UNIXWIZANYTHINGDEALINGWITH*NIXORWHATEVERIWANTTOWRITEABOUT SubscribeviaRSS

HOME ABOUTME STOPSOPA

Whyeveryoneshouldusebart(AKAdotheBartMan)

IfyouareusingSolaris10,andyouhavenotusedbartyet,youshouldstopeverythingandtakealookatit.

Forthosewhodon'tknowwhatbartis,itistheBasicAuditingandReportingToolthatisinSolaris10.

Inaquicksynopsisbartwillcreateareportthatshowsallfiles/directoriesonasolarismachine.Thisreportcontainsthepermissions,owners,sizes,modifytimesandmd5hashesofallfilesonthesystem,alongwithacl'sifyouareusingZFS.

Sowhyisbartsoimportant?First,itcanbeusedasasecuritytool.WhenyouinstallanewSolaris10system,thefirstthingyoushoulddoafteryougetitinstalledandpatchedandbeforeitisplacedonthenetworkisrunabartonthesystemandsavethereporttoacd.Thiswillbethe"baseline"imageofthesystem.Theneveryweek/monthyoushouldrunabartagainstthemachineagainandthenusethecompareoptiontoseewhatfileshavechanged,addedordeletedfromthesystem.Wherethiscomesinreallyhandyisifyourthinkthatyourmachinehasbeenhackedorcompromised.Youcanusethecomparisontodeterminewhichfilesmayhavebeenmodifiedbythehacker.

ButthereisanonsecurityuseforbartaswellthatisVERYuseful.ThisuseisonethatIhadnotthoughtofuntilIneededittheotherday.Sowhatisthisuse?ResetingthepermissionsonfilesthatwereaccidentallychangedbyaninexperiencedUNIXpersonthinkingthata"chmodR777*"isthebestwaytofixtheirproblems.

ThefirstthingthatcametomymindwhenIsawthishappenwasohno,themachinehadnotevenbeenbackedupyet,andaday'sworthofworkwouldhavebeenlost.Evenifthemachinehadbeenbackedup,doyourealizehowlongitwouldtaketorestoreafilesystemwith40,000+files,justbecausethepermissionswerescrewedup.(Note,thepermissionsonthevariousfileswereverydifferentandevenincludedsomesetuid,andsetgiudfileswhichwerewipedoutaswell.)

Sohowdidbartsavetheday?LucklyIhadtakenabartofthemachinebeforetheworkhadbegunonthefilesystem.Soafterthechmodcommandwasissued,Ithentookabartofthefilesystemagain.Inowcouldrunabartcompareagainstthecontrolandtestmanifestandseeexactlywhatallhadchanged.

OnceIhadthisoutput,Icouldthencreateascripttochangethepermissionsofthefiles/directoriesbacktotheoriginalvalues.AlltoldafterIfinishedtweakingmyscriptittookabout20minutestoresetthepermissionsonallthefilesanddirectories.

Sohereisaquickstarttogettingyourfirstbartmanifestofyoursystem:

1.Createabart_rulesfile.Ifyoudonotcreatearulesfile,youroutputwillonlyhaveFilesandnotdirectorieslistedinit.Mysimplebart_rulesfilelookslikethis:

/CHECKALL/homeIGNOREALL

Iignorethe/homefilesystemasinmycaseitwasnfsmounted.Inrealityyouwouldwanttoincludealllocalfilesystems.

tags

AIXAppleCableCardComcastFamilyFlyingFunnyHomeRepairsHouseIBMInterestingjetBlueLDAPM$WindersMacBookProMacOSXMorgantownMorgantown,WVOpenSolarisPhotography

PhotoShopPHPRandomStuffRantSecurityShellScriptsSMFSolarisSpamFightingSunSunRaySyswatchtipsTiVoTivoliTravelUncategorizedVacationVideoVMWareWorkX2100XMRadioZFSZones/Containers

