[Tiger-devel] Audit scripts and new 3.2.2 release

[Javier Fernandez-Sanguino]

Hi everyone,

As you are aware of, there has not yet been a 3.3 release. I have not 
been able to code all the things I had in my TODO for 3.3 but have 
been fixing and improving (with the help of Christian Slater, and 
other HP staff) Tiger sufficiently that I believe a release is 
deserved based from the current CVS code. I will be labeling this 
release as 3.2.2 since it's mostly a bug fix release (although it also 
expands support for Tru64 and HP-UX and introduces new security checks).

One thing I'm going to introduce, and I'm looking out for testers out 
there, is a set of audit collection scripts based on the ones 
developed by Marc Heuse. These scripts do not do system analysis but, 
instead, just grab system information to do offline system review 
(currently not automated) in order to do "white box" audits. They have 
been very useful in some customers where I'd rather not run Tiger on 
production systems, and these scripts are easier to debug and run on them.

Maybe you've missed my "UNIX/Windows audit scripts" mail in pen-test a 
while back (see Message-ID: <address@hidden>, March 4th 
 2005). In any case, I will be putting up the scripts in CVS now that 
Marc Heuse has relicensed them to GPL, if anyone wants to help me test 
out these scripts I would appreciate (and will forward them a copy). 
Current supported systems are: AIX, Solaris, HP-UX, Red Hat Linux, 
SuSE Linux, Debian GNU/Linux, Nokia IPSO, Slackware Linux and, even, 
the Oracle BBDD.

I would like to have a second set of scripts to analyse these scripts 
results (plain text files) and generate Tiger-like output. If anyone 
can volunteer to write those down please speak up! :-)

Once these scripts are in place, and have been tested, I will try to 
have a new release out of the door.

Best regards

Javier