareprovider

In the Cryptographic Framework feature of Oracle Solaris, a device driver and its hardwareaccelerator. Hardware providers offload expensive cryptographic operations from the computersystem, thus freeing CPU resources for other uses. See also provider.

host A system that is accessible over a network.

host principal A particular instance of a service principal in which the principal (signified by the primaryname host) is set up to provide a range of network services, such as ftp, rcp, or rlogin. Anexample of a host principal is host/[email protected]. See also serverprincipal.

inheritable set The set of privileges that a process can inherit across a call to exec.

initial ticket A ticket that is issued directly (that is, not based on an existing ticket-granting ticket). Someservices, such as applications that change passwords, might require tickets to be markedinitial so as to assure themselves that the client can demonstrate a knowledge of its secretkey. This assurance is important because an initial ticket indicates that the client has recentlyauthenticated itself (instead of relying on a ticket-granting ticket, which might existed for along time).

instance The second part of a principal name, an instance qualifies the principal's primary. In the caseof a service principal, the instance is required. The instance is the host's fully qualified domainname, as in host/central.example.com. For user principals, an instance is optional. Note,however, that jdoe and jdoe/admin are unique principals. See also primary, principal name,service principal, user principal.

integrity A security service that, in addition to user authentication, provides for the validity oftransmitted data through cryptographic checksumming. See also authentication, privacy.

invalid ticket A postdated ticket that has not yet become usable. An invalid ticket is rejected by anapplication server until it becomes validated. To be validated, an invalid ticket must bepresented to the KDC by the client in a TGS request, with the VALIDATE flag set, after its starttime has passed. See also postdated ticket.

KDC Key Distribution Center. A machine that has three Kerberos V5 components:

■ Principal and key database■ Authentication service■ Ticket-granting service

Each realm has a master KDC and should have one or more slave KDCs.

least privilege

Glossary 47

Kerberos An authentication service, the protocol that is used by that service, or the code that is used toimplement that service.

The Kerberos implementation in Oracle Solaris that is closely based on Kerberos V5implementation.

While technically different, “Kerberos” and “Kerberos V5” are often used interchangeably inthe Kerberos documentation.

Kerberos (also spelled Cerberus) was a fierce, three-headed mastiff who guarded the gates ofHades in Greek mythology.

Kerberospolicy

A set of rules that governs password usage in the Kerberos service. Policies can regulateprincipals' accesses, or ticket parameters, such as lifetime.

key 1. Generally, one of two main types of keys:

■ A symmetric key – An encryption key that is identical to the decryption key. Symmetrickeys are used to encrypt files.

■ An asymmetric key or public key – A key that is used in public key algorithms, such asDiffie-Hellman or RSA. Public keys include a private key that is known only by one user,a public key that is used by the server or general resource, and a private-public key pairthat combines the two. A private key is also called a secret key. The public key is alsocalled a shared key or common key.

2. An entry (principal name) in a keytab file. See also keytab file.3. In Kerberos, an encryption key, of which there are three types:

■ A private key – An encryption key that is shared by a principal and the KDC, anddistributed outside the bounds of the system. See also private key.

■ A service key – This key serves the same purpose as the private key, but is used by serversand services. See also service key.

■ A session key – A temporary encryption key that is used between two principals, with alifetime limited to the duration of a single login session. See also session key.

keystore A keystore holds passwords, passphrases, certificates, and other authentication objects forretrieval by applications. A keystore can be specific to a technology, or a location that severalapplications use.

keytab file A key table file that contains one or more keys (principals). A host or service uses a keytab filein the much the same way that a user uses a password.

kvno Key version number. A sequence number that tracks a particular key in order of generation.The highest kvno is the latest and most current key.

least privilege A security model which gives a specified process only a subset of superuser powers. Theleast privilege model assigns enough privilege to regular users that they can perform personaladministrative tasks, such as mount file systems and change the ownership of files. On the

limit set


other hand, processes run with just those privileges that they need to complete the task, ratherthan with the full power of superuser, that is, all privileges. Damage due to programmingerrors like buffer overflows can be contained to a non-root user, which has no access to criticalabilities like reading or writing protected system files or halting the machine.

limit set The outside limit of what privileges are available to a process and its children.

