Chapter 1: Introduction

1.1: What's new in Stealth V.1.34

Two new options were added to facilitate report-file rotations: The report file should not be modified while integrity scans take place. The new options were added to make sure this requirement is met when the report file must be rotated. The ssh connections to clients remain open between pairs of --suppress and --resume commands. See section 5.8 for details about these two options.

Issues related to suppressing stealth runs are:

1.2: Stealth

Welcome to stealth. The program stealth implements a file integrity scanner. The acronym stealth can be expanded to

SSH-based Trust Enforcement Acquired through a Locally Trusted Host.

This expansion contains the following key terms:

stealth is based on an idea by Hans Gankema and Kees Visser, both at the Computing Center of the University of Groningen.

stealth's main task is to perform file integrity tests. However, the testing will leave no sediments on the tested computer. Therefore, stealth has stealthy characteristics. I consider this an important security improving feature of stealth.

The controller itself only needs two kinds of outgoing services: ssh(1) to reach its clients, and some mail transport agent (e.g., sendmail(1)) to forward its outgoing mail to some mail-hub.

Here is what happens when stealth is run:

Alternatively, the command-line options --rerun and --terminate may be provided to communicate with a stealth process started earlier using either the --keep-alive or --repeat option. In this case,

The options --suppress and --rerun (see section 5.8) were implemented to allow safe rotations of stealth's report file.

1.2.1: The integrity of the stealth distribution

The integrity of the archive stealth-1.34.tar.gz can be verified as follows:

This should produce output comparable to:

gpg: Signature made Mon Aug  1 10:57:41 2005 CEST using DSA key ID 38C66170
gpg: Good signature from "Frank B. Brokken <f.b.brokken@rug.nl>"
gpg:                 aka "Frank B. Brokken <f.b.brokken@rc.rug.nl>"