how to copy compiled binaries to other system 2

[dwcasey]

I have downloaded and compiled tripwire on my dev machine. Now i want to push this out to other systems as-is. I don't want to have to install gcc and compile a dozen other systems. We like to keep those systems 'clean' if you know what I mean.

I compiled and tar'd up the dir, then ftp'd it over. Now when I try to run the initialize command, it complains from what appears to be because it was not built on this particular machine.

exec(): 0509-036 Cannot load program ./tripwire because of the following errors:
0509-150 Dependent module libstdc++.a(libstdc++.so.5) could not be loaded.
0509-022 Cannot load module libstdc++.a(libstdc++.so.5).
0509-026 System error: A file or directory in the path name does not exist.

Is there a gcc option I can run to make sure these are 'built-in' or could I just copy these over??

 

[khalidaaa]

IMHO I hope this would help without installing the gcc! I think you need to install the libstdc++ on that machine to be able to run your program!

You will be able to find a copy of it here:

http://www-03.ibm.com/systems/p/os/aix/linux/toolbox/ezinstall.html

Regards,
Khalid

 

[dwcasey]

I got it installed, but I'm getting the same error

>rpm -qa | grep libstd

libstdc++-4.2.0-2

 

[khalidaaa]

Check the LIBPATH variable! It should point to the libstdc lib!

Also, you can use the ldd command to check what other missing libraries you need to run your script.

(IMHO You might need libstdc++-devel instead if this won't work!)

For some reason the above link is not working! You can get the same in here:

http://www.perzl.org/aix/index.php?n=Main.Gcc

Regards,
Khalid

 

[p5wizard]

Just a hunch (and I may be completely wrong), but you have installed libstdc++ at version 4, and in your OP I see that tripwire complains about libstdc shared library at version 5 ?

exec(): 0509-036 Cannot load program ./tripwire because of the following errors:
0509-150 Dependent module libstdc++.a(libstdc++.so.[red]5[/red]) could not be loaded.
0509-022 Cannot load module libstdc++.a(libstdc++.so.[red]5[/red]).
0509-026 System error: A file or directory in the path name does not exist.

versus

>rpm -qa | grep libstd

libstdc++-[red]4.2.0-2[/red]


HTH,

p5wizard

 

[dwcasey]

p5, that might be it as well, but I only see what appears to be version 4 of libstdc out there, even in the link given above. I'm just not sure at this point.

I added the LIBPATH, getting similar error:

exec(): 0509-036 Cannot load program ./tripwire because of the following errors:
0509-150 Dependent module /opt/freeware/lib/gcc/powerpc-ibm-aix5.3.0.0/4.2.0/libstdc++.a/libstdc++.a(libstdc++.so.5) could not be loaded.
0509-022 Cannot load module /opt/freeware/lib/gcc/powerpc-ibm-aix5.3.0.0/4.2.0/libstdc++.a/libstdc++.a(libstdc++.so.5).
0509-026 System error: A parameter must be a directory.

Anyone know if there is a precompiled tripwire for AIX out there? Bull freeware was a no go.

 

[p5wizard]

To compare, on both servers, type

[tt]ar t libstdc++.a|grep libstdc++.so[/tt]

(either cd to the dir where libstdc++.a resides first or type in the full path name for the [tt]ar t[/tt] command.)

see if both have the .5 version of the .so file in the archive.



HTH,

p5wizard

 

[dwcasey]

Hrm...I'm confused

ar t libstdc++.a|grep libstdc++.so

ar: 0707-100 libstdc++.a does not exist.

>rpm -qa

cdrecord-1.9-4
mkisofs-1.13-4
vnc-3.3.3r1-2
prngd-0.9.29-1
zlib-1.2.2-4
sudo-1.6.7p5-1
openssl-0.9.7g-1
expect-5.42.1-3
tcl-8.4.7-3
tk-8.4.7-3
gcc-4.0.0-1
AIX-rpm-5.3.7.0-6

It works on this box, but those libs are not present?? so during compile, maybe Tripwire source did something??

 

[p5wizard]

Did you cd to /usr/lib first?

Better yet, [tt]find[/tt] the libstdc++.a file:

[tt]find / -name libstdc++.a -print[/tt]

Then run the [tt]ar t[/tt] command on the file it finds as per above post.



