|
发表于 2007-6-22 15:52:46
|
显示全部楼层
tripwire. [quote]Tripwire就是解决这一问题的经典工具,它是目前最为著名的unix下文件系统完整性检查的软件工具,这一软件采用的技术核心就是对每个要监控的文件产生一个数字签名,保留下来。当文件现在的数字签名与保留的数字签名不一致时,那么现在这个文件必定被改动过了。具体到监控项目,在Tripwire的配置文件中有如下相应说明:
access permissions and file mode settings, including effective execution settings inode number in the file system
number of links
user ID of the owner
group ID of the group of users to which access may be granted
size of the item
date and time the item was last accessed, the last modification made to the item, and the creation date and time associated with the items inode
由上,我们可以看到Tripwire对文件的管理面是很宽的。
[quote] |
|