How to Compare Manifests From a Different System With the Manifest of a Control System

You can run system to system comparisons, thereby enabling you to quickly determine whether there are any file-level differences between a baseline system and the other systems. For example, if you have installed a particular version of the Solaris software on a baseline system, and you want to know whether other systems have identical packages installed, you can create manifests for those systems and then compare the test manifests with the control manifest. This type of comparison will list any discrepancies in the file contents for each test system that you compare with the control system.

1. Assume the Primary Administrator role, or become superuser.

   The Primary Administrator role includes the Primary Administrator profile. To create the role and assign the role to a user, see Chapter 2, Working With the Solaris Management Console (Tasks), in System Administration Guide: Basic Administration.

2. After installing the Solaris software, create a control manifest.

   # bart create options > control-manifest

3. Save the control manifest.

4. On the test system, use the same bart options to create a manifest, and redirect the output to a file.

   # bart create options > test1-manifest

   Choose a distinct and meaningful name for the test manifest.

5. Save the test manifest to a central location on the system until you are ready to compare manifests.

6. When you want to compare manifests, copy the control manifest to the location of the test manifest. Or, copy the test manifest to the control system.

   For example:

   # cp control-manifest /net/test-server/bart/manifests

   If the test system is not an NFS-mounted system, use FTP or some other reliable means to copy the control manifest to the test system.

7. Compare the control manifest with the test manifest and redirect the output to a file.

   # bart compare control-manifest test1-manifest > test1.report

8. Examine the BART report for oddities.

9. Repeat Step 4 through Step 9 for each test manifest that you want to compare with the control manifest.

   Use the same bart options for each test system.

Example 6–6 Comparing Manifests From Different Systems With the Manifest of a Control System

This example describes how to monitor changes to the contents of the /usr/bin directory by comparing a control manifest with a test manifest from a different system.

• Create a control manifest.

  # bart create -R /usr/bin > control-manifest.121203 !Version 1.0 ! Friday, December 12, 2003 (09:19:00) # Format: #fname D size mode acl dirmtime uid gid #fname P size mode acl mtime uid gid #fname S size mode acl mtime uid gid #fname F size mode acl mtime uid gid contents #fname L size mode acl lnmtime uid gid dest #fname B size mode acl mtime uid gid devnode #fname C size mode acl mtime uid gid devnode / D 13312 40755 user::rwx,group::r-x,mask:r-x,other:r-x 3fd9e925 0 2 /.s F 14200 104711 user::rwx,group::--x,mask:--x,other:--x 3f8dbfd6 0 1 8ec7e52d8a35ba3b054a6394cbf71cf6 /ControlPanel L 28 120777 - 3f81dc71 0 1 jre/bin/ControlPanel /HtmlConverter L 25 120777 - 3f81dcdc 0 1 bin/HtmlConverter /acctcom F 28300 100555 user::r-x,group::r-x,mask:r-x,other:r-x 3f6b5750 0 2 d6e99b19c847ab4ec084d9088c7c7608 /activation-client F 9172 100755 user::rwx,group::r-x,mask:r-x, other:r-x 3f5cb907 0 1 b3836ad1a656324a6e1bd01edcba28f0 /adb F 9712 100555 user::r-x,group::r-x,mask:r-x,other:r-x 3f6b5736 0 2 5e026413175f65fb239ee628a8870eda /addbib F 11080 100555 user::r-x,group::r-x,mask:r-x,other:r-x 3f6b5803 0 2 a350836c36049febf185f78350f27510 . . .

• Create a test manifest for each system that you want to compare with the control system.

  # bart create -R /usr/bin > system2-manifest.121503 ! Version 1.0 ! Friday, December 15, 2003 (13:30:58) # Format: #fname D size mode acl dirmtime uid gid #fname P size mode acl mtime uid gid #fname S size mode acl mtime uid gid #fname F size mode acl mtime uid gid contents #fname L size mode acl lnmtime uid gid dest #fname B size mode acl mtime uid gid devnode #fname C size mode acl mtime uid gid devnode / D 13312 40755 user::rwx,group::r-x,mask:r-x,other:r-x 3fd9ea9c 0 2 /.s F 14200 104711 user::rwx,group::--x,mask:--x,other:--x 3f8dbfd6 0 1 8ec7e52d8a35ba3b054a6394cbf71cf6 /ControlPanel L 28 120777 - 3f81dc71 0 1 jre/bin/ControlPanel /HtmlConverter L 25 120777 - 3f81dcdc 0 1 bin/HtmlConverter /acctcom F 28300 100555 user::r-x,group::r-x,mask:r-x,other: r-x 3f6b5750 0 2 d6e99b19c847ab4ec084d9088c7c7608 . . .

• When you want to compare manifests, copy the manifests to the same location.

  # cp control-manifest /net/system2.central/bart/manifests

• Compare the control manifest with the test manifest.

  # bart compare control-manifest system2.test > system2.report /su: gid control:3 test:1 /ypcat: mtime control:3fd72511 test:3fd9eb23

The previous output indicates that the group ID of the su file in the /usr/bin directory is not the same as that of the control system. This information can be helpful in determining whether a different version of the software was installed on the test system or if possibly someone has tampered with the file.