MAC 1. See message authentication code (MAC).

2. Also called labeling. In government security terminology, MAC is Mandatory AccessControl. Labels such as Top Secret and Confidential are examples of MAC. MAC contrastswith DAC, which is Discretionary Access Control. UNIX permissions are an example of DAC.

3. In hardware, the unique system address on a LAN. If the system is on an Ethernet, the MACis the Ethernet address.

master KDC The main KDC in each realm, which includes a Kerberos administration server, kadmind, andan authentication and ticket-granting daemon, krb5kdc. Each realm must have at least onemaster KDC, and can have many duplicate, or slave, KDCs that provide authentication servicesto clients.

MD5 An iterative cryptographic hash function that is used for message authentication, includingdigital signatures. The function was developed in 1991 by Rivest. Its use is deprecated.

mechanism 1. A software package that specifies cryptographic techniques to achieve data authentication orconfidentiality. Examples: Kerberos V5, Diffie-Hellman public key.

2. In the Cryptographic Framework feature of Oracle Solaris, an implementation of analgorithm for a particular purpose. For example, a DES mechanism that is applied toauthentication, such as CKM_DES_MAC, is a separate mechanism from a DES mechanismthat is applied to encryption, CKM_DES_CBC_PAD.

messageauthenticationcode (MAC)

MAC provides assurance of data integrity and authenticates data origin. MAC does not protectagainst eavesdropping.

messagedigest

A message digest is a hash value that is computed from a message. The hash value almostuniquely identifies the message. A digest is useful for verifying the integrity of a file.

minimization The installation of the minimal operating system that is necessary to run the server. Anysoftware that does not directly relate to the operation of the server is either not installed, ordeleted after the installation.

name servicescope

The scope in which a role is permitted to operate, that is, an individual host or all hosts that areserved by a specified naming service such as NIS LDAP.

networkapplicationserver

A server that provides a network application, such as ftp. A realm can contain several networkapplication servers.

postdated ticket

Glossary 49

networkpolicies

The settings that network utilities configure to protect network traffic. For information aboutnetwork security, see “Securing the Network in Oracle Solaris 11.2 ”.

nonattributableaudit event

An audit event whose initiator cannot be determined, such as the AUE_BOOT event.

NTP Network Time Protocol. Software from the University of Delaware that enables you to manageprecise time or network clock synchronization, or both, in a network environment. You can useNTP to maintain clock skew in a Kerberos environment. See also clock skew.

PAM Pluggable Authentication Module. A framework that allows for multiple authenticationmechanisms to be used without having to recompile the services that use them. PAM enablesKerberos session initialization at login.

passphrase A phrase that is used to verify that a private key was created by the passphrase user. A goodpassphrase is 10-30 characters long, mixes alphabetic and numeric characters, and avoidssimple prose and simple names. You are prompted for the passphrase to authenticate use of theprivate key to encrypt and decrypt communications.

passwordpolicy

The encryption algorithms that can be used to generate passwords. Can also refer to moregeneral issues around passwords, such as how often the passwords must be changed, how manypassword attempts are permitted, and other security considerations. Security policy requirespasswords. Password policy might require passwords to be encrypted with the AES algorithm,and might make further requirements related to password strength.

permitted set The set of privileges that are available for use by a process.

policy Generally, a plan or course of action that influences or determines decisions and actions. Forcomputer systems, policy typically means security policy. Your site's security policy is the setof rules that define the sensitivity of the information that is being processed and the measuresthat are used to protect the information from unauthorized access. For example, securitypolicy might require that systems be audited, that devices must be allocated for use, and thatpasswords be changed every six weeks.

