An Oracle White Paper April 2005 Integrating BART and the Oracle Solaris Fingerprint Database in the Oracle Solaris 10 Operating System Important note: this paper was originally published before the acquisition of Sun Microsystems by Oracle in 2010. The original paper is enclosed and distributed as-is. It refers to products that are no longer sold and references technologies that have since been re-named. Integrating BART and the Solaris™ Fingerprint Database in the Solaris 10 Operating System Glenn Brunette, Client Solutions Sun BluePrints™ OnLine—April 2005 A Sun BluePrints Cookbook http://www.sun.com/blueprints Sun Microsystems, Inc. 4150 Network Circle Santa Clara, CA 95045 U.S.A. 650 960-1300 Part No. 819-2260-10 Revision 1.0, 3/23/05 Edition: April 2005 Copyright 2005 Sun Microsystems, Inc. 4150 Network Circle, Santa Clara, California 95045 U.S.A. All rights reserved. Sun Microsystems, Inc. has intellectual property rights relating to technology embodied in the product that is described in this document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S. patents listed at http://www.sun.com/patents and one or more additional patents or pending patent applications in the U.S. and in other countries. This product or document is protected by copyright and distributed under licenses restricting its use, copying, distribution, and decompilation. No part of this product or document may be reproduced in any form by any means without prior written authorization of Sun and its licensors, if any. Third-party software, including font technology, is copyrighted and licensed from Sun suppliers. Parts of the product may be derived from Berkeley BSD systems, licensed from the University of California. UNIX is a registered trademark in the U.S. and other countries, exclusively licensed through X/Open Company, Ltd. Sun, Sun Microsystems, the Sun logo, Sun BluePrints, SunSolve, SunSolve Online, docs.sun.com, JumpStart, N1, and Solaris are trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and other countries. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. in the U.S. and other countries. Products bearing SPARC trademarks are based upon an architecture developed by Sun Microsystems, Inc. The OPEN LOOK and Sun™ Graphical User Interface was developed by Sun Microsystems, Inc. for its users and licensees. Sun acknowledges the pioneering efforts of Xerox in researching and developing the concept of visual or graphical user interfaces for the computer industry. Sun holds a non-exclusive license from Xerox to the Xerox Graphical User Interface, which license also covers Sun’s licensees who implement OPEN LOOK GUIs and otherwise comply with Sun’s written license agreements. U.S. Government Rights—Commercial use. Government users are subject to the Sun Microsystems, Inc. standard license agreement and applicable provisions of the FAR and its supplements. DOCUMENTATION IS PROVIDED “AS IS” AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON- INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. Copyright 2005 Sun Microsystems, Inc. 4150 Network Circle, Santa Clara, Californie 95045 Etats-Unis. Tous droits réservés. Sun Microsystems, Inc. détient les droits de propriété intellectuels relatifs à la technologie incorporée dans le produit qui est décrit dans ce document. En particulier, et ce sans limitation, ces droits de propriété intellectuelle peuvent inclure un ou plus des brevets américains listés à l’adresse http://www.sun.com/patents et un ou les brevets supplémentaires ou les applications de brevet en attente aux Etats - Unis et dans les autres pays. Ce produit ou document est protégé par un copyright et distribué avec des licences qui en restreignent l’utilisation, la copie, la distribution, et la décompilation. Aucune partie de ce produit ou document ne peut être reproduite sous aucune forme, par quelque moyen que ce soit, sans l’autorisation préalable et écrite de Sun et de ses bailleurs de licence, s’il y en a. Le logiciel détenu par des tiers, et qui comprend la technologie relative aux polices de caractères, est protégé par un copyright et licencié par des fournisseurs de Sun. Certaines parties de ce produit pourront être dérivées des systèmes Berkeley BSD licenciés par l’Université de Californie. UNIX est une marque enregistree aux Etats-Unis et dans d’autres pays et licenciée exclusivement par X/Open Company, Ltd. Sun, Sun Microsystems, le logo Sun, Sun BluePrints, SunSolve, SunSolve Online, docs.sun.com, JumpStart, N1, et Solaris sont des marques de fabrique ou des marques déposées de Sun Microsystems, Inc. aux Etats-Unis et dans d’autres pays. Toutes les marques SPARC sont utilisées sous licence et sont des marques de fabrique ou des marques déposées de SPARC International, Inc. aux Etats-Unis et dans d’autres pays. Les produits portant les marques SPARC sont basés sur une architecture développée