Home / server / Questions / 387111
In Process
John
Asked: 2012-05-09 06:53:50 +0800 CST

Inventory or Audit Installed Linux Software

  • 772

I am working on a project where we need to be able to tell and report periodically on what software is installed on our various Linux/Unix servers. I have looked at this, How to inventory what software/roles a Linux server is "serving up" to clients?, posting and this, Open-source inventory agent, posting and was not able to locate information that would suggest an answer to my issue. I am not sure that the OCS Agent would report on Linux/Unix servers like it does in Windows. Are there any scripts, open source software, software agents, etc. that can be used to run against a large number of Linux/Unix servers to report on what software is installed and what versions are installed?

=========================

Updates for clarity:

I am looking for a reliable way in which to determine if particular software exists on a Linux/Unix machine. Ideally, this would be a remote solution where I can point it towards the servers in question and have it return the results indicating if the software in question exists on that box or not. Also, should I be concerned about the following issues relating to installed software on a Linux/Unix host?

  1. Software installed from packages
  2. Software installed from source
  3. Software that is installed to an unknown or unexpected location

How would I go about handling these conditions along with finding out if the software exists?

linux unix reporting

6 Answers

    1. Check package management database
    2. Not perfectly reliable, but scan the entire filesystem for the expected executable or library file names.
    3. Same as #2, but don't count on it if somebody wants to rename netcat to purrmeow, statically compile it, and run it by calling libc instead of a direct execution.

    You could try to identify any files using the content of the first few bytes to check for executable magic numbers and then note any that don't have a home. This will take care of accidental or innocent violation installations. You'll be hard-pressed, however, if somebody wanted to put something in place and keep it hidden from you.

    To be really sneaky, one could embed an executable in some junk section of file, mmap it, and then memory jump into it. Where there's a will, there's a hacker... so beware of the limitations of whatever method you choose if this is an audit function.

    • 4

  2. This wouldn't actually be all that difficult to script up manually via ssh.

    That said, I think you're going about this the wrong way. You ought to start deploying via a configuration management system which will ensure your servers are in a specific, reproducible, version-controlled state.

    • 2

  3. ErikA is giving you sound advice. Instead of guessing what you have running, you should specify what you want running.

    But maybe blueprint can help you get from your current state to the one you should be in.

    • 2

  4. What OS are you running? You can pull this information from your system's package manager (rpm -qa), SNMP (using something like snmpwalk -v2c -c communityname hostname 1.3.6.1.2.1.25.6.3.1.2), or a configuration management solution of your choice... The earlier Blueprint recommendation is very good, too.

    • 2

  5. You could take a look at the stand alone linux (Ubuntu, Fedora, etc) audit script for Open-AudIT. It's a bit dated, but should provide what you are after.

    http://www.open-audit.org/downloads.php

    Disclaimer - I am the developer.

    • 1

  6. We've used OCS Inventory with reasonable success. https://www.ocsinventory-ng.org/en/

    • 0