/[tiger]/tiger/man/tiger.8
ViewVC logotype

Contents of /tiger/man/tiger.8

Parent Directory Parent Directory | Revision Log Revision Log


Revision 1.1 - (show annotations) (download)
Fri Jun 14 08:51:31 2002 UTC (21 years, 10 months ago) by jfs
Branch: MAIN
CVS Tags: version_3_2
First release of the new tiger source code base. This code is based on the
2.2.4p2 release and integrates:
- TARA's (ARSC) fixes and scripts
- Debians's fixes and new scripts
- HP's new scripts

(note: some system scripts are missing due to problems with the CVS server)

1 .\" @(#)tiger.8 1.00 93/06/04 TAMUSCC;
2 .TH TIGER 8 "27 March 2002" "Security" "Administrator Commands"
3 .SH NAME
4 tiger \- UNIX Security Checker
5 .SH SYNONPSIS
6 .B "tiger [-B tigerdir] [-l logdir] [-w workdir] [-b bindir] [-e|-E] [-S] [-H] [-c tigerrc]"
7 .LP
8 .SH DESCRIPTION
9 .LP
10 Tiger is a package consisting of Bourne Shell scripts, C code and
11 data files which is used for checking for security problems on a
12 UNIX system. It scans system configuration files, file systems,
13 and user configuration files for possible security problems and
14 reports them. The command
15 .B tigexp(8)
16 can be used to obtain explanations of the problems reported by
17 .I tiger.
18 .SS OPTIONS
19 .TP
20 .I "\-B"
21 Specify the directory where
22 .I tiger
23 is installed. If not specified, the current directory is used.
24 .TP
25 .I "\-d"
26 Specify the name of the directory where
27 .I tiger
28 will write the security report. This defaults to the current directory.
29 The filename of the report will
30 be of the form
31 .RI 'security.report. hostname.date.time.'
32 .TP
33 .I "\-w"
34 Specify a directory to use for creating scratch files. This defaults
35 to
36 .I /tmp.
37 .TP
38 .I "\-b"
39 Specify the directory which contains (or will contain) the binaries
40 generated from the C modules. If the systems directories contain
41 all the binaries, they will be used directly from there. If not,
42 then if the
43 .I bindir
44 contains the binaries, these will be used. If none are found in
45 either place, then an attempt will be made to compile the C code
46 and install the executables into the
47 .I bindir.
48 .TP
49 .I "\-c"
50 Specify an alternate name for the
51 .I tigerrc
52 control file. The default is 'tigerrc'.
53 .TP
54 .I "\-e"
55 This option will cause explanations to be inserted into the security
56 report following each message. This can greatly increase the size
57 of the report, as explanations may appear repeatedly.
58 .TP
59 .I "\-E"
60 This option indicates that a separate explanation report should be
61 created, with explanations for each type of message only appearing
62 once. The filename of the explanation report will be of the form
63 .RI 'explain.report. hostname.date.time.'
64 .TP
65 .I "\-H"
66 This option will format the report into HTML creating local links
67 to the problem descriptions.
68 .TP
69 .I "\-S"
70 This option indicates that a surface level check of the configuration
71 files of any diskless clients served by this machine should be checked
72 at the same time. The checks will not be as in depth as they would be
73 if run on the client itself.
74 .LP
75 .SH MODULES
76 .LP
77 .B Tiger
78 is composed of a series of modules. Each of these modules check specific
79 security issues related to UNIX systems. The framework provided by
80 .B Tiger
81 allows the provision of both generic modules and those specific for
82 the operating system the software runs in. Modules can be executed
83 stand alone, from cron or through the
84 .B tiger
85 program (which will execute all those available).
86 .TP
87 .I check_accounts
88 Checks the accounts provided in the system, looking for disabled accounts
89 with cron, rhosts, .forward, and valid shells.
90 .TP
91 .I check_aliases
92 Performs a check for mail aliases and improper configuration.
93 .TP
94 .I check_anonftp
95 Determines if the anonymous FTP service is properly configured.
96 .TP
97 .I check_cron
98 Validates the cron entries in the system.
99 .TP
100 .I check_embedded
101 Determines if embedded pathnames are configured properly.
102 .TP
103 .I check_exports
104 Analyses configuration files for NFS exported filesystems to see if
105 access is properly restricted.
106 .TP
107 .I check_group
108 Checks the UNIX groups available in the system, looking for conflicts
109 and improper entries.
110 .TP
111 .I check_inetd
112 Checks the inetd configuration file: compares against services
113 definition, valid directory paths, non-existant binaries and active
114 services.
115 .TP
116 .I check_known
117 Looks for known intrusion signs including backdors and mail spools.
118 .TP