HTH,

p5wizard

 

[dwcasey]

On the working system

/usr/local/lib/power/libstdc++.a
/usr/local/lib/powerpc/libstdc++.a
/usr/local/lib/ppc64/libstdc++.a
/usr/local/lib/pthread/power/libstdc++.a
/usr/local/lib/pthread/powerpc/libstdc++.a
/usr/local/lib/pthread/ppc64/libstdc++.a
/usr/local/lib/pthread/libstdc++.a
/usr/local/lib/libstdc++.a

>ar t /usr/local/lib/power/libstdc++.a
libstdc++.so.5

>ar t /usr/local/lib/powerpc/libstdc++.a
libstdc++.so.5

>ar t /usr/local/lib/pthread/powerpc/libstdc++.a
libstdc++.so.5

>ar t /usr/local/lib/ppc64/libstdc++.a

>ar t /usr/local/lib/pthread/power/libstdc++.a
libstdc++.so.5

>ar t /usr/local/lib/pthread/ppc64/libstdc++.a

>ar t /usr/local/lib/pthread/libstdc++.a
libstdc++.so.5

>ar t /usr/local/lib/libstdc++.a
libstdc++.so.5

on the non-working box, I get "does not exist" for each one.
but, I show it is install, just in a diff path. I updated the path. I wonder if I need to add each of these in LIBPATH or, simply copy them to the path that the working box uses?

>rpm -qa | grep libstd
libstdc++-4.2.0-2

 

[p5wizard]

OK, you shouldn't be doing this but...

On a non-working box that you can play around on (not production), copy over the /usr/local/lib/libstdc++.a file from the working box (same dir /usr/local/lib).

Then try the executable again (make sure that dir is in LIBPATH).

You also may want to verify that both boxes are running the same AIX (version, TL and SP): [tt]oslevel -s[/tt] must report the same level.



HTH,

p5wizard

 

[p5wizard]

One other thing you can do is to find out if there's an AIX fileset that owns any of those lib files

lslpp -w /usr/local/lib/libstdc++.a

But as it is located in /usr/local/lib, I'd doubt it. Perhaps you do need to install gcc on all the boxes and then distribute the binary you created. So you don't need to rebuild on all the boxes, just have all the dev tools installed?


HTH,

p5wizard

 

[dwcasey]

Well, not having too much luck still, so I'm starting to wonder if there is a tripwire-like app out there? Doesn't have to be as robust, but simply to watch files in a directory and see if their attributes have changed.

I could cron it to run at midnight, create a new list of files, compare to old, create file of diffs.

I guess the catch is I would like to know who or what process made the change.

 

[Edcrosbys]

Have you tried Samhain?

http://la-samhna.de/samhain/index.html

This provides paid version tripwire like functionality. The libraries needed depend on what functionality you'd like. With just standard freeware functionality, I believe you could get away with no extra libraries and just gcc (on the first box) unless you want some of the additional functionality.

After this you should be able to distribute those binaries across. If you have shared key authentication, you can deploy it from the original server.

Here's some info to compare the different scanners (although written by samhain's author):

http://www.la-samhna.de/library/scanners.html

Also, you'd be tough pressed to find something that would tell you what process changed each file. I would think something like that would have to run constantly watching every file call in the system. As soon as a file changed it would have to log who changed it. On a decently used system, I do believe this would KILL performance. But I'm open to someone proving me wrong!

 

[dwcasey]

Samhain worked as far as compiling on one machine and copying to another, thank you!

As far as who did what, I agree. I was sure what sort of data is kept track of by these various apps ( tripwire, samhain, etc ).

I think a file scan, store to db methodology works well as a level set, then compare activity against it.

It appears samhain does something similar, but I'm still digging through the docs.

 

[Edcrosbys]

I'm glad Samhain worked for you.

I've been thinking about the "who changed the file" portion... In HP-UX you could turn on TCB (trusted computing base) and have an audit trail of kernel level calls, if you wanted. This could, with enough patience, tell you who/what changed a specific file.

I'm pretty sure AIX has something similar and it probably includes something to let you know if specific files have changed. It might be EXTREME overkill for your needs, but I thought I'd throw it out there for you to look into. Or maybe someone who is more familiar with this can chime in..

 

[dwcasey]

I'm a little familar with TCB on AIX. From what I know, however, is that is requires the OS to be reinstalled.

 

[MoreFeo]

In AIX TCB must be included at installation time, but the audit process is not a part of TCB (in AIX).

In AIX you can turn on audit at any time (without rebooting).

Try man audit, and have a look at the conf files to see what you can really audit.