
NOTES on signatures
-------------------

Tiger has two generic checks to test in UNIX systems: check_perms,
and check_signatures. 'Check_perms' can check if the filesystem
permissions correspond to those after installation. 'Check_signatures'
checks if the MD5 sums of a list of files correspond to those 
known to be vulnerable in a given operating system.

However, notice that for this checks to properly work the system
signatures have to be up to date. The two files involved in this
are 'signatures' and 'file_access_list' under the directories of the
operating systems (systems/).

Note that this files might not be as up to date as it would be desired for
some operating systems. 

If you want to generate fresh signature and file_access_list for your
system you can use the scripts 'util/mksig' and 'util/mkfilelst' which
will, respectively, create a signatures.$OS-$REV-$ARCH and
file_access_list.$OS-$REV-$ARCH file in the current directory you can
install under the appropriate systems/$OS/$REV/$ARCH directory (and
rename them to 'signatures' and 'file_access_list')

You can retrieve updated signatures (MD5 and SHA-1 signatures) from
different sources including:

- http://www.knowngoods.org/download.html (these will probably be in the 
near future too), for a good discussion on this service check
http://slashdot.org/articles/02/12/09/0411224.shtml?tid=172

# TODO: add pointer to NIST reference list

Some vendors provide signatures or patch information for their
operating systems:

- Sun has a web interface for MD5 sums of Solaris
  at http://sunsolve.sun.com/pub-cgi/fileFingerprints.pl
  As well as a patch tools based on patchdiag.xref available at:
  http://sunsolve.sun.com/pub-cgi/patchDownload.pl?target=patchdiag.xref&method=H

- IBM provides a list of APAR fixes at 
  http://techsupport.services.ibm.com/server/aix.CAPARdb
  http://techsupport.services.ibm.com/server/LatestFixData51
  http://techsupport.services.ibm.com/server/aix.fdc51
  http://techsupport.services.ibm.com/server/aix.fixsearch5L

Notice that the old location for signatures (at TAMU
http://www.net.tamu.edu/ftp/security/TAMU/tiger-sigs/) have already
been integrated into the latest tiger source code.

--- Javier Fernandez-Sanguino Pen~a  <jfs@computer.org>
Wed, 13 Aug 2003 03:35:59 +0200
