# Radmind/Printable version

The current, editable version of this book is available in Wikibooks, the open-content textbooks collection, at
https://en.wikibooks.org/wiki/Radmind

# Tripwire

The open source tool called Tripwire is a host-based intrusion detection system. It is not so much concerned with detecting intrusion attempts at the periphery of a computing system (as in Network intrusion detection systems), but rather looks for and reports on the resultant changes of state in the computing system under observation.
Intruders usually leave traces of their activities (change system state). Tripwire looks for these by monitoring key attributes of files that should not change, including binary signature, size, expected change of size, etc. - and reporting its findings. While useful for intrusion detection it can also be used for many other purposes such as integrity assurance, change management, policy compliance, and more.
Many techniques used for host-based intrusion detection were entirely or in part pioneered by Tripwire. In many senses recent efforts at managing security on computers, such as the Trusted Computing Group Trusted Platform Module are extensions of these ideas and techniques wrapped up in a piece of silicon that runs external to the CPU and is thus harder to crack.
Radmind goes beyond the general Tripwire by allowing you to reverse changes instead of only notifying the administrator. To fail tripwire means that something changed without the administrator's knowledge.

# ktcheck

NAME
SYNOPSIS
DESCRIPTION
OPTIONS
FILES
EXIT STATUS
SEE ALSO

# Radmind Assistant

The Radmind Assistant is a GUI app for Mac OS X.
As of Sept. 2, 2005, here is what is required to get the standard scripts installed with the Radmind Assistant 0.9.6 running under 10.4.x with iHook installed;
1. Issue the command;
sudo defaults write com.apple.loginwindow LogoutHook /etc/logout.hook
to create a link to the iHook logout hook - and if you want login by a 'radmind' local user to trigger a full RADMIND issue the command;
sudo defaults write com.apple.loginwindow LoginHook /etc/login.hook
to create the required links to the iHook login hook.
2. The /etc/radmind.defaults file currently supplied with Radmind Assistant 0.9.6 has 3 bugs...
a) Delete the last line that reads;
'exit 0'
b) Remove the 'switches' from the variables TLSLEVEL and SERVER;
To do this, go to the section labelled "radmind-specific defaults" in /etc/radmind.defaults
Edit the file at this point to read as follows for the first two variables;
TLSLEVEL="`defaults read $ra_domain tlslevel 2>/dev/null || echo ${TLSLEVEL} | awk '{ print $2 }'`"
previously;
TLSLEVEL="-w `defaults read $ra_domain tlslevel 2>/dev/null | echo ${TLSLEVEL} | awk '{ print $2 }'`"
and;
SERVER="`defaults read $ra_domain radmindhost 2>/dev/null | echo ${SERVER} | awk '{ print $2 }'`"
previously;
SERVER="-h `defaults read $ra_domain radmindhost 2>/dev/null | echo ${SERVER} | awk '{ print $2 }'`"
Several users have been confused by the comments at the head of the radmind.defaults file that refers to the fact that any edits to this file don't work if you are using the Radmind Assistant unless some 'defaults' setting is changed'. I don't think there has been full information provided on exactly what this means, especially as it doesn't seem to preclude things working.
Also - I originally tried getting things to work by changing the other references at the head of the file from AUTHLEVEL to TLSLEVEL, but in the end I changed them back again and it still worked.