Perforce: //depot/projects/trustedbsd/openbsm/...

cvsup: p4-cvs-trustedbsd-openbsm

OpenBSM is a portable, open source implementation of Sun's Basic Security Module (BSM) security audit API and file format. BSM, the de facto industry standard for audit, describes a set of system call and library interfaces for managing audit records, as well as a token stream file format that permits extensible and generalized audit trail processing. Records may describe both kernel events, such as system calls, as well as application events, such as login, password changes, etc.

OpenBSM extends the BSM API and file format in a number of ways to support features present in the Mac OS X and FreeBSD operating systems, such as Mach task interfaces, sendfile(), and Linux system calls present in the FreeBSD Linux emulation layer, as well as focusing on portability through an endian-independent version of the trail format.

The OpenBSM distribution provides system include files, the libbsm library, command-line tools such as praudit and auditreduce, sample /etc configuration files, and an audit daemon for use on systems with kernel support. It is appropriate for use stand-alone in processing trails generated by BSM-enabled systems, as well as for use as the foundation of OS audit implementations requiring libraries, command-line tools, etc.

OpenBSM is built and tested on several versions of FreeBSD, Mac OS X, and Linux; some components, such as the audit daemon, require kernel audit support (present in newer versions of FreeBSD and Mac OS X), but the basic library and audit trail tools run on all three platforms regardless of OS kernel support. Written in portable C and built using autoconf/automake, it is easy to adapt OpenBSM for use on new platforms.

OpenBSM is derived from the BSM audit implementation found in Apple's open source Darwin operating system, generously released by Apple under a BSD license. The Darwin BSM implementation was created by McAfee Research under contract to Apple Computer, and has since been extended by the volunteer TrustedBSD team.

OpenBSM is the core user space component of the TrustedBSD Audit Implementation for FreeBSD, providing tools, libraries, and include files. OpenBSM ships with FreeBSD 6.2 and later, with the first full release of OpenBSM (1.0) in FreeBSD 6.3 and FreeBSD 7.0.

BSMtrace is a BSM-based host intrusion detection system that relies on OpenBSM audit trails.

Discussion of the TrustedBSD Audit implementation, as well as the OpenBSM package, takes place on the trustedbsd-audit mailing list.

OpenBSM source code is available for download via occasional snapshot and release tarballs, vendor integrated source code (such as the FreeBSD source tree), cvsup, and the TrustedBSD Perforce repository. The current release is OpenBSM 1.0, released on 28 October 2007. Please see the file README present in the OpenBSM distribution for build and installation instructions.

Development snapshots reflect work-in-progress snapshots of the OpenBSM development branch in Perforce. They are appropriate for use in production systems, but consumers of these snapshots should be aware that APIs, file formats, and tools are under active development, and may change at any time. Please see the file README present in the OpenBSM distribution for build and installation instructions.

This is an archive of past OpenBSM test snapshots; use of these versions is not recommended. These snapshots are from the development of OpenBSM 1.1:

These snapshots are from the development of OpenBSM 1.0: