{"id":3934,"date":"2015-08-31T23:37:30","date_gmt":"2015-08-31T15:37:30","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=3934"},"modified":"2015-09-09T19:36:34","modified_gmt":"2015-09-09T11:36:34","slug":"tiger-unix-security-audit-intrusion-detection-tool","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2015\/08\/tiger-unix-security-audit-intrusion-detection-tool\/","title":{"rendered":"Tiger &#8211; Unix Security Audit &#038; Intrusion Detection Tool"},"content":{"rendered":"<p>Tiger is a Unix security audit tool that can be use both for auditing and as an intrusion detection system. It supports multiple Unix platforms and it is free and provided under a GPL license. Unlike other tools, Tiger needs only POSIX tools and is written entirely in shell language.<\/p>\n<p>Tiger has some interesting features that merit its resurrection, including a modular design that is easy to expand, and its double edge, it can be used as an audit tool and a host intrusion detection system tool.<\/p>\n<p align=\"center\"><img decoding=\"async\" src=\"https:\/\/farm1.staticflickr.com\/622\/20414697893_8e5da31589.jpg\" alt=\"Tiger - Unix Security Audit &#038; Intrusion Detection Tool\" \/><\/p>\n<p>Free Software intrusion detection is currently going many ways, from network IDS (with Snort), to the kernel (LIDS, or SNARE for Linux and Systrace for OpenBSD, for example), not mentioning file integrity checkers (many of these: aide, integrit, <a href=\"https:\/\/www.darknet.org.uk\/2009\/10\/samhain-v-2-5-9c-open-source-host-based-intrusion-detection-system-hids\/\">samhain<\/a>, tripwire&#8230;) and logcheckers (even more of these, check the Log Analysis pages). But few of them focus on the host-side of intrusion detection fully.<\/p>\n<p>Tiger complements these tools and also provides a framework in which all of them can work together. Tiger is not a logchecker, nor it focused in integrity analysis. It does &#8220;the other stuff&#8221;, it checks the system configuration and status. Read the manpage for a full description of checks implemented in Tiger. A good example of what Tiger can do is, for example, check_findeleted, a module that can determine which network servers running in a system are using deleted files (because libraries were patched during an upgrade but the server&#8217;s services not restarted).<\/p>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>There are other similar tools, but most of them focus on privilege escalation:<\/p>\n<p>&#8211; <a href=\"https:\/\/www.darknet.org.uk\/2014\/11\/linenum-linux-enumeration-privilege-escalation-tool\/\">LinEnum \u2013 Linux Enumeration &#038; Privilege Escalation Tool<\/a><br \/>\n&#8211; <a href=\"https:\/\/www.darknet.org.uk\/2014\/09\/lynis-v1-6-0-released-download-linux-security-auditing-tool\/\">Lynis v1.6.0 Released For Download \u2013 Linux Security Auditing Tool<\/a><br \/>\n&#8211; <a href=\"https:\/\/www.darknet.org.uk\/2015\/06\/unix-privesc-check-unixlinux-user-privilege-escalation-scanner\/\">unix-privesc-check \u2013 Unix\/Linux User Privilege Escalation Scanner<\/a><\/p>\n<p>You can download Tiger here:<\/p>\n<p><a href=\"http:\/\/download.savannah.gnu.org\/releases\/tiger\/tiger-3.2.3.tar.gz\">tiger-3.2.3.tar.gz<\/a><\/p>\n<p>Or read more <a href=\"http:\/\/www.nongnu.org\/tiger\/\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Tiger is a Unix security audit tool that can be use both for auditing and as an intrusion detection system. It supports multiple Unix platforms and it is free and provided under a GPL license. Unlike other tools, Tiger needs only POSIX tools and is written entirely in shell language. Tiger has some interesting features [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"Tiger is a UNIX security audit tool that can be use both for auditing and as an intrusion detection system. It supports multiple UNIX platforms.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[12,6,11],"tags":[544,3110],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3934"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=3934"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3934\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=3934"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=3934"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=3934"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}