#Triple D Consulting #Network Attached Device Diagnostic System #README File Agent Name: File Change Agent Agent Version: Version 1.5 Agent Author: Daryl Quenet Agent Date: 2003-May-27 Agent Purpose: Agent detects whether a protected files contents and permissions remain unchanged. If contents are changed file is compressed and archived with a timestamp. Agent Installation Instructions: Place agent in the agents directory within the $BCNUHOME directory. Add into $BCNUHOME/etc/agents parameters specified below. Agent Operating Dependancies: Linux & Solaris Agent Security Dependancies: Agent can only read and verify files that are world readable or in the same group. Agent Application Dependancies: Awk & Sed & ls Agent Storage: Files will be stored in $BCNUHOME/data/filechange-archive Tested by: N/A Date Tested: N/A Agent Syntax: Uses standard BCNU cron scheduler. Agent call example: agent:filechange:::::$p1=$p2: agent:filechange:8-18:1:1:enabled:/etc/passwd=passwd /etc/shadow=shadow: Parameters: $p1 is file to monitor, $p2 is the file handler name to use for storage within the archive directory (allows for multi files with the same name, ie passwd files). Error condtions: File contents change Expected response: File is archived with its permissions perserved with timestamp within a Tar Gzip archive. And error Next iteration files will match provided no changes within the agent runtime. Actual response: Error condtions: File permissions change Expected response: File is archived with its permissions perserved with timestamp within a Tar Gzip archive. Next iteration files will match provided no changes within the agent runtime. Actual response: Warn conditions: None. Expected response: None. Actual response: None. Successful conditions: File remains intact. Expected response: Reports Ok! Features To Add: -None