119 .I check_netrc
120 Checks if users's netrc files are insecurely configured.
121 .TP
122 .I check_nisplus
123 Looks for wrong configuration in the NIS+ entries.
124 .TP
125 .I check_passwd
126 Checks the UNIX users available in the system, looking for conflicts
127 and improper entries.
128 .TP
129 .I check_path
130 Validates the binaries in user's PATHs as well as PATH definitions
131 used by scripts in order to determine insecure definitions.
132 .TP
133 .I check_perms
134 Check filepermissions and inconsistencies.
135 .TP
136 .I check_printcap
137 Analyses the configuration for the printer control file.
138 .TP
139 .I check_rhosts
140 Checks rhosts files in order to see if user's configuration leaves the
141 system open to attack.
142 .TP
143 .I check_sendmail
144 Checks sendmail configuration files.
145 .I check_signatures
146 Compares binary files signatures against those stored in the local database
147 (provided with the program).
148 .TP
149 .I check_system
150 This module calls the operating system's specific modules available at
151 .B /usr/lib/tiger/systems/
152 .
153 .TP
154 .I check_devices
155 Checks for devices's permissions, warning about devices that have world
156 permissions.
157 .TP
158 .I check_logfiles
159 Checks for the existance of log files (wtmp, btmp, lastlog and utmp). It
160 will also check for proper umask settings.
161 .TP
162 .I check_listeningprocs
163 Checks for processes listening on TCP/IP sockets (servers) in the system as
164 well as users running them. Will warn if the user running a server is not
165 an authorised one or if the server is listening on all available interfaces.
166 .TP
167 .I check_patches
168 Checks if patches are available for the system (i.e. new packages).
169 It will use autorpm or apt-get to check this (so this tools need to be
170 properly configured). This check is specific to Linux (RedHat or Debian).
171 .TP
172 .I check_root
173 Checks if remote root login is allowed to the local system.
174 .TP
175 .I check_rootdir
176 Checks the permissions for the root directory.
177 .TP
178 .I check_single
179 Checks if the system is properly configured to disallow single-user
180 access. This check is specific to Linux.
181 .TP
182 .I check_lilo
183 Analyses configuration files for lilo and grub boot loaders (Linux-specific).
184 .TP
185 .I check_release
186 Analyses the verions of the operating system and determines if it is
187 too out of date. This check is specific to Linux (RedHat or Debian).
188 .TP
189 .I deb_checkadvisories
190 This module checks against a list of stored Debian Security
191 Advisories in order to see if the system has any package installed
192 whose version might be subject to any security vulnerability (Debian-specific).
193 .TP
194 .I deb_checkmd5sums
195 Compares the MD5 sums of binary files against those provided after installation.
196 Changes in these files might be an indication of a compromised system
197 (Debian-specific).
198 .TP
199 .I deb_nopackfiles
200 Looks for files installed in the system's directories that are not provided
201 by any installed Debian packages (Debian-specific).
202 .LP
203 .SH SEE ALSO
204 tigexp(8)
205 .LP
206 .SH BUGS
207 There are a lot more things to check.
208 .LP
209 Some places in the package are not shell meta-character or white-space
210 safe.
211 .LP
212 For Debian-specific (known) bugs read the
213 .B /usr/share/doc/tiger/README.Debian
214 document or the
215 .B http://bugs.debian.org/tiger
216 webpage.
217 .SH AUTHOR
218 .B Tiger
219 was originally developed by a team of the
220 Texas A&M University Supercomputer Center, as of september 1993,
221 the development done via the Network Group, Computing & Information Services.
222 .PP
223 This software was written originally by Douglas Lee Schales, Dave K. Hess, Khalid Warraich,
224 and Dave R. Safford (circa 1993)
225 .PP
226 A
227 .B lot
228 of changes were introduced by the ARSC team (a.k.a. the TARA team)
229 Liam Forbes <lforbes at arsc.edu>, Nathan Bills <bills@arsc.edu> and
230 Mike Kienenberger <mkienenb at arsc.edu>, including support for quite a number of
231 operating systems.
232 .PP
233 The adaptation for the GNU/Linux operating system was made by
234 Robert L. Ziegler <rlz at mediaone.net>
235 .PP
236 The modifications for the Debian GNU/Linux operating system have been made
237 by Javier Fernandez-Sanguino Peņa <jfs at computer.org>, including a new check for the GNU/Linux
238 operating systems (
239 .B gen_listeningprocs
240 ) and some specific for Debian (
241 .B deb_checkadvisories
242 ,
243 .B deb_checkmd5sums
244 and
245 .B deb_nopackfiles
246 ).

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26