v0.9.9
Send bug reports, feature requests, and other miscellany to tdotkinch@yahoo.com

==The quick and dirty way==

In case you just want to get started playing with Petrovich, follow these steps. But you really should read over ==The Right Way== and implement as much of it as you can. If your integrity checker is compromised you've defeated its purpose.

First, read the INSTALL file. Once you've got it installed test it out.

perl petrovich.pl

You will see something like this:

Initializing...
Opening petrovich.db
Processing /bin
Processing /usr/bin
Processing /usr/local/bin
Processing /sbin
Processing /usr/sbin
Processing /usr/local/sbin
Processing /dev
petrovich.db's md5 hash is udHwuU6aSTwwXRwJwU2mNQ
petrovich.pl ran for 41 seconds

As long as you've got a valid petrovich.conf in your current directory, this will generate a new database with integrity verifying information on all the directories specified in petrovich.conf. The new database will be called petrovich.db. This is your BASELINE. By running petrovich in --verify mode you can tell when any of the files measured in your baseline have changed. To run a verify against your database.

perl petrovich.pl --verify

This will tell you if any of the files you are monitoring have changed or if any of the directories you are monitoring have had files added to them. It's pretty simple. If you wake up one morning and your home page has been replaced by the latest hacktivist claptrap, just run petrovich in verify mode. If they've installed their nifty 0day password sniffing, IRC botting, DDoS agenting, 31337 rootkit on your box you will know which files have been changed and added, which means you don't have to wipe all your partitions and start over. You can actually fix the damage and get on with your life.

Whenever you update your system with new programs, patches, service packs, or whatever it is you like to install, create a new database with

perl petrovich.pl

and you will have a new database that reflects the new state of your system. Read on to learn how to make Petrovich really useful.

==The Right Way==

It's a little more complicated to use a filesystem integrity checker the right way than it is to just use it. I will try to explain some of the issues along with my solutions. If you feel I'm missing something, please send me an email.

So now you know how to create a database that has integrity information about your filesystem and how to verify that database against the current state of your system. How do you protect the database? How do you protect the program that checks against the database? How do you protect the configuration file that controls the program that checks the database?  How do you make a useable system out of this?

1. Figure out which directories you actually want to monitor

 For Eunuchs systems this is fairly standard. If you're running X you will probably want to add several directories to the default list in petrovich.conf. If you're running windows you will definitely want to modify the defaults from win2k.petrovich.conf. Open the conf file for your platform in a text editor and look at it. There are 3 types of lines in the configuration file.

lines beginning with # are comments. They are ignored by petrovich.  I like to put system names, patch levels, and dates on comment lines.

Lines beginning with + are directories to process. They are not files. You cannot use files on + lines. These directories are recursively processed, so if you include +/winnt every file and subdirectory underneath winnt is processed.  If you're on a windows system, you can use either / or \ in path names.  The program replaces backslash with slash internally before doing anything with the files.  If you're on a windows system all of the file and path names are converted to lowercase before being used because windows systems don't care about the case of files and directories.  Eunuchs systems do.

Lines beginning with - are exclusions. If you have a specific file or directory under a directory you added with + that you don't want to check, give it a - line. This works for both files and directories. I added this feature because windows systems don't separate binaries from other file types like Eunuchs normally does. For example, under /winnt/system32 you have a directory called config that contains the files corresponding to the event logs in windows NT/2000. These files are constantly changing as you use your system.  If you can't exclude this directory it is going to show up every time you run a verify. And if you have 100 files showing up in every verify, eventually you are going to stop looking at the results.  So you will notice in win2k.petrovich.conf there is a line to include the winnt directory

+/winnt

and a line to exclude the /winnt/system32/config directory

-/winnt/system32/config

You only have to exclude directories that are under directories you have already included.

You will probably want to run petrovich in verify mode often at first so you can see what files are changing through normal system usage and figure out whether or not to exclude them. After a few days you should be pretty comfortable with your list.

2. Protect petrovich itself

Now that you have your conf file straightened out and have a good petrovich.db to work from for your specific system you need to protect them from being tampered with. If you are running on a Eunuchs system you may be able to fit petrovich.pl, petrovich.conf, and petrovich.db all on one floppy. Write protect this floppy. Only someone with physical access to your machine can modify this information now. If you are managing a network of Eunuchs machines, or if you have a windows machine, you will probably not be able to fit all this information on one floppy. I monitor two windows 2000 machines and the database for each is over 4 MB. Burn it all on a CD if you can. If you can't do this put it on a network share that your normal account has Read Only access to. You could use a Zip disk and write protect that (although write protection on these is fallible - it's controlled by software). The point is to make the program that's doing the checking (petrovich.pl), the database its checking against (petrovich.db) and the list of things to check (petrovich.conf) difficult to modify. Physically read only media is best, software protection may be adequate for you.

3. Schedule the verify to run on a regular basis

For Eunuchs:

Use cron. You will probably have to put it in root's crontab because there are some files (setuid files especially) you may want to monitor that other users don't even have read access to (on my OpenBSD boxes at least).

crontab -e

will put you in a text editor in your crontab. Add a line like this (this is all one line - watch for wrap):

30 2 * * * /mnt/cdrom/petrovich.pl --verify --conf /mnt/cdrom/petrovich.conf --db /mnt/cdrom/petrovich.db| mail -s "`/bin/hostname` petrovich report" me@mymail.com

Check the directory names, correct the email address and you're set. This will set petrovich to run every night at 2:30 AM and email you its output. Every morning you wake up, drink your coffee and revel in the knowledge that your critical server has made it another day without being hacked.

For windows:

There's not an easy built in way to send mail from the command line with windows. You can do it with Perl, you can do it with WSH, but I find it's easiest to do it with blat. Blat is a public domain RFC822 compliant mailer that runs from the command line.

you can get it from http://gepasi.dbs.aber.ac.uk/softw/Blat.html

Copy blat.exe to a directory in your path (like c:\winnt) and install it with

blat -install mail.myserver.com me@myserver.com 4 25

which tells it your server name, your email address, retry 4 times if it has difficulty sending the mail, and use port 25 (the default smtp port) For more help type blat -h

Now that you've got blat working take the petrovich.cmd file that comes with the distribution and copy it into your path (like c:\winnt). Open petrovich.cmd in notepad, change the directory paths to be right for your system and you'll be ready to go.

Open scheduled tasks from the control panel and schedule petrovich.cmd to run every night at 2:30 AM (or whenever your computer is on but not doing anything).

==What else should I know?==

1. Don't ever automate the database creation. If someone compromises your system and then you schedule a database creation afterward you will never know. Always run a verify immediately before creating a new database.  If you're really paranoid, take the system offline, run a verify, create a new database, put it on a read only media, then bring the system back on line.

2. There are some caveats on windows. Petrovich does not check the registry. I don't plan on adding this because it's too much hassle. If you really need this I think TripWire for NT does it.

3. Petrovich does not check alternate data streams on NTFS partitions. I don't plan on adding this either unless someone comes up with a Perl module that handles it easily. Even then I may not add it. I think TripeWire for NT does this too.  There's also a freeware tool to detect alternate data streams available at http://www.crucialsecurity.com/