This is version 2.5 of the Beltane II Manual.
Copyright © 2005-2015 Rainer Wichmann
Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.1 or any later version published by the Free Software Foundation with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. You may obtain a copy of the GNU Free Documentation License from the Free Software Foundation by visiting their Web site or by writing to: Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
This manual refers to Beltane II version 2.5.0.
Table of Contents
Beltaneis a web-based management console for the samhain/ yulecentralized file integrity / intrusion detection system. Within that system, yuleis the central log server, while samhainis the client (or standalone) application to monitor file integrity (and eventually check for kernel-level rootkits or rogue SUID binaries).
Beltaneis intended to be installed on the central log server, and to act as an administrative frontend. Beltaneallows to
manage a database of installed clients (in XML format),
review client messages, acknowledge them interactively, and update the file signature databases of clients accordingly (i.e. without the need to run an update on the client).
Beltanetakes advantage of the fact that samhainis designed to run as a daemon, and keeps a memory of file changes. Thus, if a file is modified, only one message is reported as long as the daemon runs. To avoid a new message when the daemon restarts, it is only neccessary to update the file signature database stored on the central server before the next restart of the daemon. All necessary information for this is provided in the daemon's report.
Samhain version 4.0 introduces a change in the baseline database format. This does not affect the client/server communication, i.e. it is possible to mix pre-4.0 and 4.0+ clients and server.
If you are using the Beltane II WebGUI, you need version 2.5+ to handle the new database format.
Finally, if you are planning to make use of the new features for integrating samhain into your change control process, you will need Samhain version 4.0+ for clients and sever, and Beltane II version 2.5+.
This Handbook uses the following notation:
|command||Command or text that would be typed.|
||"Variable" text that can be replaced.|
||Program or document code|