    Plain commands can be executed on the client computer by merely
specifying them. Of course, this means that programs called
tt(LABEL), tt(LOCAL) tt(USE) or tt(DEFINE), cannot be executed, since
these names are interpreted otherwise by s(). It's unlikely that this
will cause problems. Remote commands must succeed (i.e., their return 
codes must be 0).

    Remote commands are commands executed on the client using the bf(SSH)
shell. These commands are executed using the standard tt(PATH) set for the
bf(SSH) shell. However, it is advised to specify the full pathname to the
programs to be executed, to prevent ``trojan approaches'' where a trojan horse
is installed in an `earlier' directory of the tt(PATH)-specification than the
intended program.

    Two special remote commands are tt(GET) and tt(PUT), which can be used to
copy files between the client and the monitor.  Internally, tt(GET) and
tt(PUT) use the tt(DD) use-specification. If a non-default specification is
used, one should ensure that the alternate program accepts bf(dd)(1)'s tt(if=,
of=, bs=) and tt(count=) options. With tt(GET) the options tt(bs=, count=) and
tt(of=) are used, with tt(PUT) the options tt(bs=, count=) and tt(if=) are
used. Normally there should be no need to alter the default tt(DD)
specification.

    The tt(GET) command may be used as follows:
    itemization(
    it() bf(GET) tt(<client-path> <local-path>)nl()
    Copy the file indicated by tt(client-path) at the client to tt(local-path)
at the monitor. tt(client-path) must be the full path of an existing file
on the client, tt(local-path) may either be a local directory, in which case
the client's file name is used, or another file name may be specified, in
which case the client's file is copied to the specified local filename. If the
local file already exists, it is overwritten by the copy-procedure.

    Example:
    verb(    GET /usr/bin/sha1sum /tmp)
    The program tt(/usr/bin/sha1sum), available at the client, is copied to
the monitor's tt(/tmp) directory. If copying fails for some reason, any
subsequent commands are skipped, and s() terminates.

    it() bf(GET NOTEST) tt(<client-path> <local-path>)nl()
    Copy the file indicated by tt(client-path) at the client to tt(local-path)
at the monitor. tt(client-path) must be the full path of an existing file
on the client, tt(local-path) may either be a local directory, in which case
the client's file name is used, or another file name may be specified, in
which case the client's file is copied to the specified local filename. If the
local file already exists, it is overwritten by the copy-procedure.

    Example:
    verb(    GET NOTEST /usr/bin/sha1sum /tmp)
    The program tt(/usr/bin/sha1sum), available at the client, is copied to the
monitor's tt(/tmp) directory. Remaining commands in the policy file are
executed, even if the copying process wasn't successful.
    )

    The tt(PUT) command may be used as follows:
    itemization( 
    it() bf(PUT) tt(<local-path> <remote-path>)nl()
    Copy the file indicated by tt(local-path) at the monitor to
tt(remote-path) at the client. The argument tt(local-path) must be the
full path of an existing file on the monitor. The argument tt(remote-path)
must be the full path to a file on the client. If the remote file already
exists, it is overwritten by tt(PUT).

    Example:
    verb(    PUT /tmp/sha1sum /usr/bin/sha1sum)
    The program tt(/tmp/sha1sum), available at the monitor, is copied to the
client as tt(usr/bin/sha1sum). If the copying fails for some reason,
any subsequent commands are skipped, and s() terminates.

    it() bf(PUT NOTEST) tt(<local-path> <remote-path>)nl()
    Copy the file indicated by tt(local-path) at the monitor to
tt(remote-path) at the client. The argument tt(local-path) must be the
full path of an existing file on the monitor. The argument tt(remote-path)
must be the full path to a file on the client. If the remote file already
exists, it is overwritten by tt(PUT).