For the implementation of policy in specific areas of the Oracle Solaris OS, see audit policy,policy in the Cryptographic Framework, device policy, Kerberos policy, password policy, andrights policy.

policy forpublic keytechnologies

In the Key Management Framework (KMF), policy is the management of certificate usage.The KMF policy database can put constraints on the use of the keys and certificates that aremanaged by the KMF library.

policy in theCryptographicFramework

In the Cryptographic Framework feature of Oracle Solaris, policy is the disabling of existingcryptographic mechanisms. The mechanisms then cannot be used. Policy in the CryptographicFramework might prevent the use of a particular mechanism, such as CKM_DES_CBC, from aprovider, such as DES.

postdatedticket

A postdated ticket does not become valid until some specified time after its creation. Sucha ticket is useful, for example, for batch jobs that are intended to run late at night, since the

http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=NWSEC

primary


ticket, if stolen, cannot be used until the batch job is run. When a postdated ticket is issued, itis issued as invalid and remains that way until a) its start time has passed, and b) the clientrequests validation by the KDC. A postdated ticket is normally valid until the expiration timeof the ticket-granting ticket. However, if the postdated ticket is marked renewable, its lifetimeis normally set to be equal to the duration of the full life time of the ticket-granting ticket. Seealso invalid ticket, renewable ticket.

primary The first part of a principal name. See also instance, principal name, realm.

principal 1. A uniquely named client/user or server/service instance that participates in a networkcommunication. Kerberos transactions involve interactions between principals (serviceprincipals and user principals) or between principals and KDCs. In other words, a principal is aunique entity to which Kerberos can assign tickets. See also principal name, service principal,user principal.

2. (RPCSEC_GSS API) See client principal, server principal.

principalname

1. The name of a principal, in the format primary/instance@REALM. See also instance,primary, realm.

2. (RPCSEC_GSS API) See client principal, server principal.

principle ofleast privilege

See least privilege.

privacy A security service, in which transmitted data is encrypted before being sent. Privacy alsoincludes data integrity and user authentication. See also authentication, integrity, service.

private key A key that is given to each user principal, and known only to the user of the principal and to theKDC. For user principals, the key is based on the user's password. See also key.

private-keyencryption

In private-key encryption, the sender and receiver use the same key for encryption. See alsopublic-key encryption.

privilege 1. In general, a power or capability to perform an operation on a computer system that isbeyond the powers of a regular user. Superuser privileges are all the rights that superuseris granted. A privileged user or privileged application is a user or application that has beengranted additional rights.

2. A discrete right on a process in an Oracle Solaris system. Privileges offer a finer-grainedcontrol of processes than does root. Privileges are defined and enforced in the kernel.Privileges are also called process privileges or kernel privileges. For a full description ofprivileges, see the privileges(5) man page.

privilegeescalation

Gaining access to resources that are outside the range of resources that your assigned rights,including rights that override the defaults, permit. The result is that a process can performunauthorized operations.

http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=REFMAN5privileges-5

public-key encryption

Glossary 51

privilegemodel

A stricter model of security on a computer system than the superuser model. In the privilegemodel, processes require privilege to run. Administration of the system can be divided intodiscrete parts that are based on the privileges that administrators have in their processes.Privileges can be assigned to an administrator's login process. Or, privileges can be assigned tobe in effect for certain commands only.

privilege set A collection of privileges. Every process has four sets of privileges that determine whethera process can use a particular privilege. See limit set, effective set set, permitted set set, andinheritable set set.

Also, the basic set set of privileges is the collection of privileges that are assigned to a user'sprocess at login.

privilege-aware

Programs, scripts, and commands that turn on and off the use of privilege in their code. In aproduction environment, the privileges that are turned on must be supplied to the process, forexample, by requiring users of the program to use a rights profile that adds the privileges to theprogram. For a full description of privileges, see the privileges(5) man page.

privilegedapplication

An application that can override system controls. The application checks for security attributes,such as specific UIDs, GIDs, authorizations, or privileges.

privilegeduser

A user who is assigned rights beyond the rights of regular user on a computer system. See alsotrusted users.

profile shell In rights management, a shell that enables a role (or user) to run from the command line anyprivileged applications that are assigned to the role's rights profiles. The profile shell versionscorrespond to the available shells on the system, such as the pfbash version of bash.

provider In the Cryptographic Framework feature of Oracle Solaris, a cryptographic service that isprovided to consumers. PKCS #11 libraries, kernel cryptographic modules, and hardwareaccelerators are examples of providers. Providers plug in to the Cryptographic Framework, soare also called plugins. For examples of consumers, see consumer.

proxiableticket

A ticket that can be used by a service on behalf of a client to perform an operation for theclient. Thus, the service is said to act as the client's proxy. With the ticket, the service can takeon the identity of the client. The service can use a proxiable ticket to obtain a service ticket toanother service, but it cannot obtain a ticket-granting ticket. The difference between a proxiableticket and a forwardable ticket is that a proxiable ticket is only valid for a single operation. Seealso forwardable ticket.

public object A file that is owned by the root user and readable by the world, such as any file in the /etcdirectory.

public-keyencryption

An encryption scheme in which each user has two keys, one public key and one private key. Inpublic-key encryption, the sender uses the receiver's public key to encrypt the message, and thereceiver uses a private key to decrypt it. The Kerberos service is a private-key system. See alsoprivate-key encryption.

http://www.oracle.com/pls/topic/lookup?ctx=E36784&id=REFMAN5privileges-5

QOP


QOP Quality of Protection. A parameter that is used to select the cryptographic algorithms that areused in conjunction with the integrity service or privacy service.

RBAC Role-based access control, the user rights management feature of Oracle Solaris. See rights.

RBAC policy See rights policy.

realm 1. The logical network that is served by a single Kerberos database and a set of KeyDistribution Centers (KDCs).

2. The third part of a principal name. For the principal name jdoe/[email protected],the realm is CORP.EXAMPLE.COM. See also principal name.

reauthentication The requirement to provide a password to perform a computer operation. Typically, sudooperations require reauthentication. Authenticated rights profiles can contain commands thatrequire reauthentication. See authenticated rights profile.

relation A configuration variable or relationship that is defined in the kdc.conf or krb5.conf files.

renewableticket

Because having tickets with very long lives is a security risk, tickets can be designated asrenewable. A renewable ticket has two expiration times: a) the time at which the currentinstance of the ticket expires, and b) maximum lifetime for any ticket. If a client wants tocontinue to use a ticket, the client renews the ticket before the first expiration occurs. Forexample, a ticket can be valid for one hour, with all tickets having a maximum lifetime of tenhours. If the client that holds the ticket wants to keep it for more than an hour, the client mustrenew the ticket. When a ticket reaches the maximum ticket lifetime, it automatically expiresand cannot be renewed.

rights An alternative to the all-or-nothing superuser model. User rights management and processrights management enable an organization to divide up superuser's privileges and assign themto users or roles. Rights in Oracle Solaris are implemented as kernel privileges, authorizations,and the ability to run a process as a specific UID or GID. Rights can be collected in a rightsprofile and a role.

rights policy The security policy that is associated with a command. Currently, solaris is the valid policyfor Oracle Solaris. The solaris policy recognizes privileges and extended privilege policy,authorizations, and setuid security attributes.

rights profile Also referred to as a profile. A collection of security overrides that can be assigned to a role oruser. A rights profile can include authorizations, privileges, commands with security attributes,and other rights profiles that are called supplementary profiles.

role A special identity for running privileged applications that only assigned users can assume.

