Free glibc audit 2.4 4 software for linux

glibc-audit is a modified version of glibc for application developers who check their code with an automatic memory access checker such as valgrind, Insure++, or Purify.
glibc-audit has been audited and cleaned up so that reports from the developers use of a memory access checker are more likely to be interesting to the developer, with less "noise" from the C library itself. Typically, glibc-audit initializes all of its local variables and structs before use. Ordinary glibc uses uninitialized dummy variables that are "dont-care" to its logic but reported by the memory access checker.
Also, the r_debug.r_brk protocol has been enhanced to co-operate with a co-resident auditor. If the auditor sets .r_brk, then the runtime loader will call the auditor directly whenever a shared library event occurs.
This is much more convenient than using breakpoints. By default the old breakpoint protocol works just like before. The new protocol is binary compatible with the old on machines where a pointer to a function is the same size as an ordinary pointer. Platforms where a pointer to a function is larger (such as HP-PA RISC, Alpha processor, or PowerPC) are not binary backward compatible, and will have to increment r_debug.r_version. Exising clients (such as gdb) also will see an ignorable type mismatch error when they are built. But for now, it is worth more not to antagonize gdb at runtime on x86.
The patch modifies 91 files. Compared to glibc-2.3.2-27.9, the additional code occupies 18 more bytes of .text, and 24 fewer bytes in the .so. On a nano-scopic scale, the typical execution cost is 0 to 3 CPU cycles per affected routine; the estimated median total impact is less than 1 second per machine per day. In the case of *printf(), glibc-audit is faster than glibc because the cleaned-up source helps gcc-3.2 avoid generating atrocious code when initializing printf_spec.info for parse_one_spec() in stdio-common/printf-parse.h.
Glibc-audit was constructed by running a memory access checker on the internal testcases of glibc, then analyzing the reported errors and modifying the source. The process revealed 10 memory access bugs in glibc-2.3.2-11.9. Seven were fixed in glibc-2.3.2-27.9, two more have been fixed in CVS, and one is a design flaw that probably will not be fixed.
Predecessor patches to glibc-audit-1 were submitted to the glibc project, but those patches were ignored [user "guest", password "guest"], declined, or rejected. There is enough improvement in usability and reliability to publish glibc-audit-1 separately.
The unmodified glibc-2.3.2-27.9.src.rpm is available from RedHat mirrors. rpmbuild -ba --target i686 took about 4 hours and 2.5GB of disk space on a machine with 1.1GHz CPU, 384MB RAM, UDMA100 disk.
Enhancements:
- The patches were updated to glibc-2.4-4.
- A glibc bug that interfered with gdb stop-on-solib-events was fixed.
- On x86, x86-64, and PowerPC, the __NR_open system call was improved to avoid leaking information from the user to the kernel.

Qmail Auditor consists of a email auditing tool.
QMail Auditor provides simple a method for auditing emails. It is easy to configure and uses regular expressions as rules.
The format of audit file is :
Any e-mail (outbound or inbound) have passed at this filter.
The valids "field header"(s) :
all - field from or to of e-mails
to - field to
from - field from
In case of regular expression you read the
# man re_format
# man regex
E-mail to forward is a valid mail account to redirect.
Example of this :
from nelio@walk.* auditoria@spyware.walk.com.br
to nelio@spyware.* auditoria@spyware.walk.com.br
Enhancements:
- Now the config file name has renamed.
- From audit (in /var/qmail/control for /var/qmail/control/auditor) and qmail-queue-real-audit for qmail-queue-real-auditor.

GNU C Library is one of the most important components of most modern Linux distributions. It is used by almost all C programs and provides the most essential program interface.

The GNU C library is primarily designed to be a portable and high performance C library.
It follows all relevant standards (ISO C 99, POSIX.1c, POSIX.1j, POSIX.1d, Unix98, Single Unix Specification). It has also internationalization and has one of the most complete internationalization interfaces known.

mudFTP is a protocol used for transfer of text files between a MUD server and a mudFTP client program. The text files can be notes, programs, room descriptions, etc. Once the file is transferred to the client, it is edited locally using the users favorite text editor.

In order to install mudFTP on your server, your server must have a centralized mechanism for editing text entries. In case of most MERC derivatives, this happens via the function string_append which takes a char** and takes over the control over input from the user, reallocating the text string as necessary. In any case, a fair knowledge of the C programming language and your MUD server is required in order to install mudFTP.

Once installed on the server side, mudFTP will listen on another port - typically youd wand this to be 6 higher than the normal port (e.g. if your mud is on port 4444, your mudFTP port would be on port 4450).

You users then use the mudFTP client program to connect. The client program identifies itself to the server with the MUD username/password and then waits for a request.

When a user with mudFTP enabled then edits a text using the text editing mechanism, it notices that there is a mudFTP connection and sends the text there instead of to the normal user screen. The users mudFTP client reads the text, saves it to a temporary file and spawns an editor. The user edits the file, and when satisfied, exits the editor. This causes the mudFTP client to send the text back to the server - which in turn replaces the text the user was editing with the new text from the client.

The server source code is ported to following platforms:

* Diku-like servers:
o Envy 2.2 with ILAB OLC
o Mythran 3.1.6b
o ROM 2.4b6 with Ivans OLC 1.72 (by Jessica Boyd)
o ROT 1.4 (by Dominic J. Eidson)
o Circle 3.0 (by George Greer)
* Non-Diku
o LDMUD (by Markus Peter) - should be portable to any LP [New!]

Ports under development:

If you are interested in porting to a new server platform, please email me. mudFTP should be portable to your server as long as your server has some central mechanism for editing text strings.

The C version of the client code works under the following platforms:

* Linux (libc5 as well as glibc)
* Any UNIX (untested, but the code is fairly compatible)
* Windows 95 and NT (port by Cath Allen)
* Windows 98 (untested)

The Java version of the client will work on any Java-capable platform.
Id very much like someone to port the client to the Macintosh platform

SLAD is a tool for performing local security checks against GNU/Linux systems.

SLAD has been primarily developed for the BOSS project to work together with Nessus to enhance its local scanning capabilities. For example, scanning for weak passwords with a tool like John-the-Ripper is something that simply cannot be achieved by a network scan.

Therefore, SLAD is required to be installed on every GNU/Linux system where local auditing needs to be done. SLAD can then be used as a stand-alone application or more conveniently through Nessus. For usage with Nessus two NASL plugins are provided for interfacing between Nessus and SLAD

The Version 2.0 provides a XML Interface for Parameters and easy integration of additional audit-parameters and tools. To help the administrator to integrate a new feature-set, a development-documentation is provided with the cvs.

SLAD has been tested and verified on the following platforms:

RedHat Fedora Core 3
SuSe 9.2
Debian 3.0 (woody)
Debian 3.1 (sarge)
ERPOSS3
Gentoo Linux 2004.3

SLAD is implemented in Perl and provides an extendable plugin architecture allowing to use various GPL-based security scanners and auditing tools under one common framework. Currently, SLAD comes packaged with

John-the-Ripper
Chkrootkit
LSOF
ClamAV
Tripwire
TIGER

As a result SLAD delivers reports of these locally installed auditing and analysis tools. When used with Nessus the individual reports are wrapped into a standard Nessus report.

SLAD as well as the SLAD NASL Plugins can be downloaded from this Website in their current stable release V2.0.

Installation:

You can use our "easy-to-use" GTK installer, this installer downloads the lastest SLAD Release Binary, and install it on the target system. You only need to provide the login for the traget system.

Tired of a broken package system after upgrading using dselect or aptitude? Buddy is a hardcore Debian package handler reduced to its essential functions. Buddy is not intended as replacement for the common Debian package manager
Buddy is a tiny, fast, and proper Debian package handler which acts as a wrapper to apt-get and dpkg.
Every command is shown before it is executed. It has the ability to backup the package setup and simulate package manipulations (dry run).
Main features:
- package maintenance (backup, diagnostic, audit, cleanup, renew, repair)
- package information (find/search, details, status, list, count)
- package manipulation (install, uninstall, remove, purge, configure)
Advantages:
- failover safe - simulate sensitive package manipulations (dry run)
- more secure - backup your package-setup to be more reversible
- faster - no packagelist loading at startup
- more transparent - every command is shown before executed
- completely shell based - no curses or other libraries needed
Enhancements:
- This is a work in progress snapshot.

The Linux Security Auditing Tool (LSAT) is a post install security auditor for Linux/Unix.
Linux Security Auditing Tool checks many system configurations and local network settings on the system for common security/config errors and for packages that are not needed.
It (for now) works under Linux (x86: Gentoo, RedHat, Debian, Mandrake; Sparc: SunOS (2.x), Redhat sparc, Mandrake Sparc; Apple OS X).
Enhancements:
- The dependency on the popt library has been removed.
- This release adds extra passwd and group checks under Linux, a check for failed logins under Linux/Solaris, a check for kernel modules under Solaris, network interface stats, and routing checks. It fixes a problem in checknetforward giving false positives, and an issue where verbose output was not very consistent.
- The kernel module check under Linux has been modified.

audit package contains the user-space utilities for creating audit rules. As well as for storing and searching the audit records generate by the audit subsystem in the Linux 2.6 kernel.
Usage:
Examples usage of utilities:
General:
Window 1:
./auditd
Window 2 (you dont have to have the daemon running to try this, but
enabled has to be 1):
./auditctl -s
./auditctl -a entry,always -S open
ls
./auditctl -d entry,always -S open
Identity tracking:
./auditctl -a exit,always -S all -F loginuid=2000
./auditctl -L 2000,"test uid"
Enhancements:
- Updates were made to system-config-audit. auditctl was updated to better handle watching of directories with older kernels.
- Memory leaks and an invalid free in auditd were fixed along with interpretations in auparse.