CDVT – Computer Defense Version Tracker [Updated - Feb 12th]
Hey Hey,
CDVT is a project that was dreamed up by me off some comments on tracking current project versions by a colleague. I'm sure we'll release information on ourselves and how we came up with the project once we launch it. However, as I'm planning a move over the next couple weeks, there might be some delay in the actual launch, however I'm hoping to get it completed this weekend while I still have some free time.
The concept of the CDVT is to have the authors/maintainers of popular tools place a single text file on the root of their website. CDVT will check this file at regular intervals, and find contained it in the most recent version of the software, which it will update in it's database. The database will be used to populate the front-end... a small applet (most likely actually a table of some sort, maybe a full page) that will allow you to notice at a glace the most recent versions of the software and keep yourself up to date.
Included during the release, will be a front-end that you can incorporate into your own site, as well as hopefully an RSS feed and possibly the expansion to a mailed out newsletter, daily or weekly... possibly only on updates.
I am looking for contact from authors/maintainers that would like to have their projects added and also suggestions from everyone as to what other projects/tools you'd like to see included.
To date I've contacted the following projects and their authors/maintainers:
- nmap (verified participation)
- nessus (in communication)
- snort
- hping
- dsniff
- amap
- hydra
- BackTrack
- WinPcap (verified participation)
- ettercap
- Ethereal (in communication)
- Cain & Abel
- John the Ripper (verified participation)
- Kismet (verified participation)
- Metasploit (verified participation)
- HiJackThis [Added Feb 10th]
- StartupList [Added Feb 10th]
- netfilter/iptables [Added Feb 12th] (verified participation)
- kernel.org [Added Feb 12th] (in communication) [Asking me to use their method and stray from a standard]
- nikto [Added Feb 12th] (verified participation)
- portsentry [Added Feb 12th]
- aide [Added Feb 12th]
- logwatch [Added Feb 12th]
- openssh [Added Feb 12th] (in communication) [Asking me to use their method and stray from a standard]
- openssl [Added Feb 12th]
- syslog-ng [Added Feb 12th]
Let me know of any others, or any ideas/suggestions you may have. You can post your comments here, or contact me - ht[at]computerdefense.org
Peace,
HT
This would be a great idea, if everyone gets on board with it. I always liked the way kernel.org gave the latest version upon a finger query; it owuld be nice if everyone did. But that’s not likely to happen. A text file on everyone’s server would be the next best thing,and once it catches on, everyone will be doing it.
I have a few things I’d like to see added to the list…
iptables
kernel.org
whisker/nikto
portsentry
aide
logwatch
openssh
openssl
syslog-ng
I’m sure I can think of more, I just need to wait for mailinglist announcements to come in. That’s what I can think of now for security related tools; if I were to start listing general system administration tools the list would start getting rather large, and I get the impression this is going to be limited to security tools, at least in the initial stages.
Howdy,
As an update… I’ve taken your suggestions and have contacted the following
netfilter/iptables
kernel.org
nikto
portsentry
aide
logwatch
openssh
openssl
syslog-ng
I will update with the results as I hear from them…
Also as another update.. The beta is in the works and in testing… I’ve ran into a slight problem with this webhost and I have contacted them to clarify the issue so I can finalize beta testing and send the text file format to those that have confirmed participation.
Both Kernel.org and OpenSSH has replied and have given me methods to obtain the current version. Since I’m working on a standardized format to make parsing and processing as simple as possible, this just isn’t going to work. If anyone here is interested in the methods that they are using, and would like to generate the file from the information they provide on their behalf, please let me know and I’ll be more than willing to point towards your information.