Categories

Categories

SelectCategory

Blogroll

JustinsBlog

ComputerStuff

ChrisQuenelle'sWeblog

ChristopherSaul'sWeblog

GlennBrunette'sSecurityWeblog

Joyent

TheClinganZone

TheSwordblog

OtherSites

AudiencesEverywhere

PhotoStuff

FroKnowsPhoto

MAY/08

2.Createthebart,Ikeeptherulesfilein/root/bart_rulessoIwouldrunthecommand:

bartcreateR/r/root/bart_rules>/tmp/bart.output

Thiswillcreateabartmanifestandoutputitto/tmp/bart.output.Lookingatthefirstcoupleoflinesofitlookslikethis:

unixwiz@sungeek:/home/unixwiz>head20/tmp/bart.out!Version1.0!Saturday,May17,2008(21:24:27)#Format:#fnameDsizemodeacldirmtimeuidgid#fnamePsizemodeaclmtimeuidgid#fnameSsizemodeaclmtimeuidgid#fnameFsizemodeaclmtimeuidgidcontents#fnameLsizemodeacllnmtimeuidgiddest#fnameBsizemodeaclmtimeuidgiddevnode#fnameCsizemodeaclmtimeuidgiddevnode/D102440755user::rwx,group::rx,mask:rx,other:rx481d0e4300/.ICEauthorityF310100600user::rw,group::,mask:,other:44c581c2003eb63faf448e8a2b2c1a7b2019a8bde3/.XauthorityF99100600user::rw,group::,mask:,other:44c560e0005ffe2e5f4b6f73e662001f62f7cae4d3/.bash_historyF649100600user::rw,group::,mask:,other:481d1109009132e0e798d5d05644cafc90c2aa876a/.dtD51240755user::rwx,group::rx,mask:rx,other:rx44c560e000/.dt/appmanagerD51240755user::rwx,group::rx,mask:rx,other:rx44c5534d00/.dt/helpD51240755user::rwx,group::rx,mask:rx,other:rx44c5534d00/.dt/iconsD51240755user::rwx,group::rx,mask:rx,other:rx44c5534d00/.dt/sessionlogsD51240755user::rwx,group::rx,mask:rx,other:rx44c5534c00/.dt/sessionlogs/sungeek_DISPLAY=:0F132100644user::rw,group::r,mask:r,other:r44c560e0006d4e62fc972046a7a85fdb36a0ce21fd

Thefirstpartofthefile,thepartthatbeginswith#fnameisalegendastohoweachtypeoflineisformed.Solookingatthefirstactuallineofthecontents:

/D102440755user::rwx,group::rx,mask:rx,other:rx481d0e4300

Weseethatthefnmaeis/,itisadirectory,withasizeof1024.Itsmodeis755,thelastmodifiedtimeisthe"481d0e43"anditisownedbyuid0andgid0.

Lookingatafileinparticularweseethis:

/httpd/htdocs/index.htmlF10100644user::rw,group::r,mask:r,other:r463d4f4b00b7a9369d4cc9f82ed707bce91ced8af8

Intheabove,weseethatthefileis10bytes,hasapermissionsof644andisownedbyroot/root.

NowsupposethatIforsomereasonbyaccidentwasinthe/httpd/htdocsdirectoryanddidachmodR777*.SinceIhadmycontrolmanifest,Iwouldthenrunanotherbartandthenusethecompareoption.WhatIwouldgetissomethinglikethis:

#bartcompare/tmp/bart.output/tmp/bart.output2/httpd/htdocs/index.html:modecontrol:100644test:100777aclcontrol:user::rw,group::r,mask:r,other:rtest:user::rwx,group::rwx,mask:rwx,other:rwx

Herewecanseethatthepermissionshaschangedfrom644to777.Buttheoutputisnotreallyeasytoparsewithascript.Soweneedtousethe"p"optiononthebartcompare:

#bartcomparep/tmp/bart.output/tmp/bart.output2/httpd/htdocs/index.htmlmode100644100777acluser::rw,group::r,mask:r,other:ruser::rwx,group::rwx,mask:rwx,other:rwx

Intheabove,sincetheonlythingthatwaschangedwasthemode,thatistheonlythingthatislisted.

herearesomeotherexamples:

/var/samba/locks/browse.datmtime482f8544482f8800/var/samba/locks/unexpected.tdbcontents7c3404e9622749702e3df56caf26fe7272983947ada3260a236394a51aef0d31

Thefirstlineshowsthatthefilebrowse.datmodifytimechanged,butnothingelse.Thesecondlineshowsthattheunexpected.tdbhadit'scontentschange.Thiscanbeenseebythe2differenthashes.

