.TH TIGERCRON 8 "19 September 2003" "Security" "Administrator Commands" .SH NAME tigercron \- Cron utility for Tiger UNIX Security Checker .SH SYNOPSIS .B tigercron .RI [ controlfile ] .RB [ -B .IR basedir ] .RI [ tigeroptions ...] .LP .SH DESCRIPTION .LP \fBTigercron\fR is used to run periodically checks from the Tiger UNIX Security Checker. \fBTigercron\fR reads a control file which is usually located in '@tigerconfigdir@/cronrc' although it can also be specificied as the first argument when calling the program. The format of this control file is the same as for the \fBcron\fR program, each line indicates when different checks from \fBTiger\fR will be run. The user can indicate where Tiger is installed through the \fB-B basedir\fR parameter, any other additional options provided in the command line will be passed on to configure to configure \fBTiger\fR based on them (as described in \fBtiger (8)\fR). \fBTigercron\fR runs the specified checks and compares their reports with previous stored reports (under @tigerlogdir@). It will then mail the user defined in '@tigerconfigdir@/tigerrc' (\fITiger_Mail_RCPT\fR) the results. When a module is run, \fBtigercron\fR checks: .IP \(bu 4 If \fITiger_Cron_Template\fR is set to Y in tigerrc. If it is, it checks if there is a template stating which are the expected results. .IP \(bu 4 If \fITiger_Cron_CheckPrev\fR is set to Y in tigerrc. If it is, it checks if there is a previous run of the module it can check against. .PP A differential report is generated depending on the module reports and previous run and is sent through e-mail. These reports provide an easy way to detect intrusions even if no configuration of templates has been done. In the event of an intrusion a \fBTiger\fR check might detect something specific (file changes, new processes, new users, etc.) and this alert mechanism provides a way to turn \fBTiger\fR into a Host Intrusion Detection System (HIDS). The ability of it to work as a proper HIDS is based on a good customization of the cronrc file. Modules that check events to which the host is most exposed to should be run often in order to detect deviations from normal behaviour. .SH OPTIONS \fBTigercron\fR uses the same options as \fBTiger\fR. A controlfile can be defined also to override the default. .SH FILES .TP .I @tigerconfigdir@/tigerrc Configuration file for the .B Tiger tool. .TP .I @tigerconfigdir@/cronrc Configuration file for the .I Tigercron tool. .TP .I @tigerlogdir@ Location of the log messages generated by .B Tiger when run through .I cron .TP .I @tigerworkdir@ Working directory used by .B Tiger scripts to create temporary files. .SH SEE ALSO .BR tigexp (8), tiger (8), cron (8), crontab (5) The deficiencies of using \fBtigercron\fR as a HIDS are described in the file README.hostids which is provided with the package. In Debian GNU/Linux you will find this (and other related) documentation at /usr/share/doc/tiger/ .SH BUGS Currently \fBTigercron\fR has only one alert mechanism (mail) and signatures are not supported. Thus, alerts could be faked. Also, it is dependant on \fBcron\fR and will not work if \fBcron\fR is not working. .SH AUTHOR This manpage was written by Javier Fernandez-Sanguino.