about summary refs log blame commit diff stats
path: root/linux/samhain.html
blob: f679749f0d31af05b42035caba8d0547582bb9c0 (plain) (tree)
1
2
3
4
5
6
7
8
9



                              
                                     


           
                                                
 
                                            



























                                                                             
                                             



































































































































































































                                                                                             
                                                       

















                                                                                                                 
                                                
           


                                                        




                                                                                            
<!DOCTYPE html>
<html dir="ltr" lang="en">
    <head>
        <meta charset='utf-8'>
        <title>2.6.4. Samhain</title>
    </head>
    <body>

        <a href="index.html">GNU/Linux Index</a>

        <h1 id="samhain">2.6.4. Samhain</h1>

        <p>Read 
        <a href="http://www.la-samhna.de/samhain/manual/">Samhain Manual</a>,
        samhain is a file and host integrity and intrusion alert system 
        suitable for single hosts as well as for large, UNIX-based networks. 
        samhain offers advanced features to support and facilitate 
        centralized monitoring.</p>

        <p>The client (or standalone) part is called samhain, while the 
        server is referred to as yule. Both can run as daemon processes.</p>

        <p>Most of the options require being defined at compile time, is
        easy to start with basic and then compile as more features are
        required.</p>

        <pre>
        $ sudo prt-get depinst samhain
        </pre>

        <dl>
            <dt>/var/lib/samhain/samhain_file</dt>
            <dd>signature database</dd>
            <dt>/etc/samhainrc</dt>
            <dd>configuration file</dd>
            <dt>/var/log/samhain.log</dt>
            <dd>log file</dd>
        </dl>

        <h2 id="conf">2.6.4.1. Configure</h2>

        <p>For more information on configuration check 
        <a href="http://www.la-samhna.de/samhain/manual/filedef.htm">Monitoring Policies</a>.
        Description of section headings;</p>

        <dl>
            <dt>ReadOnly</dt>

            <dd>All modifications except access times will be 
            reported for these files.</dd>
            <dd>Checked: owner, group, permissions, file type, device number,
            hardlinks, links, inode, checksum, size, mtime, ctime.</dd>

            <dt>LogFiles</dt>

            <dd>Modifications of timestamps, file size, and signature will be
            ignored.</dd>
            <dd>Checked: owner, group, permissions, file type, device number,
            hardlinks, links, inode.<dd>

            <dt>GrowingLogFiles</dt>

            <dd>Modifications of timestamps, and signature will be ignored.
            Modification of the file size will only be ignored if the file size
            has increased.</dd>
            <dd>Checked: owner, group, permissions, file type, device number,
            hardlinks, links, inode, size >= previous_size, checksum(file start
            up to previous size) equals previous checksum.</dd>

            <dt>Attributes</dt>

            <dd>Only modifications of ownership, access permissions, and device
            number will be checked.</dd>
            <dd>Checked: owner, group, permissions, file type, device number.</dd>

            <dt>IgnoreAll</dt>

            <dd>No modifications will be reported. However, the existence of the
            specified file or directory will still be checked.</dd>

            <dt>IgnoreNone</dt>

            <dd>All modifications, including access time, but excluding ctime, will
            be reported - checking atime and ctime would require to play with
            the system clock.</dd>
            <dd>Checked: owner, group, permissions, file type, device number,
            hardlinks, links, inode, checksum, size, mtime, atime.</dd>

        </dl>

        <pre>
        $ vim /etc/samhainrc
        </pre>

        <p>This is just a resume, there is a complete template
        on crux ports?.</p>

        <pre>
        [Misc]

        [ReadOnly]
        dir = 0/

        [Attributes]
        file = /tmp
        file = /dev
        file = /media
        file = /proc
        file = /sys