RSA A method for obtaining digital signatures and public key cryptosystems. The method was firstdescribed in 1978 by its developers, Rivest, Shamir, and Adleman.

scan engine A third-party application, residing on an external host, that examines a file for known viruses.

service

Glossary 53

SEAM The product name for the initial version of Kerberos on Solaris systems. This product isbased on the Kerberos V5 technology that was developed at the Massachusetts Institute ofTechnology. SEAM is now called the Kerberos service. It continues to differ slightly from theMIT version.

secret key See private key.

Secure Shell A special protocol for secure remote login and other secure network services over an insecurenetwork.

securityattributes

Overrides to security policy that enable an administrative command to succeed when thecommand is run by a user other than superuser. In the superuser model, the setuid root andsetgid programs are security attributes. When these attributes are applied to a command, thecommand succeeds no matter who runs the command. In the privilege model, kernel privilegesand other rights replace setuid root programs as security attributes. The privilege model iscompatible with the superuser model, in that the privilege model also recognizes the setuidand setgid programs as security attributes.

security flavor See flavor.

securitymechanism

See mechanism.

security policy See policy.

securityservice

See service.

seed A numeric starter for generating random numbers. When the starter originates from a randomsource, the seed is called a random seed.

separation ofduty

Part of the notion of least privilege. Separation of duty prevents one user from performing orapproving all operations that complete a transaction. For example, in RBAC, you can separatethe creation of a login user from the assignment of security overrides. One role creates the user.A separate role can assign security attributes, such as rights profiles, roles, and privileges toexisting users.

server A principal that provides a resource to network clients. For example, if you ssh to the systemcentral.example.com, then that system is the server that provides the ssh service. See alsoservice principal.

serverprincipal

(RPCSEC_GSS API) A principal that provides a service. The server principal is stored as anASCII string in the form service@host. See also client principal.

service 1. A resource that is provided to network clients, often by more than one server. For example, ifyou rlogin to the machine central.example.com, then that machine is the server that providesthe rlogin service.

service key


2. A security service (either integrity or privacy) that provides a level of protection beyondauthentication. See also integrity and privacy.

service key An encryption key that is shared by a service principal and the KDC, and is distributed outsidethe bounds of the system. See also key.

serviceprincipal

A principal that provides Kerberos authentication for a service or services. For serviceprincipals, the primary name is a name of a service, such as ftp, and its instance is the fullyqualified host name of the system that provides the service. See also host principal, userprincipal.

session key A key that is generated by the authentication service or the ticket-granting service. A sessionkey is generated to provide secure transactions between a client and a service. The lifetime of asession key is limited to a single login session. See also key.

SHA1 Secure Hashing Algorithm. The algorithm operates on any input length less than 264 to producea message digest. The SHA1 algorithm is input to DSA.

single-systemimage

A single-system image is used in Oracle Solaris auditing to describe a group of audited systemsthat use the same naming service. These systems send their audit records to a central auditserver, where the records can be compared as if the records came from one system.

slave KDC A copy of a master KDC, which is capable of performing most functions of the master. Eachrealm usually has several slave KDCs (and only one master KDC). See also KDC, masterKDC.

softwareprovider

In the Cryptographic Framework feature of Oracle Solaris, a kernel software module or aPKCS #11 library that provides cryptographic services. See also provider.

stash file A stash file contains an encrypted copy of the master key for the KDC. This master key is usedwhen a server is rebooted to automatically authenticate the KDC before it starts the kadmindand krb5kdc processes. Because the stash file includes the master key, the stash file and anybackups of it should be kept secure. If the encryption is compromised, then the key could beused to access or modify the KDC database.

superusermodel

The typical UNIX model of security on a computer system. In the superuser model, anadministrator has all-or-nothing control of the system. Typically, to administer the machine, auser becomes superuser (root) and can do all administrative activities.

synchronousaudit event

The majority of audit events. These events are associated with a process in the system. A non-attributable event that is associated with a process is a synchronous event, such as a failedlogin.

TGS Ticket-Granting Service. That portion of the KDC that is responsible for issuing tickets.

