samhain file integrity scanner | online documentation

Using samhain with GnuPG

This document aims to explain how to use samhain with signed configuration and database files which are checked by invoking GnuPG.

Introduction

Samhain can be compiled to recognize PGP signatures on configuration and database files and to invoke GnuPG in order to check such signatures. (Note: while the application usually is referred to as GnuPG, the executable itself is called gpg).

If samhain is compiled with this option, then

both the configuration file and the file signature database must be signed, and
for both files the signatures must verify correctly,
otherwise samhain will abort.

Prerequisites

Obviously you need gpg (GnuPG), and you must have created a key pair with:
gpg --gen-key
(it does not really matter which type of key, the defaults are ok).
GnuPG uses a public-key algorithm: the key pair consists of
- a secret key that is used for signing and stored in ~user/.gnupg/secring.gpg, and
- a public key used for verifying the signature, and stored in ~user/.gnupg/pubring.gpg.
The secret key obviously should be kept secret, while the public key can be published.
You need to compile samhain with support for GnuPG:
./configure --with-gpg=/path/to/gpg [more options]

Note 1: If compiled with support for GnuPG, the TIGER192 checksum of the gpg executable will be compiled into samhain, and the gpg executable will be checksummed (to verify its integrity) before invoking it. If you don't like this, you should add the configure option:

--with-checksum=no

Compiling in the GnuPG checksum will tie the samhain executable to the gpg executable. If you upgrade GnuPG, you will need to re-compile samhain. If you don't like this, use '--with-checksum=no'.

Note 2: The mere fact that the signature is correct does not prove that it has been signed by you with your key - it just proves that it has been signed by somebody. Samhain can optionally check the fingerprint of the key that has been used to sign the files, to verify that your key has been used to sign the file(s). To enable this, use the configure option

--with-fingerprint=FINGERPRINT

where FINGERPRINT is the hexadecimal fingerprint of the key as listed with

gpg --fingerprint

Example


rainer$ gpg -