par Sun Microsystems, Inc. L’interface d’utilisation graphique OPEN LOOK et Sun™ a été développée par Sun Microsystems, Inc. pour ses utilisateurs et licenciés. Sun reconnaît les efforts de pionniers de Xerox pour la recherche et le développement du concept des interfaces d’utilisation visuelle ou graphique pour l’industrie de l’informatique. Sun détient une licence non exclusive de Xerox sur l’interface d’utilisation graphique Xerox, cette licence couvrant également les licenciés de Sun qui mettent en place l’interface d’utilisation graphique OPEN LOOK et qui en outre se conforment aux licences écrites de Sun. CETTE PUBLICATION EST FOURNIE “EN L’ETAT” ET AUCUNE GARANTIE, EXPRESSE OU IMPLICITE, N’EST ACCORDEE, Y COMPRIS DES GARANTIES CONCERNANT LA VALEUR MARCHANDE, L’APTITUDE DE LA PUBLICATION A REPONDRE A UNE UTILISATION PARTICULIERE, OU LE FAIT QU’ELLE NE SOIT PAS CONTREFAISANTE DE PRODUIT DE TIERS. CE DENI DE GARANTIE NE S’APPLIQUERAIT PAS, DANS LA MESURE OU IL SERAIT TENU JURIDIQUEMENT NUL ET NON AVENU. Please Recycle Integrating BART and the Solaris™ Fingerprint Database in the Solaris 10 Operating System In a previous Sun BluePrints™ Cookbook (Automating Centralized File Integrity Checks in the Solaris™ 10 Operating System), we discussed how to centralize and automate the collection of file integrity information using the Solaris™ 10 Operating System (Solaris 10 OS) Basic Audit and Reporting Tool (BART), Solaris 10 OS Process Privileges, Role-based Access-Control, and Secure Shell. This Sun BluePrints Cookbook describes how to quickly and easily authenticate BART manifests using the Solaris Fingerprint Database (sfpDB). Using this process, you can determine whether there exist any files within the BART manifest that have been modified from the way in which they were shipped by Sun. This information is crucial when deciding how much trust can be placed in the validity of the files at the time the BART manifest was generated. About BART and sfpDB Before you begin the process of integrating BART and sfpDB, it’s important to understand more about them—what they are, how they differ, and how they can be used to complement one another. Basic Audit and Reporting Tool BART is a tool that collects and compares a variety of attributes of filesystem objects installed on a system. For example, with BART, you can detect file ownership, permissions, and content changes. While this kind of functionality is clearly useful 1 for security incident detection, it is also often used as part of a larger change management process to validate approved changes and to detect those that may have occurred outside of an approved process. Collecting Filesystem Object Attributes BART collects filesystem object attributes, such as name, size, permissions, access control lists, UID, GID, and so on. The exact attributes collected depend on the type of object being evaluated. Each time that BART is run, it captures point in time information (snapshot) about the filesystem. For more information about the attributes collected, see bart(1M). Comparing System Snapshots You can also use BART to compare any two independent BART snapshots to determine whether there have been any changes made to the objects being assessed. For example, with BART, you can quickly and easily answer the question: “Has this file changed since yesterday?” Using cron(1M), you can generate BART manifests every minute, hour, day, week or, month. How often you actually run BART to generate new manifests should be based on how critical your need is to detect change. Because one size does not fit all, you might even want to consider having different BART rules or policies. For example, you might have: ■ a smaller policy, targeting a few key files, that runs every minute or hour, and ■ a larger policy, collecting information across the entire system, that runs only once a day or week. Use common sense when deciding how often you will generate manifests, balancing your detection priorities with the I/O load that will be generated on the system by the collection process. Determining Whether an Object is Genuine Regardless of the selected time intervals, however, BART is still not able to definitively answer the question: “Is this a genuine object that Sun shipped?” This is because you need to manually perform your data collection using BART after the system has been installed. There is always the possibility (however slight) that someone or something could have changed a Sun-provided file from its default before you performed your first BART snapshot. As a result, it is important to be able to determine whether the files contained in your BART manifest are genuine. This is especially true for a control 2 Integrating BART and the Solaris™ Fingerprint Database in the Solaris 10 Operating System • April 2005 manifest that will be used as the basic of comparison for future BART runs.