TGT Ticket-Granting Ticket. A ticket that is issued by the KDC that enables a client to requesttickets for other services.

virtual private network (VPN)

Glossary 55

ticket An information packet that is used to securely pass the identity of a user to a server or service.A ticket is valid for only a single client and a particular service on a specific server. A ticketcontains the principal name of the service, the principal name of the user, the IP address of theuser's host, a time stamp, and a value that defines the lifetime of the ticket. A ticket is createdwith a random session key to be used by the client and the service. Once a ticket has beencreated, it can be reused until the ticket expires. A ticket only serves to authenticate a clientwhen it is presented along with a fresh authenticator. See also authenticator, credential, service,session key.

ticket file See credential cache.

trusted users Users whom you have decided can perform administrative tasks at some level of trust.Typically, administrators create logins for trusted users first and assign administrative rightsthat match the users' level of trust and ability. These users then help configure and maintain thesystem. Also called privileged users.

user principal A principal that is attributed to a particular user. A user principal's primary name is a username, and its optional instance is a name that is used to described the intended use of thecorresponding credentials (for example, jdoe or jdoe/admin). Also known as a user instance.See also service principal.

virtual privatenetwork(VPN)

A network that provides secure communication by using encryption and tunneling to connectusers over a public network.


57

Index

Numbers and Symbols+ (plus sign)

file permissions symbol, 12- (minus sign)

file permissions symbol, 12file type symbol, 8

. (dot)displaying hidden files, 16

/etc/syslog.conf fileexecutable stack messages and, 14

/var/adm/messages fileexecutable stack messages, 14

32-bit executablesprotecting from compromising security, 14

= (equal sign)file permissions symbol, 12

Aabsolute mode

changing file permissions, 12, 19changing special file permissions, 21description, 12setting special permissions, 13

accesssecurity

UFS ACLs, 14Access Control Lists (ACLs) See ACLACL

description, 14format of entries, 14

administeringfile permissions, 15, 15

attributeskeyword in BART, 29

BBART

components, 26overview, 25programmatic output, 41security considerations, 27task map, 28verbose output, 40

bart create command, 26, 28Basic Audit Reporting Tool See BART

Cchanging

file ownership, 17file permissions

absolute mode, 19special, 21symbolic mode, 18

group ownership of file, 18special file permissions, 21

chgrp commanddescription, 8syntax, 18

chmod commandchanging special permissions, 21, 22description, 8syntax, 21

chown commanddescription, 7

commandsfile protection commands, 7

componentsBART, 26

control manifests (BART), 25customizing

Index


manifests, 30customizing a report (BART), 36

Ddefaults

umask value, 11determining

files with setuid permissions, 22directories, 7

See also filesdisplaying files and related information, 7, 15permissions

defaults, 11description, 8

public directories, 11disabling

32-bit executables that compromise security, 14executable stacks, 23logging of executable stack messages, 24programs from using executable stacks, 23

displayingfile information, 15files and related information, 7

dot (.)displaying hidden files, 16

Eequal sign (=)

file permissions symbol, 12executable stacks

disabling logging messages, 24logging messages, 15protecting against, 23protecting against 32-bit processes, 14

execute permissionssymbolic mode, 12

Ffile permission modes

absolute mode, 12symbolic mode, 12

file systems

securityTMPFS file system, 11

TMPFS, 11files

BART manifests, 38changing group ownership, 18changing ownership, 7, 17changing special file permissions, 21displaying file information, 15displaying hidden files, 16displaying information about, 7file types, 8finding files with setuid permissions, 22manifests (BART), 38ownership

and setgid permission, 10and setuid permission, 10

permissionsabsolute mode, 12, 19changing, 8, 12, 19defaults, 11description, 8setgid, 10setuid, 10sticky bit, 11symbolic mode, 12, 12, 18, 19umask value, 11

