Tiger Security Audits and Intrusion Checks on Debian

Tiger is a modular, host-based security audit and intrusion detection tool that actively monitors the integrity of the Debian operating system. It performs periodic security audits by running an automated suite of POSIX-compliant shell scripts and C binaries triggered by system schedulers. These checks inspect file system permissions, system binaries, open network ports, user accounts, and kernel configurations against predefined security baselines, generating centralized reports that alert system administrators to anomalies, misconfigurations, and potential intrusions.

Periodic Execution via Cron

Tiger implements periodic scheduling through Debian’s native cron infrastructure. Upon installation via Debian's package manager, the package configures automated execution scripts located within /etc/cron.d/tiger, /etc/cron.daily/tiger, or /etc/cron.monthly/tiger.

The daily cron job runs lightweight checks designed to detect immediate signs of intrusion, such as modifications to system binaries, unexpected root-level access, and altered system logs. The monthly cron execution runs a comprehensive, resource-intensive audit that reviews historical security baselines, dormant user accounts, file integrity across every mounted partition, and package-level checksum mismatches. Administrators can customize check frequencies and runtime behavior using the central configuration file located at /etc/tiger/tigerrc.

Core Inspection Modules and Vulnerability Scanning

Tiger relies on independent, modular scripts located in /usr/lib/tiger/systems/Linux/ and /usr/lib/tiger/scripts/ to audit specific aspects of the Debian environment:

  • File System and Permissions: Scans for world-writable directories, unauthorized SUID/SGID executables, orphaned files without assigned owners, and hidden files across the root filesystem.
  • Account and Authentication Security: Parses /etc/passwd, /etc/shadow, and PAM configurations to identify empty passwords, duplicate user IDs, unauthorized root equivalencies (UID 0), and weak administrative credentials.
  • Network and Service Auditing: Invokes system networking utilities (netstat, ss, and lsof) to analyze listening TCP and UDP sockets, comparing active listeners against a predefined list of valid services to detect rogue processes or backdoors.
  • System Binary Integrity: Integrates with Debian tools such as debsums to compare the SHA-256 and MD5 checksums of installed packages against the pristine checksums published in the Debian repository.
  • Kernel and Process Auditing: Checks /proc and kernel runtime variables (sysctl) to identify hidden processes, rootkit traces, unsecured network parameter flags (such as disabled SYN cookies or enabled IP forwarding), and unapplied kernel mitigations.

Baseline Comparison and False Positive Reduction

To prevent false alarms during periodic checks, Tiger utilizes template baselines stored in /etc/tiger/. System administrators can define expected anomalies—such as legitimate custom SUID binaries or designated open ports—by recording them in configuration override files like tiger.ignore. During each scheduled audit, Tiger filters its findings through these ignore definitions, highlighting only new, unverified deviations from the established system state.

Alerting and Reporting Architecture

Once the periodic audit sequence finishes, Tiger compiles all output into a timestamped security report stored in /var/log/tiger/security.report.<date>. If configured, Tiger immediately pipes this report to the local mail server via mailx or sendmail, dispatching a summarized digest directly to the root mailbox or an external administrative email address. The report groups findings into critical severity flags: alerts requiring immediate action (FAIL), security warnings (WARN), and informational optimization suggestions (INFO).