Similar to the question here, https://serverfault.com/questions/387111/inventory-or-audit-installed-linux-software, I would like to obtain ideas about commands that should be ran across various Linux/Unix distributions to audit installed software. It should cover at a minimum the following use cases:
- Software installed from packages
- Software installed from source
- Software that is installed to an unknown or unexpected location
Additionally, it should work on CentOS/RedHat, SuSE, and Macintosh OS. Some of the ideas that I have thought about in relation to obtaining the software installed include the following; however, I am not sure how practical they might be.
- Listing the running processes and making inferences from the output
- Listing the listening or open ports and making inferences from the output
- Running various CLI commands and trying to make sense of the output
- Performing a dump or listing of the installed packages from the native package manager
- Perform a find command to look for particular files or file names, perhaps even config files to assume that certain software exists
The ultimate goal is to have commands that can be used and store the resulting output to a file. I would use this to run against various machines, either locally on the machine or via SSH, for auditing, record keeping, and determining which hosts are vulnerable to particularly announced vulnerabilities.