trustchk Command

Purpose

Administration of Trusted Signature Database (TSD) and Trusted Execution function.

Syntax

Add Files to TSD

trustchk [ -R module name ] -s <private key file> -v <certificate file> [ -P ] -a [tree] { filename [ size=VOLATILE ] [ hardlinks=value ] [ symlinks=value ]...| -f filename }

Delete Files from TSD

trustchk -d { filename...| ALL | -f filename }

Query TSD

trustchk -q { filename...| ALL |-f filename }

Switch to New Hashing Algorithm

trustchk -g [ SHA1 | SHA256 | SHA512 ]

System Scan

trustchk [-i] [ -x ] { -n | -t | -y } tree [dirpath…….]

Configure Policies

trustchk [ -@ { WparName | ALL } ] -p { [ TE [ = ON | OFF ] ] [ CHKEXEC [ = ON | OFF ] ] [ CHKSHLIB [ = ON | OFF ] ] [ CHKSCRIPT [ = ON | OFF ] ] [ CHKKERNEXT [ = ON | OFF ] ] [ STOP_UNTRUSTD [ = ON | OFF | TROJAN ] ] [ STOP_ON_CHKFAIL [ = ON | OFF ] ] [ LOCK KERN POLICIES [ = ON | OFF ] ] [ TEP [ = ON | OFF | PathList ] ] [ TLP [ = ON | OFF | PathList [ TSD_FILES_LOCK [ = ON | OFF | EXVOL] ] [ TSD_LOCK [ = ON | OFF ] ] }

System Audit

trustchk [ -l ] [ -r ] { -n | -t | -y } { filename... | ALL } }

Using Alternate TSD File

trustchk -F TSDFile { -a | -d | -g | -q | -y | -n | -t }

Update TSD trustchk

trustchk -u <filename>[<attr>=value]

trustchk -k -s sign-key -v verify-key -N -D 
"OU=IT + OU=jj, OU=zlab037.austin.ibm.com"

Description

Managing the Trusted Signature Database

Audit the security state of the system

To audit the security state of the system, you must check the security parameters stored in the TSD against the parameters of the actual files present on the system. Use the trustchk command to do so. Any discrepancy in the values is pointed to the user based on the input flags specified. To check all of the files that are listed in the TSD, use the ALL parameter in place of filename. You can specify a list of files separated by spaces on the command line.

Enabling the Trusted Execution function

To enable or disable the runtime integrity-verification function that is responsible for verifying of a file's cryptographic hash before being started, use the trustchk command. To turn the Trusted Execution function on or off, use the TE -p flag.

Configure different policies for Trusted Execution

By default, the TSD defines all the files and programs that are part of the trusted computing base, but the privileged user or a member of the security group can choose to define only those files considered to be security-relevant.

The TE policies are stored in the /etc/security/tsd/tepolicies.dat file.

This command writes messages to the standard error log (stderr).

Scanning the system for TROJAN detection

Flags

Exit Status

This command returns the following exit values:

Examples

1. To add a new file definition for /usr/bin/ls using private key located at /home/guest/privkey.der and an associated certificate at /home/guest/certificate.der , enter the following command:

   trustchk –s /home/guest/privkey.der –v /home/guest/certificate.der 
   –a  /usr/bin/ls

2. To add a file as a volatile file to the TSD using same pair of private key and certificate in the previous example, enter the following command:

   trustchk –s /home/guest/privkey.der –v /home/guest/certificate.der 
    –a  /usr/bin/passwd size=VOLATILE

3. To add a file /usr/bin/ls with a /usr/local/bin/ls hardlink to TSD using same pair of private key and certificate in the first example, enter the following command:

    trustchk–s /home/guest/privkey.der –v /home/guest/certificate.der 
   –a  /usr/bin/ls hardlinks=/usr/local/bin/ls 

4. To delete a file /usr/bin/logname, enter the following command:

    trustchk –d  /usr/bin/logname

5. To add file definitions stored in a file /home/guest/filedef.in, enter the following command:

   trustchk –s /home/guest/privkey.der 
   –v /home/guest/certificate.der 
   –a  -f /home/guest/filedef.in

6. To enable policy for checking executable file listed in the TSD on every load, follow these steps:
   1. Configure the policy by entering the following command:

      trustchk –p CHKEXEC=ON

   2. Activate the policy by entering the following command:

      trustchk –p TE=ON

7. To check the integrity of all of the files belonging to the TSD, enter the following command:

   trustchk –n ALL

8. To print the value of the currently active hash algorithm for TSD, enter the following command:

   trustchk -g

9. To list all the policies of a WPAR, enter the following command:

   trustchk -@ <wpar> -p

10. To list all the policies of all WPARs, enter the following command:

    trustchk -@ ALL -p

11. To scan the whole system for a TROJAN detection report only, enter the following command:

    trustchk –n tree

12. To scan only dir /usr for TROJAN detection and automatically fix them, enter the following command:

    trustchk  -y /usr

13. To scan the entire system for TROJAN detection, except NFS mounts filesystem, and fixes them interactively, enter the following command:

    trustchk –i –t tree

14. To take the values from the LDAP server instead of the local copy, enter the following command:

    trustchk –R LDAP -p