Hereisanotherexampleoftheindex.htmlfileabove,afterithadbeenedited:

bash3.00#bartcompare/tmp/bart.out/tmp/bart.out3/httpd/htdocs/index.html:sizecontrol:10test:26modecontrol:100644test:100777aclcontrol:user::rw,group::r,mask:r,other:rtest:user::rwx,group::rwx,mask:rwx,other:rwxmtimecontrol:463d4f4btest:482f8b89contentscontrol:b7a9369d4cc9f82ed707bce91ced8af8test:1567caf683e3859cb5da7335c35438f7

Onceagainthisisinthe"human"readableformat,the"machine"readablelookslike:

Thecontentonsungeek.netisprovidedASIS,andWITHOUTANYWARRANTY.Allopinionsarepersonalandinnowayreflectanyorganization.Theauthorwillnotbeheldliableforanyproblemsresultingfromtheinformationprovidedhere.Copyright2015unixwizLightwordThemebyAndreiLuca Gototop

Taggedas:Security,ShellScripts,Solaris,tips,ZFS CommentsOff

FreakingSweetAcrobatReaderonSolarisx86 PacManJonesinDallas

bash3.00#bartcomparep/tmp/bart.out/tmp/bart.out3/httpd/htdocs/index.htmlsize1026mode100644100777acluser::rw,group::r,mask:r,other:ruser::rwx,group::rwx,mask:rwx,other:rwxmtime463d4f4b482f8b89contentsb7a9369d4cc9f82ed707bce91ced8af81567caf683e3859cb5da7335c35438f7

(theaboveisactuallyallononeline.)

Onceyouhavetheoutputofthebartafterthe"oops"youwillneedtorunthebartcomparewithoptionstoignoresomeitems.SinceIamonlyinterestedinthemode,thesize,mtimeandcontentscanbeignored.Iusedthefollowing:

bash3.00#bartcompareisize,mtime,contents,uid,gidp/tmp/bart.out/tmp/bart.out2

Thisonlyshowsfilesthathavehadtheirmodechanged:

bash3.00#bartcompareisize,mtime,contents,uid,gidp/tmp/bart.out/tmp/bart.out2/httpd/htdocs/index.htmlmode100644100777acluser::rw,group::r,mask:r,other:ruser::rwx,group::rwx,mask:rwx,other:rwx

Youshouldredirectthisoutputtoafile,sothatitcanthenbeusedtogenerateascript.WiththeoutputinafileIthendidthis:

cat/tmp/bart.compare|awk'{print"chmod"$3""$1}'>/tmp/CHANGEPERMS

SobasiclyIcatthefileandprintthechmodcommandallongwiththe3rdfield(100644)andthenthefirstfield(/httpd/htdocs/index.html)andredirectthistoanewfile.OnceIspotcheckthisfile,youcanthenrunitanditwill"reset"thepermissionsback.

NoweverythingIhaveshownaboveisbasedonthemachinehavingaUFSfilesystem.IfyourunbartagainstafilesystemthatisZFS,youwillgetamanifestthatlookssomethinglikethis:

/home/unixwiz/bin/phpF10587732100755owner@::deny,owner@:read_data/write_data/append_data/write_xattr/execute/write_attributes/write_acl/write_owner:allow,group@:write_data/append_data:deny,group@:read_data/execute:allow,everyone@:write_data/append_data/write_xattr/write_attributes/write_acl/write_owner:deny,everyone@:read_data/read_xattr/execute/read_attributes/read_acl/synchronize:allow4743a7fa100149b8cfb15ed069bd6e43d7c2ae11a3e23

ItshowstheZFSextendedacl's.

Soifyouhaven'tstartedusingbart,youshouldstartassoonaspossible.

Postedbyunixwiz

Sorry,thecommentformisclosedatthistime.

Comments(0) Trackbacks(0) (subscribetocommentsonthispost)