#!/usr/bin/perl
#
# ViperDB v0.9.1
#
# ViperDB was created as a smaller & faster option to Tripwire.
# Tripwire while being a great product leaves something to be
# desired in the speed department and also, by default tripwire
# generates a report everytime it runs and directs that report
# to an email address. This hinders most people from running
# Tripwire every few minutes to do a system check. ViperDB
# however is the answer to this problem. ViperDB does not use
# a fancy all-in-one database to keep records instead, I opted
# to keep it fast and hence decided to go with a plaintext db
# which is stored in each "watched" directory. By using this
# there is no real one attack point for a attacker to focus his
# attention on. This coupled with the running of ViperDB every
# 5 minutes (via cron root job) decreases that likelyhood that
# an attacker will be able to modify your "watched" filesystem
# .while ViperDB is monitoring your system
#
# NOTES:
#
#
# PLANNED UPGRADES:
# - Adding of a more complex "system status" function which when
#   a change is detected, would grab info that might be helpful
#   in determining what caused the change (ie. processes running,
#   users logged in, last few lines from logfiles, etc)
#
# THANKS TO:
# whitetrash, punkis, & rooster, and those of you who
# have sent in your suggestions.
#
# Special thanks to Anthony D. Urso <anthonyu@killa.net> for
# finding the nasty race conditions which prompted me to recode
# all file access properly instead of being lame and using system()
# for every file access
#
# VERSION HISTORY
# 0.1 - 0.5 - Wrote CreateDB.pl which generates the DBs
#           - Wrote CheckDB.pl which used diff to find changes
#           - Re-Coded to use a "distributed database" instead of
#             one centralized DB.
#           - Re-Coded to use a config file (ViperDB.ini)
#           - Changed to use Assoc. Arrays to speed up processing
#           - Added capability to detect additions & deletions of
#             files to "watched" directories
#       0.6 - Merged CreateDB.pl & CheckDB.pl into one
#           - Cleaned out debugging code and commented more
#       0.7 - Changed logging mechanism from logging to an
#             individual file to logging to the standard
#             logging facility (calls on 'logger')
#           - Added '-checkstrict' functionality which changes
#             permissions back to what they were before the
#             change was made to the file.
#           - Added exception(s) to '-checkstrict' which removes
#             all permissions from the changed file if the file
#             originally was SUID/GUID
#           - Changed way changes were seen by admin, now a change
#             only sends an alert to the logs once instead of repeatedly.
#       0.8 - Added Email notification option which will send email to
#             specified email address
#           - Updated to make "database(s)" immutable and undeleteable
#             so it is hard for the database(s) to be changed in between
#             runs even if someone busts root.
#       0.9 - Added ignore file functionality which allows user to
#             specify files to ignore
#           - Updated code to work better on solaris, ie updated ls
#             options to -lAcr for solaris instead of standard -laAs
#     0.9.1 - Fixed some nasty race conditions
#           - changed almost all system() calls to perl equivolents
#           - cleaned up -checkstrict code to handle changing perms.
#             owner,group back to original.. now use UID/GID instead
#             of the name of the uid/gid
#           - Simplfied reporting (lumped all perms together and
#             uid/gid together)
#           - cleaned up a bug with chattr and -init runtype
#

# These are the only things you should need to set
$configfile='/usr/local/etc/viperdb.conf';
$ignorefile='/usr/local/etc/viperdb.ignore';
$notifymail='Y';
$notify_email='j-dog@resentment.org';
$notify_subject="ViperDB Changes Detected!\n";

chomp($os_type=lc(qx[uname]));

# Detect what command line switches were passed and act accordingly
if (@ARGV[0] eq '-init'){
	print "Init Detected. Creating Databases...\n";
	&InitDB;
} elsif (@ARGV[0] eq '-check'||@ARGV[0] eq '-checkstrict'){
	print "Check Detected: Now Checking File Sanity...\n";
	&SysCheck;
} else {
	print "\n\nViperDB v0.9\n";
	print "ERROR: Unrecognized option or none given.\n";
	print "usage: ViperDB -init -check\n";
	print "     -init          Initializes the ViperDB Databases\n";
	print "     -check         Runs a system file sanity check\n";
	print "     -checkstrict   Runs a system file sanity check (protective)\n";
}

sub InitDB {
	$runtype='init';
	&CreateDB;
}

sub SysCheck {
	$runtype='check';
	&CreateDB;
	if (@ARGV[0] eq '-checkstrict'){
		$strictmode="Y";
	}
	&Compare;
	&Cleanup;

	# At this point I re-init the databases to stop
	# changes from constantly being displayed. We have
	# displayed changes, if any, and we are now going
	# to re-create the database with the new perms.
	$runtype='init';
	print "Creating New Databases...\n";
	&CreateDB;

