df@sei.cmu.edu (Dan Farmer) (05/17/91)
(BTW, The source code for all of this is also available via anon-ftp, at
cert.sei.cmu.edu, in ~ftp/pub/cops/perl.alpha.)
====================================
Miscellaneous notes
====================================
Hello -- this is what everyone has been waiting for, the alpha (!!!)
release of perl-cops, or p-cops. This should be functionally equivalent
to version 1.02 of the normal, or shell/C version of cops, with everything
rewritten in perl, with the exception of the CRC checking stuff (sorry,
no one had the guts (insanity) to do it :-)). It still calls a couple
of Un*x programs to do some dirty work -- diff, find, and some other
things, but should require nothing other than a working version of perl,
version xyz (I haven't tried it with earlier versions; it uses "require",
tho, which shouldn't stop you if you are determined; I don't think it
uses anything else special) and a working Un*x (I'll pass this opportunity
to make some snide remarks about what Un*x's actually work, here...)
It is completely under tested, under documented, and probably has it's
share of bugs. I'm pretty sure it works on Tom Christiansen's and my
machine (actually, it has some problems on my decstation, but works fine
on the sparc next to me), but that's about all I'll vouch for right now.
Send bugs, problems, comments, and flames to me -- df@cert.sei.cmu.edu (If
you hurry, we'll get a beta release out in a short while. What a deal!)
As a bonus, there are a couple of new features to this, which may or
may not show up in the normal version. First, there is a config file
("cops.cf") that should hold all the little stupid variable things. This
makes it a lot easier to run this sucker on multiple host types; you can
just say "cops -c config.sun4" or whatever, and it sucks up the info for
that machine type. I'll put a separate section on how to use this little
gem down below. Second, now when you check for writable files inside
things like /etc/rc and crontab and such, you can specify the search to
be recursive; so if you have a line like this in /etc/rc:
/usr/bin/foo > /dev/console
It will examine "/usr/bin/foo" for programs inside of it -- and it will
keep going until it has exhausted all possibilities. So you can get warning
messages like:
Warning! File /foo/bar (inside /usr/local/X11R4/bin/X inside /usr/local/X11R4
/bin/xdm inside /etc/rc.local) is _World_ writable!
Fun stuff. No one can hide, now. This will probably *not* show up in
the normal cops package, 'cause the string lengths this generates can easily
go beyond what little the shell can comprehend.
Finally, it includes an even better version of Kuang. Steve is still
working on yet another bigger and better version.
====================================
End notes --
====================================
To get all this running, you might find it helpful to read the README
file. A word to the wise, that's all...
When a stable version of this is ready, when I get all of my other changes
done to the normal cops, and finally when I get the new changes propagated
back to the perl cops, I'll post the final 1.03 version, which should have
equivalent shell and perl code. This will be the last time for that, methinks.
I've got some plans for doing some networking stuff, using cops to figure
out what goes on in the mind(s) of the network, and it's a bit too difficult
(actually, it takes too long!) to write everything in C and shell (BTW,
anyone who is into hacking security network stuff and understands a bit of
kuang-eese can contact me, if you really want to do some further serious
work.)
Tremendous thanks go to Tom Christiansen, who almost single-handedly did
the port to perl (well, he probably did 50% of the code, and bashed on the
entire version to make it work right), and the rest of the perl crew (in
no particular order); Steve Romig, Jeff Kellem, Mitch Wright, Matthew
Farwell, Martin Foord, David Lawrence, Vik Lall, Brian Utterback, Terry
McGonigal, and Chris (ckd@cs.bu.edu).
Enjoy!
-- dandavidm@uunet.UU.NET (David S. Masterson) (05/19/91)
>>>>> On 17 May 91 04:45:11 GMT, df@sei.cmu.edu (Dan Farmer) said:
Dan> Hello -- this is what everyone has been waiting for, the alpha (!!!)
Dan> release of perl-cops, or p-cops. This should be functionally equivalent
Dan> to version 1.02 of the normal, or shell/C version of cops, with everything
Dan> rewritten in perl, with the exception of the CRC checking stuff (sorry,
Dan> no one had the guts (insanity) to do it :-)).
etc, etc...
This is, without a doubt, the longest introduction to a source posting that,
after reading it, I still couldn't figure out the purpose of the program it
was referring to. So, what the h*** is COPS??? (and kuang?)
--
====================================================================
David Masterson Consilium, Inc.
(415) 691-6311 640 Clyde Ct.
uunet!cimshop!davidm Mtn. View, CA 94043
====================================================================
"If someone thinks they know what I said, then I didn't say it!"