TIGERCRON(8)

💖 TIGERCRON 💖 (section 8, admin commands bestie)

okay so welcome to tigercron — the Cron utility for Tiger UNIX Security Checker 🐯✨ yes it's a whole thing and yes it slays

✨ SYNOPSIS ✨

tigercron [controlfile] [-B basedir] [tigeroptions...]

🌸 DESCRIPTION 🌸

So tigercron is what you call when you want the Tiger UNIX Security Checker to run its checks periodically — like, on a schedule, no you don't have to sit there and run it yourself, we're not doing that 💅

It reads a control file, which usually lives at /etc/tiger/cronrc, but lowkey you can also just hand it over as the first argument when you call the program. The format of this control file is the same as for the cron program — every line says when the different checks from Tiger are gonna run. 🕐

You can tell it where Tiger is installed with the -B basedir parameter, and any other extra options you drop on the command line get passed on to configure so Tiger gets configured based on them (that's all described over in tiger (8), go read it bestie).

Then tigercron runs the checks you asked for and compares their reports with previous stored reports (those live under /var/log/tiger). After that it mails the user defined in /etc/tiger/tigerrc — that's the Tiger_Mail_RCPT one, iykyk 📧

When a module runs, tigercron checks:

• If Tiger_Cron_Template is set to Y in tigerrc. If it is, it checks if there's a template saying which are the expected results.
• If Tiger_Cron_CheckPrev is set to Y in tigerrc. If it is, it checks if there's a previous run of the module it can check against.

A differential report gets generated depending on the module reports and the previous run, and it's sent through e-mail. These reports are the moment fr — they give you an easy way to detect intrusions even if no configuration of templates has been done. Like, in the event of an intrusion a Tiger check might detect something specific (file changes, new processes, new users, etc.) and this alert mechanism is literally the way to turn Tiger into a Host Intrusion Detection System (HIDS). 👑

The ability of it to work as a proper HIDS is based on a good customization of the cronrc file. Modules that check events to which the host is most exposed to should be run often so you can detect deviations from normal behaviour. Vibe check your cronrc, bestie, it matters. 🦋

💅 OPTIONS 💅

• Tigercron uses the same options as Tiger. A controlfile can be defined also to override the default.

🎀 FILES 🎀

• /etc/tiger/tigerrc — Configuration file for the Tiger tool.
• /etc/tiger/cronrc — Configuration file for the Tigercron tool.
• /var/log/tiger — Location of the log messages generated by Tiger when run through cron.
• /var/lib/tiger/work — Working directory used by Tiger scripts to create temporary files.

👀 SEE ALSO 👀

tigexp(8), tiger(8), cron(8), crontab(5)

The deficiencies of using tigercron as a HIDS are described in the file README.hostids which is provided with the package. In Debian GNU/Linux you will find this (and other related) documentation at /usr/share/doc/tiger/ 📚

💀 BUGS 💀

Currently Tigercron has only one alert mechanism (mail) and signatures are not supported. Thus, alerts could be faked. 🙈 Also, it is dependent on cron and will not work if cron is not working. Periodt.

🫶 AUTHOR 🫶

This manpage was written by Javier Fernandez-Sanguino.

okay that's the whole thing, thanks for coming to my TED talk 💖 this was Security, dated 19 September 2003, and yes it's still the TIGERCRON(8) page — go forth and cron responsibly bestie ✨🎀🦋