}
sub CreateDB {
	# Parse in the Ignore file
	open (IGNORE, "< $ignorefile");
		%ignorefiles;
		$ignorecount=0;
		while(<IGNORE>){
			chomp;
			$ignorefiles{$ignorecount} = $_;
			$ignorecount+=1;
		}#while
	close(IGNORE);

	#Parse in the Config file
	open (CONFIG, "< $configfile");
		STARTCONFIG:
		$configline=<CONFIG>;
		chomp $configline;
		while (defined($configline)){
			if ($configline =~ /:/){
				goto STARTCONFIG;
			} else {
				$wd=$configline;
				# Set some vars up for runtype
				if ($runtype eq 'init'){
					$ViperDB=$wd . '.ViperDB';
					# Solaris be goofy and we can't do this
					if ($os_type ne 'sunos'){
						system("chattr -iu $ViperDB 2>/dev/null 1>/dev/null");
					}#if
				} else {
					$ViperDB=$wd . '.ViperDB.tmp';
				}#if...else

				# Read in the current dir and build the DB
				open (VIPERDB, "> $ViperDB");
					opendir(BINLIST, $wd) || die "can't opendir $wd: $!";
						@files = readdir(BINLIST);
						$filecount=@files;
						$count=0;
						RESTARTLOOP:
						while($count ne $filecount){
							foreach $ignorecount (sort keys %ignorefiles){
								if ($files[$count] eq $ignorefiles{$ignorecount}){
									$count+=1;
									goto RESTARTLOOP;
								}
							} #foreach
							$bname=$files[$count];
							$file="$wd/$bname";
							($dev, $ino, $mode, $nlink, $uid, $gid,$rdev, $size, $atime, $mtime, $ctime, $blksize, $blocks)= stat($file);
							print VIPERDB "$bname,$size,$mode,$uid,$gid,$mtime,$ctime\n";

							$count+=1;
						} #while
					closedir(BINLIST);
				close(VIPERDB);

				# Change the permissions to only allow root to read...
				chmod(0400, "$ViperDB");
				if ($runtype eq 'init') {
					if ($os_type ne 'sunos') {
						system("chattr +iu $ViperDB 2>/dev/null 1>/dev/null");
					}
				}
				$configline=<CONFIG>;
				chomp $configline;
			} # else...if
		}
	close (CONFIG);
}


sub Compare {
	open (DIRLIST, "< $configfile");
		open (LOG, "|logger -t ViperDB");
			my $trouble=0;
			READDIRLIST:
			$dirlistline=<DIRLIST>;
			chomp $dirlistline;
			while(defined($dirlistline)){
				if ($dirlistline =~ /:/){
					goto READDIRLIST;
				} else {
					$mypath=$dirlistline;
				}
				$RealDB=$mypath . '.ViperDB';
				$ChkDB=$mypath . '.ViperDB.tmp';

				# Init some Assoc. Arrays
				%valid = ();
				%check = ();

				# Read the RealDB into an Assoc. Array
				open(A, $RealDB);
					while(<A>){
						($bname,$junk) =  split /,/,$_;
						chomp $bname;
						if(defined($bname)){
							if(!defined($valid{$bname})){
								$valid{$bname} = $_;
							} # if
						} # if
					} # while
				close (A);

				# Read the CheckDB into an Assoc. Array
				open(B, $ChkDB);
					while(<B>){
						($bname,$junk) =  split /,/,$_;
						chomp $bname;
						if(defined($bname)){
							if(! defined($check{$bname})){
								$check{$bname} = $_;
							} # if
						} # if
					} # while
				close (B);

