SHADOW and Y2K Problems

From: Bill Ralph (wralphat_private)
Date: Tue Jan 04 2000 - 05:41:20 PST

  • Next message: pdaat_private: "Re: irix-soundplayer.sh" 

    Version 1.6 of the SHADOW intrusion detection system passed through 1/1/00
with no problems. Those with earlier versions had a problem on their
sensors. Our suggestion is to fetch the latest version of SHADOW (Version
1.6) from http://www.nswc.navy.mil/ISSEC/CID/shadowForm.html and install it.

For the short term, line 22 in start_logger.pl of pre-1.6 versions reads:

$tmp = sprintf("%02d%02d%02d%02d", @T[5],@T[4]+1,@T[3],@T[2]);

Change it to:

$tmp = strftime("%y%m%d%H", @T);

This should keep your SHADOW system functioning until you upgrade to Version
1.6. As a by-product of that upgrade, you will get other worthwhile
improvements:

       Multiple day pattern search.
       Improved sensor scripts.
       Ability to run simultaneous tcpdumps with differing parameter files.
       Improvement in stopping previously started tcpdump.
       Raw data file names now use 4-digit year.
       Automatic archival of Incident Reports.
       Automatic generation of incident report number.
       Removal of obsolete accessories from package.
       Searching improved with abort button.
       New graphics and colors.
       NMAP button included in tool window.
       Four digit years throughout all scripts with backward compatibility.


---------------------------------------
 ___  _  _  _   ___       _       _
| . ><_>| || | | . \ ___ | | ___ | |_
| . \| || || | |   /<_> || || . \| . |
|___/|_||_||_| |_\_\<___||_||  _/|_|_|
Member of NSWC SHADOW Team  |_|
wralphat_private - (540)653-5593
---------------------------------------

    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:25:52 PDT