Labrador Intrusion Detection

File Release Notes and Changelog

Release Name: labrador 0.7

Notes:
Several changes were made from version 0.6 to this one, and users are urged to upgrade as soon as possible as it contains several improvements and bugfixes. Main usability difference is that now the rules files is called "rules.conf" and the "labrador.conf" file is now used to store preferences, such as language, database encryption, email, etc. Please check the changelog for a complete list of changes.

Changes:
Changes in version 0.7.1

        - Fixed problem that makes labrador fail to find the "lang" directory
          when it is ran from another directory (SF Bug ID: 1241636)
        - Fixed bug where <no...> tags added empty entries if no other tag
          was selected (SF Bug ID: 1241336)
        - Fixed bug where <nonew> entries were treated as new files
        - Fixed some smaller issues (not really bugs, just some missing "\n")
        - Fixed minor spanish translation problems
        - Added one or two missing things in the documentation
        - Fixed bug where the logfile was stored in the current directory
          (SF Bug ID: 1253870)

Changes in version 0.7.0

        - Updated documentation to include all the changes in v0.7.0
        - The labrador_with_modules.pl file was aborted, replaced with
          a binary version of Labrador for *NIX systems.
        - Now labrador uses two files: "labrador.conf" (to store its own
          configuration) and "rules.conf" (the rules file).
        - Added SHA-224/256/384/512 hash algorithms support.
        - Added RipeMD160 hash algorithm support.
        - Added 'aide2lab.pl'  in the "tools" subdirectory.
          (thanks to Tito O. Negreiros for providing it)
        - Added <nonew> to warn whenever new files are added to the
          specified directories.
        - Added <nohidden> tag to warn if directory contains hidden files (*NIX only for now).
        - Added <noexec> tag to warn if directory contains executable files.
        - Added <nosuid> tag to warn if directory contains suid files.
        - Added <nosgid> tag to warn if directory contains sgid files.
        - Added <nobinary> tag to warn if directory contains binary files.
        - Added <notext> tag to warn if directory contains text files.
        - Added <nosymlink> tag to warn if directory contains symbolic links
        - Added <grow> tag to warn if file's size decreases
        - Added <reset> tag to reset all previous tags (in case people get confused)
        - Labrador can now send email reports (if properly configured) whenever changes are detected.
          (Thanks to Tito O. Negreiros for providing the patch)
        - Added database encryption support.
        - Added database compression support.
        - Code cleanup
        - Fixed bug where directories without trailing '/' were treated as files.
        - Fixed bug where a '*' after a '-r' would not scan specified files.
        -Fixed bug where files scanned in Windows were sometimes displayed with '/' instead of '\' (thanks to Fabio Martins for reporting);
        - Added inline comment support in labrador.conf
        - Now Labrador gives a hint to do '-v' or '-f' if it can't find the labrador.db file.
        - Added 'quarantine' capability when restoring files via --quarantine and --quarantine_filename parameters;
        - Now the '*' parameter in labrador.conf is optional. The user may simply specify a directory (like '/etc', instead of '/etc *' or '/etc/*');
        - Added support for messages in different languages (3 already implemented: english, brazillian portuguese and spanish);
        - Labrador now logs when tampered files are restored (in the logfile);
        - New parser code reads the entire .conf file instead of one line at a time.
        - New parser understand wildcards (e.g.: "/etc/rc.d/rc.*", \winnt\*.exe")
          (thanks to Tito O. Negreiros for providing the patch)
        - Now "-R" is also recognised as a recursive flag in labrador.conf (used to be only "-r").
        - logfile is now treated via function
        - "labrador.err" file is now only created if necessary