				foreach $bname (sort keys %valid){
					$fileinfoa=$valid{$bname};
					$fileinfob=$check{$bname};
					chomp $fileinfoa;
					chomp $fileinfob;
					if($fileinfoa ne $fileinfob){
						($a_bname,$a_size,$a_mode,$a_uid,$a_gid,$a_mtime,$a_ctime) = split/,/,$fileinfoa;
						($b_bname,$b_size,$b_mode,$b_uid,$b_gid,$b_mtime,$b_ctime) = split/,/,$fileinfob;
						$myfile=$wd.$a_bname;
						if(! defined($b_bname)){
							print LOG "Alert - FILE DELETED: $wd$a_bname\n";
							$errorsummary .= "Alert - FILE DELETED: $wd$a_bname\n";
							$trouble++;
						} else {
							print LOG "Alert - CHANGES TO FILE: $wd$a_bname\n";
							$errorsummary .= "Alert - CHANGES TO FILE: $wd$a_bname\n";
							$trouble++;
							if($a_size ne $b_size){
								print LOG "Alert - SIZE: was $a_size now $b_size\n";
								$errorsummary .= "Alert - SIZE: was $a_size now $b_size\n";
							}
							if($a_uid ne $b_uid||$a_gid ne $b_gid){
								print LOG "Alert - UID/GID: was $a_uid:$a_gid now $b_uid:$b_gid\n";
								$errorsummary .= "Alert - UID/GID: was $a_uid:$a_gid now $b_uid:$b_gid\n";
								if($strictmode eq 'Y'){
									print LOG "Alert - UID/GID: Changing uid/gid of $a_bname back to $a_uid:$a_gid\n";
									$errorsummary .= "Alert - UID/GID: Changing uid/gid of $a_bname back to $a_uid:$a_gid";
									chown $a_uid, $a_gid, $myfile;
								}
							}
							if($a_perms ne $b_perms){
								print LOG "Alert - PERMS: was $a_perms now $b_perms\n";
								$errorsummary .= "Alert - PERMS: was $a_perms now $b_perms";
								if($strictmode eq 'Y'){
									print LOG "Alert - PERMS: Changing perms on $a_bname back to $a_perms\n";
									$errorsummary .= "Alert - PERMS: Changing perms on $a_bname back to $a_perms\n";
									chmod $a_perms, $myfile;
								} # if
							} # if
							if($a_mtime ne $b_mtime){
								($a_seconds, $a_minutes, $a_hours, $a_dom, $a_month, $a_year, $a_wday, $a_yday, $a_isdst) = localtime($a_mtime);
								($b_seconds, $b_minutes, $b_hours, $b_dom, $b_month, $b_year, $b_wday, $b_yday, $b_isdst) = localtime($b_mtime);
								print LOG "Alert - MTIME: was $a_month/$a_dom/$a_year $a_hours:$a_minutes:$a_seconds now $b_month/$b_dom/$b_year $b_hours:$b_minutes:$b_seconds\n";
								$errorsummary .= "Alert -MTIME: was $a_month/$a_dom/$a_year $a_hours:$a_minutes:$a_seconds now $b_month/$b_dom/$b_year $b_hours:$b_minutes:$b_seconds\n";
							} # if
							if($a_ctime ne $b_ctime){
								($a_seconds, $a_minutes, $a_hours, $a_dom, $a_month, $a_year, $a_wday, $a_yday, $a_isdst) = localtime($a_ctime);
								($b_seconds, $b_minutes, $b_hours, $b_dom, $b_month, $b_year, $b_wday, $b_yday, $b_isdst) = localtime($b_ctime);
								print LOG "Alert - CTIME: was $a_month/$a_dom/$a_year $a_hours:$a_minutes:$a_seconds now $b_month/$b_dom/$b_year $b_hours:$b_minutes:$b_seconds\n";
								$errorsummary .= "Alert - CTIME: was $a_month/$a_dom/$a_year $a_hours:$a_minutes:$a_seconds now $b_month/$b_dom/$b_year $b_hours:$b_minutes:$b_seconds\n";
							} # if
						} # if ... else
					} # if
				} # foreach
					foreach $bname ( sort keys %check ) {
					$fileinfoa=$valid{$bname};
					$fileinfob=$check{$bname};
					($a_bname,$junk) = split/,/,$fileinfoa;
					($b_bname,$junk) = split/,/,$fileinfob;
					if (! defined($a_bname) ) {
						print LOG "Alert - NEW FILE: $wd$b_bname\n";
						$errorsummary .= "Alert - NEW FILE: $wd$b_bname\n";
						$trouble=$trouble+1;
					} # if
				} # foreach
			$dirlistline=<DIRLIST>;
		chomp $dirlistline;
	} # While
	if ($trouble!=0) {
		print LOG "Info - END RUN - $trouble changes detected.";
		$errorsummary .= "Info - END RUN - $trouble changes detected.";
	} # if
	close (LOG);
	if ($notifymail eq 'Y' && $trouble != 0) {
		open (MAIL, "|mail -s '$notify_subject' $notify_email");
			print MAIL "$errorsummary";
		close(MAIL);
	} #if
} # sub

sub Cleanup {
	open (CONF, "< $configfile");
		STARTCONF:
		$confline=<CONF>;
		chomp $confline;
		while ( defined($confline) ) {
			if ( $confline =~ /:/) {
				goto STARTCONF;
			} else {
				$rmdir=$confline;
			} # if ... else
			$tmpDB=$rmdir . '.ViperDB.tmp';
			#unlink("$tmpDB");
			$confline=<CONF>;
			chomp $confline;
		} # While
	close (CONF);
} # sub