protecting with UNIX permissions, 15scanning for integrity, 25security

changing ownership, 17changing permissions, 12, 19directory permissions, 8displaying file information, 7, 16file permissions, 8file types, 8special file permissions, 13umask default, 11UNIX permissions, 7user classes, 8

special files, 9symbols of file type, 8tracking integrity, 25

find commandfinding files with setuid permissions, 22

Index

59

Ggroups

changing file ownership, 18

I-i option

bart create command, 28, 31-I option

bart create command, 28

Kkern.notice entry

syslog.conf file, 14keywords

attribute in BART, 29

Llog files

BARTprogrammatic output, 40verbose output, 40

Mmanaging

file permissions, 15manifests, 26

See also bart createcontrol, 25customizing, 30file format, 38test in BART, 26

messages fileexecutable stack messages, 14

minus sign (-)file permissions symbol, 12symbol of file type, 8

N-n option

bart create command, 28noexec_user_stack variable, 14, 23noexec_user_stack_log variable, 15, 24

Oownership of files

changing, 7, 17changing group ownership, 18UFS ACLs and, 14

P-p option

bart create, 31permissions

changing file permissionsabsolute mode, 12, 19chmod command, 8symbolic mode, 12, 12, 18, 19

defaults, 11directory permissions, 8file permissions

absolute mode, 12, 19changing, 12, 19description, 8special permissions, 11, 13symbolic mode, 12, 12, 18, 19

finding files with setuid permissions, 22setgid permissions

absolute mode, 13, 22description, 10symbolic mode, 12

setuid permissionsabsolute mode, 13, 22description, 10security risks, 10symbolic mode, 12

special file permissions, 9, 11, 13sticky bit, 11UFS ACLs and, 14umask value, 11user classes and, 8

plus sign (+)

Index


file permissions symbol, 12protecting

32-bit executables from compromising security, 14system from risky programs, 22

protecting filesuser procedures, 15with UFS ACLs, 14with UNIX permissions, 7, 15with UNIX permissions task map, 15

public directoriessticky bit and, 11

Qquoting syntax in BART, 40

R-r option

bart create, 31-R option

bart create, 28, 31read permissions

symbolic mode, 12reporting tool See bart comparereports

BART, 25rstchown system variable, 17rules file (BART), 27rules file attributes See keywordsrules file format (BART), 39rules file specification language See quoting syntax

Ssecurity

BART, 25, 27setgid permissions

absolute mode, 13, 22description, 10security risks, 10symbolic mode, 12

setuid permissionsabsolute mode, 13, 22description, 10

finding files with permissions set, 22security risks, 10symbolic mode, 12

special permissionssetgid permissions, 10setuid permissions, 10sticky bit, 11

sticky bit permissionsabsolute mode, 13, 22description, 11symbolic mode, 12

symbolic linksfile permissions, 9

symbolic modechanging file permissions, 12, 18, 19description, 12

syslog.conf fileexecutable stack messages, 14kern.notice level, 14

system securityprotecting from risky programs, 22task map, 22UFS ACLs, 14

system variablesnoexec_user_stack, 23noexec_user_stack_log, 24rstchown, 17

systemsprotecting from risky programs, 22tracking file integrity, 25

Ttask maps

protecting against programs with security risk, 22protecting files with UNIX permissions, 15Using BART task map, 28

test manifestsBART, 26

TMPFS file systemsecurity, 11

troubleshootingfinding files with setuid permissions, 22preventing programs from using executablestacks, 23

Index

61

Uumask value

and file creation, 11typical values, 11

UNIX file permissions See files, permissionsuser classes of files, 8user procedures

protecting files, 15using

BART, 27file permissions, 15

Vvariables

noexec_user_stack, 14noexec_user_stack_log, 15rstchown, 17

viewingfile permissions, 15

Wwrite permissions

symbolic mode, 12


Documents

Securing Files and Verifying File Integrity in Oracle ... · This table describes the commands for monitoring and securing files and directories. ... 8 Securing Files and Verifying