        [ReadOnly]
        dir = 99/etc

        [Attributes]
        file = /etc/mtab
        file = /etc/adjtime
        file = /etc/motd
        file = /etc/fstab

        file = /etc

        [ReadOnly]
        dir = 99/boot

        [ReadOnly]
        dir = 99/bin
        dir = 99/sbin

        [ReadOnly]
        dir = 99/lib

        [Attributes]
        dir = 99/dev

        [IgnoreAll]
        dir = -1/dev/pts

        [ReadOnly]
        dir = 99/usr

        [IgnoreAll]
        dir = -1/usr/ports/core
        dir = -1/usr/ports/opt
        dir = -1/usr/ports/contrib
        dir = -1/usr/ports/work
        dir = -1/usr/ports/distfiles

        [ReadOnly]
        dir = 99/var

        [IgnoreAll]
        dir = -1/var/cache
        dir = -1/var/lock
        dir = -1/var/mail
        dir = -1/var/run
        dir = -1/var/spool
        dir = -1/var/tmp

        [Attributes]

        file = /var/lib/mlocate
        file = /var/lib/mlocate/mlocate.db
        file = /var/lib/urandom
        file = /var/lib/urandom/seed

        [GrowingLogFiles]
        dir = 99/var/log

        file = /var/log/samhain.log.lock

        [Attributes]
        file = /var/log/old/*.[0-9].gz

        [Misc]
        IgnoreAdded = /var/log/.*\.[0-9]+$
        IgnoreAdded = /var/log/.*\.[0-9]+\.gz$
        IgnoreAdded = /var/log/.*\.[0-9]+\.log$
        IgnoreAdded = /var/log/[[:alnum:]]+/.*\.[0-9]+$
        IgnoreAdded = /var/log/[[:alnum:]]+/.*\.[0-9]+\.gz$
        IgnoreAdded = /var/log/[[:alnum:]]+/.*\.[0-9]+\.log$
        IgnoreAdded = /var/lib/slocate/slocate.db.tmp
        IgnoreMissing = /var/lib/slocate/slocate.db.tmp

        [IgnoreNone]

        [Prelink]

        [User0]

        [User1]

        [EventSeverity]

        [Log]
        MailSeverity=notice
        PrintSeverity=none

        [Misc]
        Daemon = yes
        ChecksumTest=check
        SetNiceLevel = 19
        SetIOLimit = 500
        SetLoopTime = 600
        SetFileCheckTime = 7200
        ReportOnlyOnce = True
        SetMailTime = 86400
        SetMailNum = 10
        SetMailAddress=root@localhost
        SyslogFacility=LOG_LOCAL2

        </pre>

        <p>Initialize database;</p>

        <pre>
        # samhain -t init -p notice
        </pre>

        <p>If you want to "restart" remove samhain_file and run again 
        the command above. If daemon is set on config file you just 
        need to run;</p>

        <pre>
        # samhain -t check -p notice
        </pre>

        <p>To control daemon;</p>

        <pre>
        # samhain stop
        # samhain start
        # samhain restart
        # samhain reload or force-reload
        # samhain status
        </pre>

        <h2 id="updatedb">2.6.4.2. Update database</h2>

        <p><a href="http://www.la-samhna.de/samhain/manual/updating-the-file-signature-database.html">Manual</a>,
        You can update the database while the daemon is running, as long
        as you don't interfere with its logging. Using flag -l like this
        samhain -t update -l none make sure the log file is not accessed.</p>

        <pre>
        # samhain -t update -l none --interactive
        </pre>

        <p>Interactive update are supported with the command line flag
        --interactive. A file with a list of good files, absolute path, 
        one per line, can be passed with flag --listfile. Example;</p>

        <pre>
        # samhain -t update -l none --listfile=/root/list_of_files
        </pre>

        <a href="index.html">GNU/Linux Index</a>
        <p>
        This is part of the LeetIO System Documentation.
        Copyright (C) 2021
        LeetIO Team.
        See the file <a href="../fdl-1.3-standalone.html">Gnu Free Documentation License</a>
        for copying conditions.</p>

    </body>
</html>