Good Morning,

Thanx to the folks that provided usefull information.  Some of your
feedback was quite helpfull, and much appreciated.  My requirements
for research were fairly broad:  (1) The capability to generate and
compare mathematical hash's of files and/or directories; (2) the
ability to store system specific configuration meta-data and compare;
(3) the ability to store ACL meta-data and compare.  Exactly WHAT
files, directories, etc...to monitor and comply with the requirements
against was not specified.  Thus my questions.

"TripWire" (to the best of my understanding) is both a commercial
product offering, and a SourceForge Open Source tool that has the
capability of computing, storing and comparing a mathematical hash of
a file, directory of BLOB object.

Not so many thanx to the folks that superior attitude, thinly veiled
as knowledge.  It is this behavior that gives the technologist such a
bad reputation to the business side of the house.

rfc2307@gmail.com wrote:
> Good Morning,
> 
> Thanx to the folks that provided usefull information.  Some of your
> feedback was quite helpfull, and much appreciated.  My requirements
> for research were fairly broad:  (1) The capability to generate and
> compare mathematical hash's of files and/or directories; (2) the
> ability to store system specific configuration meta-data and compare;
> (3) the ability to store ACL meta-data and compare.  Exactly WHAT
> files, directories, etc...to monitor and comply with the requirements
> against was not specified.  Thus my questions.
> 
> "TripWire" (to the best of my understanding) is both a commercial
> product offering, and a SourceForge Open Source tool that has the
> capability of computing, storing and comparing a mathematical hash of
> a file, directory of BLOB object.
> 
> Not so many thanx to the folks that superior attitude, thinly veiled
> as knowledge.  It is this behavior that gives the technologist such a
> bad reputation to the business side of the house.
> 


Since you explained exactly none of this in your original post, I
think the superior attitude was entirely appropriate.

-- 
John Santos
Evans Griffiths & Hart, Inc.
781-861-0670 ext 539

John Santos wrote:
> rfc2307@gmail.com wrote:
> 
>> Good Morning,
>>
>> Thanx to the folks that provided usefull information.  Some of your
>> feedback was quite helpfull, and much appreciated.  My requirements
>> for research were fairly broad:  (1) The capability to generate and
>> compare mathematical hash's of files and/or directories; (2) the
>> ability to store system specific configuration meta-data and compare;
>> (3) the ability to store ACL meta-data and compare.  Exactly WHAT
>> files, directories, etc...to monitor and comply with the requirements
>> against was not specified.  Thus my questions.
>>
>> "TripWire" (to the best of my understanding) is both a commercial
>> product offering, and a SourceForge Open Source tool that has the
>> capability of computing, storing and comparing a mathematical hash of
>> a file, directory of BLOB object.
>>
>> Not so many thanx to the folks that superior attitude, thinly veiled
>> as knowledge.  It is this behavior that gives the technologist such a
>> bad reputation to the business side of the house.
>>
> 
> 
> Since you explained exactly none of this in your original post, I
> think the superior attitude was entirely appropriate.
> 

I think it would have been approriate to provide this link:
How To Ask Questions The Smart Way
http://catb.org/~esr/faqs/smart-questions.html

In article <39288283-1d6f-4af5-a87f-694ab5af9197@e23g2000prf.googlegroups.com>, rfc2307@gmail.com writes:

> Thanx to the folks that provided usefull information.  Some of your
> feedback was quite helpfull, and much appreciated.  My requirements
> for research were fairly broad:  (1) The capability to generate and
> compare mathematical hash's of files and/or directories; (2) the
> ability to store system specific configuration meta-data and compare;

As you saw from the checklists at the URLs I posted, LJK/Security
does those two steps.

> (3) the ability to store ACL meta-data and compare.  Exactly WHAT
> files, directories, etc...to monitor and comply with the requirements
> against was not specified.  Thus my questions.

Devising general rules for ACL contents is a tough task, whereas
simply recording the values and looking for changes is trivial
(SHOW SECURITY/OUTPUT=<filespec>, followed by DIFFERENCES <filespec>).

What files are worthy of your consideration depends entirely on the
use to which the target system is put.  For a production system,
hashes of all executable image should remain invariant as should
hashes of all command procedures.  For a development system, that
would be an intolerable set of rules.

But looking for changes in files is really useless on a VMS system
unless you have first taken care of all the possible configuration
errors that might enable an unauthorized person to make changes.

> "TripWire" (to the best of my understanding) is both a commercial
> product offering, and a SourceForge Open Source tool that has the
> capability of computing, storing and comparing a mathematical hash of
> a file, directory of BLOB object.

I have never heard of someone using that on VMS.  Perhaps someone else
has.

rfc2307@gmail.com wrote:
> 
> Good Morning,
> 
> Thanx to the folks that provided usefull information.  Some of your
> feedback was quite helpfull, and much appreciated.  My requirements
> for research were fairly broad:  (1) The capability to generate and
> compare mathematical hash's of files and/or directories; (2) the
> ability to store system specific configuration meta-data and compare;
> (3) the ability to store ACL meta-data and compare.  Exactly WHAT
> files, directories, etc...to monitor and comply with the requirements
> against was not specified.  Thus my questions.
> 
> "TripWire" (to the best of my understanding) is both a commercial
> product offering, and a SourceForge Open Source tool that has the
> capability of computing, storing and comparing a mathematical hash of
> a file, directory of BLOB object.
> 
> Not so many thanx to the folks that superior attitude, thinly veiled
> as knowledge.  It is this behavior that gives the technologist such a
> bad reputation to the business side of the house.

As Larry pointed out, without knowing what "Tripwire" might be, it was a
crap-shoot at best how to answer such a question.

Best to make sure "everyone" knows what you're talking about by offering
the definition or, at the very least, enough supporting context for
someone to draw a reasonably intelligent inference. 

David J Dachtera
(formerly dba) DJE Systems