The Second Commandment of system administration (NewsForge) [LWN.net]

NewsForge takes a look at integrity checkers. "Each integrity checker is a little different, so do some research before deciding on one. There are many excellent integrity checking applications out there, but the one I recommend and prefer is called afick (Another File Integrity ChecKer). Afick offers several advantages over integrity checkers such as Tripwire and AIDE. The first and foremost difference is that afick is written in Perl, which gives it the advantage of speed. Afick finishes the initialization of the database that stores filesystem attributes almost a minute faster than AIDE. Being written in Perl also means that afick is highly portable between operating systems."

to post comments

The Second Commandment of system administration (NewsForge)

Posted May 3, 2005 4:28 UTC (Tue) by mightyduck (guest, #23760) [Link] (2 responses)

Sorry, but they should have thought about the name. No way that's gonna
fly in a Germany-based company. The next thing they'll write will be
Another File Update ChecKer ;-)?

International issues

Posted May 4, 2005 0:46 UTC (Wed) by bignose (subscriber, #40) [Link] (1 responses)

> Sorry, but they should have thought about the name.

The name "AIDE", I presume you mean?

> No way that's gonna fly in a Germany-based company.

An automatic translation tool just gives me back the word "aide", which is apparently a valid word in both German and English.

Don't keep us in suspense. What's wrong with "AIDE" in Germany?

International issues

Posted May 4, 2005 6:04 UTC (Wed) by xoddam (subscriber, #2322) [Link]

'afick' is about as much a word in German as 'fsck' is in English.
Definitely not in the dictionary. So I don't see it being a problem.

The Second Commandment of system administration (NewsForge)

Posted May 3, 2005 6:06 UTC (Tue) by evgeny (subscriber, #774) [Link] (4 responses)

> The first and foremost difference is that afick is written in Perl, which gives it the advantage of speed.

Perl gives "the advantage of speed"?! Granted, an algorithm can be implemented badly in C and then, compared to the corresponding Perl's _built-in_ version (written in C, of course) which has been tuned and polished for years, would be indeed inferior. But then this applies to any language-to-language comparison. Now I'll wait for someone to state that some utility is written in Java for the sake of performance...

Perl

Posted May 3, 2005 11:13 UTC (Tue) by ncm (guest, #165) [Link]

I laughed too. "Another advantage of Perl is that it is almost unmaintainable, and even entirely unchanged promises to stop working when the Perl interpreter or library installed is updated. This provides an opportunity for accelerated evaluation of alternative programs."

Perl

Posted May 3, 2005 12:29 UTC (Tue) by clugstj (subscriber, #4020) [Link] (2 responses)

Well, if the others are written as shell scripts, then Perl does provide a speed advantage. It all depends upon what you compare it to.

Perl

Posted May 3, 2005 13:07 UTC (Tue) by evgeny (subscriber, #774) [Link] (1 responses)

> Well, if the others are written as shell scripts

In the sentence, it's compared to tripwire and aide. These are written in C.

Perl

Posted May 3, 2005 22:19 UTC (Tue) by rickmoen (subscriber, #6943) [Link]

evgeny wrote:

In the sentence, it's compared to tripwire and aide. These are written in C.

<pedantic>Technically, Tripwire's C++.</pedantic>

Rick Moen
rick@linuxmafia.com

Another approach: file change notification

Posted May 3, 2005 13:46 UTC (Tue) by bkw1a (guest, #4101) [Link] (1 responses)

Around here, I use a script based on FAM to monitor a set of files for changes. The files include things like /bin/login, /bin/ps, etc... This approach has its pros and cons, but one big "pro" is that you can set it and forget it. No need to rebuild a database whenever something changes.

Here's a link to some (out of date) documentation: http://ayesha.phys.virginia.edu/~bryan/projects/famids/

It's sloppy, but it works well for me.

Another approach: file change notification

Posted May 3, 2005 14:01 UTC (Tue) by evgeny (subscriber, #774) [Link]

> No need to rebuild a database whenever something changes.

Well, you do want to notice when something changes; that's the point of the tool ;-). Seriously, these should be integrated with package management tools, so whenever I install something with e.g. apt-get, the aide database gets updated automatically (but only for files installed with apt, of course).

The Second Commandment of system administration (NewsForge)

Posted May 3, 2005 20:43 UTC (Tue) by crouchet (guest, #1084) [Link]

2nd Commandment, huh? Did I miss seeing the list? Is their a new (and apparently not too bright) security deity handing down commandments?

While integrity checking is important I think there are several other practices that would have to come before it. Some examples might be:

Physically secure your system.
Protect your system with secure password access.
Don't allow other systems to connect to yours in an insecure way.
Don't run insecure software.
Don't operate as root/administrator.

Just to name a few. Just think, if you had to CHOOSE whether to have passwords OR integrity checking but not both, which would you choose? This "what if" process makes the real priorities clear.