samhainrc - configuration file Linux Man Page

"[ReadOnly]"

This section may contain
file= PATH and
dir= [depth]PATH entries for files and directories to check. All modifications except access times will be reported for these files. [depth] (use without brackets) is an optional parameter to define a per-directory recursion depth.

"[LogFiles]"

As above, but modifications of timestamps, file size, and signature will be ignored.

"[GrowingLogFiles]"

As above, but modifications of file size will only be ignored if the size has increased .

"[Attributes]"

As above, but only modifications of ownership and access permissions will be checked.

"[IgnoreAll]"

As above, but report no modifications for these files/directories. Access failures will still be reported.

"[IgnoreNone]"

As above, but report all modifications for these files/directories, including access time.

"[User0]"

"[User1]"

These are reserved for user-defined policies.

"[Prelink]"

For prelinked executables / libraries or directories holding them.

"[Log]"

This section defines the filtering rules for logging. It may contain the following entries:
  MailSeverity= val where the threshold value val may be one of debug , info , notice , warn , mark , err , crit , alert , or none . By default, everything equal to and above the threshold will be logged. The specifiers * , ! , and = are interpreted as 'all', 'all but', and 'only', respectively (like in the Linux version of syslogd(8) ). Time stamps have the priority warn , system-level errors have the priority err , and important start-up messages the priority alert . The signature key for the log file will never be logged to syslog or the log file itself. For failures to verify file integrity, error levels are defined in the next section.
  PrintSeverity= val,
  LogSeverity= val,
  ExportSeverity= val,
  ExternalSeverity= val,
  PreludeSeverity= val,
  DatabaseSeverity= val, and
  SyslogSeverity= val set the thresholds for logging via stdout (or /dev/console ), log file, TCP forwarding, calling external programs, and syslog(3) .

"[EventSeverity]"

  SeverityReadOnly= val,
  SeverityLogFiles= val,
  SeverityGrowingLogs= val,
  SeverityIgnoreNone= val,
  SeverityIgnoreAll= val,
  SeverityPrelink= val,
  SeverityUser0= val, and
  SeverityUser1= val define the error levels for failures to verify the integrity of files/directories of the respective types. I.e. if such a file shows unexpected modifications, an error of level val will be generated, and logged to all facilities with a threshold of at least val .
  SeverityFiles= val sets the error level for file access problems, and
  SeverityDirs= val for directory access problems.
SeverityNames= val sets the error level for obscure file names (e.g. non-printable characters).

"[External]"

OpenCommand= path Start the definition of an external logging program|script.
SetType= log|srv Type/purpose of program (log for logging).
SetCommandline= list Command line options.
SetEnviron= KEY=val Environment for external program.
SetChecksum= val Checksum of the external program (checked before invoking).
SetCredentials= username User as who the program will run.
SetFilterNot= list Words not allowed in message.
SetFilterAnd= list Words required (ALL) in message.
SetFilterOr= list Words required (at least one) in message.
SetDeadtime= seconds Time between consecutive calls.

"[Utmp]"

Configuration for watching login/logout events.
LoginCheckActive= 0|1 Switch off/on login/logout reporting.
LoginCheckInterval= val Interval (seconds) between checks for login/logout events.
SeverityLogin= val
SeverityLoginMulti= val
SeverityLogout= val Severity levels for logins, multiple logins by same user, and logouts.

"[Kernel]"

Configuration for detecting kernel rootkits.
KernelCheckActive= 0|1 Switch off/on checking of kernel syscalls to detect kernel module rootkits.
KernelCheckInterval= val Interval (seconds) between checks.
SeverityKernel= val Severity level for clobbered kernel syscalls.
KernelCheckIDT= 0|1 Whether to check the interrrupt descriptor table.
KernelSystemCall= address The address of system_call (grep system_call System.map). Required after a kernel update.
KernelProcRoot= address The address of proc_root (grep ' proc_root$' System.map). Required after a kernel update.
KernelProcRootIops= address The address of proc_root_inode_operations (grep proc_root_inode_operations System.map). Required after a kernel update.
KernelProcRootLookup= address The address of proc_root_lookup (grep proc_root_lookup System.map). Required after a kernel update.

