mtree vs tripwire

[adrian+freebsd-security at ubergeeks.com (Adrian Filipi)]

On Wed, 14 Jan 2004, D J Hawkey Jr wrote:

> On Jan 14, at 07:09 PM, Jesper Louis Andersen wrote:
> >
> > > This might seem really naive, but can mtree be used effectively as
> > > a native-to-core-OS tripwire equivalent? Would it be as efficient in
> > > terms of time-to-run and resource requirements?
> >
> > Pro: distributed with base
> > Con: Only available for *BSD architectures as far as my knowledge goes.
>
> I'm aware of both, yes; hence my question. FreeBSD is all I'm dealing
> with, where my question is concerned.
>
> Is your reply from personal experience, or is it the same "Hey, it
> could..." as is my question? If the former, would you elaborate on the
> implementation details?
>
> Thanks,
> Dave

	The company I just left makes a security appliance, and we
developed an mtree-based IDS.  As others have mentioned, raw mtree and diff
as-is leaves a lot to be desired.  It's just not very conveneint.

	That being said, its works great now that we wrapped it all up in
some wrapper scripts.

	Adrian
--
[ adrian_(_at_)_ubergeeks_(_dot_)_com ]