# SARA Daemon

## (Security Auditor's Research Assistant)

SARA Daemon mode is a new addition to the SARA network auditing tool. It provides a method or remotely accessing the SARA security engine without physical access to the SARA host console or logical access through X Windows.

SARA Daemon mode is initiated by typing ./sara -D. Authorized users can control, manage, and review SARA operations over the Intranet or Internet. Authentication and IP access control are provided through the ./add_user program and config/sara.cf, respectively.

Only experienced administrators with a good security skills should set SARA in the daemon mode. Ideally, the SARA daemon port (defined in config/sara.cf) should be protected by the enterprise's firewall. Use of good passwords, and restrictive IP ranges are a must!

Do not run SARA in both standalone and daemon mode at the same time. Neither will perform reliabily. Check config/sara.cf for specific parameter definitions.

This module is currently a non-production product. We solicit comments on it.

SARA Daemon mode was developed by Adam Pendleton, VGS, Fairfax, VA. and Bob Todd ARC, Vienna VA.