"[SuidCheck]"

Settings for finding SUID/SGID files on disk.
SuidCheckActive= 0|1 Switch off/on the check.
SuidCheckExclude= path A directory (and its subdirectories) to exclude from the check. Only one directory can be specified this way.
SuidCheckSchedule= schedule Crontab-like schedule for checks.
SeveritySuidCheck= severity Severity for events.
SuidCheckFps= fps Limit files per seconds for SUID check.

"[Database]"

Settings for logging to a database.
SetDBHost= db_host Host where the DB server runs (default: localhost). Should be a numeric IP address for PostgreSQL.
SetDBName= db_name Name of the database (default: samhain).
SetDBTable= db_table Name of the database table (default: log).
SetDBUser= db_user Connect as this user (default: samhain).
SetDBPassword= db_password Use this password (default: none).
SetDBServerTstamp= true|false Log server timestamp for client messages (default: true).
UsePersistent= true|false Use a persistent connection (default: true).

"[Misc]"

Daemon= no|yes Detach from controlling terminal to become a daemon.
VersionString= string Set version string to include in file signature database (along with hostname and date).
SetNiceLevel= -19..19 Set scheduling priority during file check.
SetIOLimit= bps Set IO limits (kilobytes per second) for file check.
SetLoopTime= val Defines the interval (in seconds) for timestamps.
SetFilecheckTime= val Defines the interval (in seconds) between succesive file checks.
FileCheckScheduleOne= schedule Crontab-like schedule for file checks. If used, SetFilecheckTime is ignored.
UseHardlinkCheck= yes|no Compare number of hardlinks to number of subdirectories for directories.
HardlinkOffset= N:/path Exception (use multiple times for multiple exceptions). N is offset (actual - expected hardlinks) for /path.
AddOKChars= N1,N2,.. List of additional acceptable characters (byte value(s)) for the check for weird filenames. Nn may be hex (leading '0x': 0xNN), octal (leading zero: 0NNN), or decimal.
IgnoreAdded= path_regex Ignore if this file/directory is added/created.
IgnoreMissing= path_regex Ignore if this file/directory is missing/deleted.
ReportOnlyOnce= yes|no Report only once on a modified file (default yes).
  ReportFullDetail= yes|no Report in full detail on modified files (not only modified items).
SetPrelinkPath= path Path of the prelink executable (default /usr/sbin/prelink).
SetPrelinkChecksum= checksum TIGER192 checksum of the prelink executable (no default).
UseLocalTime= yes|no Report file timestamps in local time rather than GMT (default no). Do not use this with Beltane.
  ChecksumTest= {init|update|check|none} defines whether to initialize/update the database or verify files against it. If 'none', you should supply the required option on the command line.
SetConsole= device Set the console device (default /dev/console).
MessageQueueActive= 1|0 Whether to use a SysV IPC message queue.
SetMailTime= val defines the maximum interval (in seconds) between succesive e-mail reports. Mail might be empty if there are no events to report.
SetMailNum= val defines the maximum number of messages that are stored before e-mailing them. Messages of highest priority are always sent immediately.
SetMailAddress= username @ host sets the recipient address for mailing. "No aliases should be used." For security, you should prefer a numerical host address.
SetMailRelay= server sets the hostname for the mail relay server (if you need one). If no relay server is given, mail is sent directly to the host given in the mail address, otherwise it is sent to the relay server, who should forward it to the given address.
SamhainPath= /path/to/binary sets the path to the samhain binary. If set, samhain will checksum its own binary both on startup and termination, and compare both.
SetBindAddress= IP_address The IP address (i.e. interface on multi-interface box) to use for outgoing connections.
SetLogServer= server sets the hostname for the log server.
SetTimeServer= server sets the hostname for the time server.
TrustedUser= name|uid Add a user to the set of trusted users (root and the effective user are always trusted. You can add up to 7 more users).
SetDatabasePath= AUTO|/path Path to database (AUTO to tack hostname on compiled-in path).
SetLogfilePath= AUTO|/path Path to logfile (AUTO to tack hostname on compiled-in path).
SetLockfilePath= AUTO|/path Path to lockfile (AUTO to tack hostname on compiled-in path).
DigestAlgo= SHA1|MD5 Use SHA1 or MD5 instead of the TIGER checksum (default: TIGER192).
RedefReadOnly= +/-XXX,+/-YYY,... Add or subtract tests XXX from the ReadOnly policy. Tests are: CHK (checksum), LNK (link), HLN (hardlink), INO (inode), USR (user), GRP (group), MTM (mtime), ATM (atime), CTM (ctime), SIZ (size), RDEV (device numbers) and/or MOD (file mode).
RedefAttributes= +/-XXX,+/-YYY,... Add or subtract tests XXX from the Attributes policy.
RedefLogFiles= +/-XXX,+/-YYY,... Add or subtract tests XXX from the LogFiles policy.
RedefGrowingLogFiles= +/-XXX,+/-YYY,... Add or subtract tests XXX from the GrowingLogFiles policy.
RedefIgnoreAll= +/-XXX,+/-YYY,... Add or subtract tests XXX from the IgnoreAll policy.
RedefIgnoreNone= +/-XXX,+/-YYY,... Add or subtract tests XXX from the IgnoreNone policy.
RedefUser0= +/-XXX,+/-YYY,... Add or subtract tests XXX from the User0 policy.
RedefUser1= +/-XXX,+/-YYY,... Add or subtract tests XXX from the User1 policy.
  HideSetup= yes|no Don't log name of config/database files on startup.
  SyslogFacility= facility Set the syslog facility to use. Default is LOG_AUTHPRIV.
MACType= HASH-TIGER|HMAC-TIGER Set type of message authentication code (HMAC). Must be identical on client and server.
SetReverseLookup= true|false If false, skip reverse lookups when connecting to a host known by name rather than IP address.
  MessageHeader= format Costom format for message header. Replacements: %F source file name, %L source file line, %S severity, %T timestamp, %C message class.

