
Tiger was not, obviously, created or developed at the margin of other
security information sources and tools. The following (incomplete) list
indicates which sources and tools have been used to improve Tiger. Note
that, in the case of tools, no code has been included directly into 
Tiger since some of the tools below are not GPL but use some other license,
or they have been developed in other programming languages (usually Perl).

Information Sources:
-------------------

- "Practical UNIX & Internet Security" by Simon Garfinkel and Gene Spafford.
  (http://www.oreilly.com/catalog/puis/). A _must_ read (although some issues
  are dated) I still need to read the third edition though 
  (http://www.oreilly.com/catalog/puis3/)

- NIST Security Check Lists (has both a generic UNIX checklist and specific
  to some OS):
  http://csrc.nist.gov/pcig/cig.html

- NSA's Security Confguration Guides, provides some Checklists for UNIX 
  operating systems (Solaris-only at the time of this writting)
  http://ww.nsa.gov/snac

- CERT's Security Improvement Modules
  available at http://www.cert.org/security-improvement/

- CERT's UNIX configuration guidelines
  http://www.cert.org/tech_tips/unix_configuration_guidelines.html

- CERT's UNIX Security Checklist v2.0
  http://www.cert.org/tech_tips/usc20_full.html
  http://www.auscert.org.au/render.html?it=1935&cid=1920

- SANS's SCORE (Security Consensus Operational Readiness Evaluation)
  http://www.sans.org/score/
  and the Step by Step Guides
  available at http://store.sans.org/store_category.php?category=consguides
  
- SANS's Intrusion Detection FAQ: How to Examine a Unix Box for 
  Possible Compromise. 
  http://www.sans.org/resources/idfaq/unixbox.php

- Security Patches FAQ (rather out of date, but some things still useful)
  http://www.faqs.org/faqs/computer-security/security-patches/

For generic information on OS behavior:
---------------------------------------
- For Linux:
	Linux manpages available at  http://www.tldp.org/docs.html#man
	(searchable at http://www.linux101.org/site/man.php?)
	Securing Debian Manual:
	http://www.debian.org/doc/manuals/securing-debian-howto/index.en.html
	RedHat's Security Guide: 
	http://www.redhat.com/docs/manuals/linux/RHL-9-Manual/security-guide/
	and many other documentation at The Linux Documentation Project
	(http://www.tldp.org/)
	Comp.os.linux security FAQ:
		http://www.linuxsecurity.com/docs/colsfaq.html

- For Solaris
  Reference information for the Solaris Operating Environment, 
  available at http://soldc.sun.com/documentation/reference/index.html
  including the Solaris manpages: 
  	http://docs.sun.com/db?p=subj/manpages_solaris
  Sun Security Patches:
  	http://sunsolve.sun.com/pub-cgi/show.pl?target=patches/patch-license&nav=pub-patches

- For AIX 
  AIX 5.x manpages: http://publib16.boulder.ibm.com/cgi-bin/ds_form?lang=en_US&viewset=AIX
  AIX 4.3 manpages: http://publib.boulder.ibm.com/cgi-bin/ds_form?lang=en_US
  AIX 4.3 documentation library:
  	http://publib.boulder.ibm.com/cgi-bin/ds_form?lang=en_US
  IBM Redbooks http://www.redbooks.ibm.com/
     1) Elements of Security: AIX 4.1, GG24-4433-00.
     2) AIX 4.3 Elements of Security Effective and Efficient 
        Implementation, SG24-5962-00.
     3) Additional AIX Security Tools on IBM pSeries, IBM RS/6000, and
        SP/Cluster, SG24-5971-00.
     4) TCP/IP Tutorial and Technical Overview, GG24-3376-06.
     5) IBM Certification Study Guide AIX Installation and System Recovery. 

- For HP-UX
  HP-UX manpages: http://docs.hp.com/hpux/os/man_pages.html
  Network security Features of HP-UX 11i: 
  	http://docs.hp.com/hpux/onlinedocs/2238/netsecur_final.pdf
  Security Patch check:
  	http://docs.hp.com/hpux/onlinedocs/internet/spc_faq.html
	http://docs.hp.com/hpux/onlinedocs/internet/spc_readme.html
  HP-UX trusted system:
  	http://docs.hp.com/hpux/onlinedocs/B2355-90121/B2355-90121.html
	(security update for HP-UX 10.20
	http://docs.hp.com/hpux/onlinedocs/internet/SecUpdate1202.html)
  HP-UX FAQ: http://www.faqs.org/faqs/hp/hpux-faq/preamble.html
  (specially the 'Auditing and Security' section 5.1)
  
- For OpenBSD (for future porting)
  OpenBSD manpages: http://www.openbsd.org/cgi-bin/man.cgi

- For IRIX
  Security information:
  http://www.sgi.com/support/security/
  http://www-viz.tamu.edu/~sgi-faq/faq/html-1/security.html
  Manpages:
  http://techpubs.sgi.com/library/tpl/cgi-bin/init.cgi


Other (related) tools:
----------------------

There are a number of security tools that have inspired Tiger in some way,
either in philosophy or checks. Some of the tools below are not specifically
auditing tools but hardening tools (such as Titan or Bastille) and Tiger
has been configured to check for the default not-secure configurations that
they have been programmed to fix. 

- Dan Farmer's COPS (Computer Oracle and Password System) developed in 1989
  [unfortunately, it was distributed with a 'non-free' license]

- Titan (written by Brad Powell, Matt Archibald, and Dan Farmer), an auditing
  and hardening tool for FreeBSD, Linux and Solaris
  http://www.fish.com/titan/

- Bastille-Linux, a hardening tool for Linux and HP-UX


As for Titan, the following modules are implemented in Tiger checks:

create-issue.sh (FreeBSD, Linux Generic, RedHat, Solaris) -> check_issue
ftpusers.sh (FreeBSD, Linux Generic, RedHat, Solaris) -> check_ftpusers
inetd.sh (FreeBSD, Linux Generic, RedHat, Solaris) -> check_inetd 
	Note: does not warn for all 'chatty' services though, needs
	to be improved
log_in_vain.sh (FreeBSD) -> not implemented (yet)
nuke-inetd.sh (FreeBSD) -> not implemented 
nuke-portmap.sh (FreeBSD) -> not implemented 
nuke-sendmail.sh (FreeBSD, Linux Generic, RedHat, Solaris) -> not implemented
telnet-banner.sh (FreeBSD, Linux Generic, RedHat, Solaris) -> not implemented
inetd_flags.sh (FreeBSD) -> not implemented

Note that the FreeBSD versions are not implemented since FreeBSD is not
yet a supported system in Tiger.

Other Titan modules have not been reviewed yet and need to be checked.


--- Javier Fernandez-Sanguino jfs@computer.org
Mon, 18 Apr 2005 23:45:32 +0200