    Example:
    verb(    PUT NOTEST /tmp/sha1sum /usr/bin/sha1sum)
    Copy the file indicated by tt(local-path) at the monitor to
tt(remote-path) at the client. The argument tt(local-path) must be the full
path of an existing file on the monitor. The argument tt(remote-path) must
be the full path to a file on the client. If the remote file already exists,
it is overwritten by tt(PUT). Remaining commands in the policy file are
executed, even if the copying process wasn't successful.
    )

    Other commands to be executed on the client can be specified as follows:

    itemization(
    it() tt(command)

        Execute `tt(command)' on the client, using the bf(SSH) command
shell. The command must succeed (i.e., must return a zero exit
value). However, any output generated by the command is ignored. 
    Example:
        verb(    /usr/bin/find /tmp -type f -exec /bin/rm {} \;)
    This command will remove all ordinary files at and below the client's
tt(/tmp) directory.

    it() bf(NOTEST) tt(command)

        Execute tt(command) on the client, using the bf(SSH) command
shell. The command may or may not succeed.

    Example:
        verb(    NOTEST /usr/bin/find /tmp -type f -exec /bin/rm {} \;)
    Same as the previous command, but this time the exit value of
tt(/usr/bin/find) is not interpreted.

    it() bf(CHECK)  [bf(LOG =)] tt(logfile [pathOffset] command)

        Execute tt(command) on the client, using the bf(SSH) command
shell. 

    The phrase bf(LOG =) is optional. When a relative file location is
specified at tt(<file-spec>) it is interpreted relatively to the tt(USE BASE)
path specification. 

tt(PathOffset) is also optional, and has the same meaning as for the tt(LOCAL
CHECK) command, described above.

The command must succeed. The output of this command is compared to the
output of this command generated during the previous run of s(). Any
differences are written to bf(REPORT). If differences were found, the existing
tt(logfile) name is renamed to tt(logfile.YYYYMMDD-HHMMSS), with
tt(YYYYMMDD-HHMMSS) being the datetime-stamp at the time s() was run.

    Note that the command is executed on the client, but the logfile is kept
at the monitor. This command represents the core of the method implemented
by s(): there will be no residues of the actions performed by s() on client
computers.

    Several examples (note the use of the backslash as line continuation
characters):
    COMMENT(CAREFUL: EXTRA BLANK REQUIRD IN THE YODL FILE BEHIND \ )
        verb(    CHECK LOG = remote/ls.root  /usr/bin/find / \ 
            -xdev -perm /6111 -type f -exec /bin/ls -l {} \;)
    All suid/gid/executable files on the same device as the root-directory (/)
on the client computer are listed with their permissions, owner and size
information. The resulting listing is written on the file
bf(BASE)tt(/remote/ls.root). 

    This long command could be formulated shorter using a tt(DEFINE):
        verb(    DEFINE LSFIND   -xdev -perm /6111 -type f -exec /bin/ls -l {} \;
    CHECK remote/ls.root  /usr/bin/find / ${LSFIND})

    Another example:
        verb(    DEFINE SHA1SUM -xdev -perm /6111 -type f -exec /usr/bin/sha1sum {} \;
    CHECK remote/sha1.root /usr/bin/find / ${SHA1SUM})
    The SHA1 checksums of all suid/gid/executable files on the same device as
the root-directory (/) on the client computer are determined.  The resulting
listing is written on the file bf(BASE)tt(/remote/sha1.root).

    it() bf(NOTEST CHECK)  [bf(LOG =)] tt(logfile [pathOffset] command)

        Execute tt(command) on the client, using the bf(SSH) command
shell. 

    The phrase bf(LOG =) is optional. When a relative file location is
specified at tt(<file-spec>) it is interpreted relatively to the tt(USE BASE)
path specification. 

tt(PathOffset) is also optional, and has the same meaning as for the tt(LOCAL
CHECK) command, described above. The command may or may not
succeed. Otherwise, the program acts identically as the bf(CHECK ...) command,
described above.
    Example (using the same tt(${SHA1SUM}))definition:
        verb(    NOTEST CHECK LOG = remote/sha1.root /usr/bin/find / ${SHA1SUM})
    The SHA1 checksums of all suid/gid/executable files on the same device as
the root-directory (/) on the client computer are determined.  The resulting
listing is written on the file bf(BASE)tt(/remote/sha1.root). s() will
not terminate if the tt(/usr/bin/find) program returns a non-zero exit value.
    )