Server Only

SetUseSocket= yes|no If unset, do not open the command socket. The default is no.
SetSocketAllowUid= UID Which user can connect to the command socket. The default is 0 (root).
SetSocketPassword= password Password (max. 14 chars, no '@') for password-based authentication on the command socket (only if the OS does not support passing credentials via sockets).
SetChrootDir= path If set, chroot to this directory after startup.
SetStripDomain= yes|no Whether to strip the domain from the client hostname when logging client messages (default: yes).
  SetClientTimeLimit= seconds The maximum time between client messages. If exceeded, a warning will be issued (the default is 86400 sec = 1 day).
  UseClientSeverity= yes|no Use the severity of client messages.
  UseClientClass= yes|no Use the class of client messages.
UseSeparateLogs= true|false If true, messages from different clients will be logged to separate log files (the name of the client will be appended to the name of the main log file to construct the logfile name).
SetClientFromAccept= true|false If true, use client address as known to the communication layer. Else (default) use client name as claimed by the client, try to verify against the address known to the communication layer, and accept (with a warning message) even if this fails.
  SeverityLookup= severity Severity of the message on client address != socket peer.
SetUDPActive= yes|no yule 1.2.8+: Also listen on 514/udp (syslog).

"[Clients]"

This section is only relevant if samhain is run as a log server for clients running on another (or the same) machine.
Client= hostname @ salt @ verifier registers a client at host hostname (fully qualified hostname required) for access to the log server. Log entries from unregistered clients will not be accepted. To generate a salt and a valid verifier, use the command samhain -P "password" , where password is the password of the client. A simple utility program samhain_setpwd is provided to re-set the compiled-in default password of the client executable to a user-defined value.

"[EOF]"

An optional end marker. Everything below is ignored.