1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
|
Here are the steps to take to kick-start s()
itemization(
it() Install the stealth Debian package tt(stealth__CurVers__i386.deb) and
thus accept the provided binary program (skipping the next series of steps) or
do not accept the provided binary, and compile s() yourself, as per the
following steps:
it() Unpack tt(stealth__CurVers_.tar.gz):
tt(tar xzvf tealth__CurVers_.tar.gz)
it() tt(cd stealth);
it() Inspect, and where necessary modify the values of the variables in
the files tt(INSTALL.cf) and tt(icmconf);
it() Install a recent Gnu tt(g++) compiler;
it() Install the bobcat library (both the binary and development version)
(lurl(https://fbb-git.gitlab.io/bobcat/));
it() Install the tt(icmake) program
(lurl(https://fbb-git.gitlab.io/icmake/));
it() Run `tt(./build program strip)' to compile s();
it() Run (probably as root) `tt(./build install program)' to install;
it() Optionally install documentation. See section ref(COMPILING).
)
Following the installation the tt(stealth) directory tree has become
superfluous and can safely be removed.
Next, do:
itemization(
it() tt(cp share/usr/bin/stealthmail /usr/local/bin)
it() tt(mkdir /root/stealth)
it() tt(cp documentation/example-policies/localhost.pol /root/stealth)
)
tt(ssh) and tt(bash) (or another shell program) should be
available. tt(root@localhost) should be able to login at tt(localhost) using
tt(ssh root@localhost), using the tt(/bin/bash). Check
(as `root') at least
verb( ssh root@localhost)
as this might ask you for a confirmation that you've got the correct
host.
Now, run
verb( stealth /root/stealth/localhost.pol)
to initialize the stealth-report files for tt(localhost). This initializes
the report for
itemization(
it() all root setuid/setgid executable files on tt(localhost),
it() and for all files under tt(/etc/) on tt(localhost).
)
The mail-report is sent to tt(root@localhost).
Now change or add or remove one of these files, and rerun s(). The
file tt(/tmp/stealth-_CurVers_.mail) should reflect these changes.
|
