14ae1c3418
Samhain is an open source file integrity and host-based intrusion detection system for Linux and Unix. It can run as a daemon process, and and thus can remember file changes - contrary to a tool that runs from cron, if a file is modified you will get only one report, while subsequent checks of that file will ignore the modification as it is already reported (unless the file is modified again). ok jasper@
102 lines
1.6 KiB
Plaintext
102 lines
1.6 KiB
Plaintext
$OpenBSD: patch-samhainrc_freebsd,v 1.1.1.1 2012/05/11 09:24:23 robert Exp $
|
|
--- samhainrc.freebsd.orig Thu May 3 10:26:48 2012
|
|
+++ samhainrc.freebsd Thu May 3 10:26:51 2012
|
|
@@ -1,6 +1,6 @@
|
|
#####################################################################
|
|
#
|
|
-# FreeBSD Configuration file for samhain.
|
|
+# OpenBSD Configuration file for samhain.
|
|
#
|
|
#####################################################################
|
|
#
|
|
@@ -69,8 +69,6 @@ dir = 0/
|
|
|
|
[Attributes]
|
|
file = /
|
|
-file = /proc
|
|
-file = /entropy
|
|
file = /tmp
|
|
file = /var
|
|
|
|
@@ -102,15 +100,7 @@ IgnoreMissing = /dev/(p|t)typ.*
|
|
##
|
|
dir = 99/etc
|
|
|
|
-
|
|
#
|
|
-# --------- /boot -----------
|
|
-#
|
|
-
|
|
-[ReadOnly]
|
|
-dir = 99/boot
|
|
-
|
|
-#
|
|
# --------- /bin, /sbin -----------
|
|
#
|
|
|
|
@@ -119,27 +109,6 @@ dir = 99/bin
|
|
dir = 99/sbin
|
|
|
|
#
|
|
-# --------- /lib -----------
|
|
-#
|
|
-
|
|
-[ReadOnly]
|
|
-dir = 99/lib
|
|
-
|
|
-#
|
|
-# --------- /libexec -----------
|
|
-#
|
|
-
|
|
-[ReadOnly]
|
|
-dir = 99/libexec
|
|
-
|
|
-#
|
|
-# --------- /rescue -----------
|
|
-#
|
|
-
|
|
-[ReadOnly]
|
|
-dir = 99/rescue
|
|
-
|
|
-#
|
|
# --------- /root -----------
|
|
#
|
|
|
|
@@ -150,28 +119,12 @@ dir = 99/rescue
|
|
dir = 99/root
|
|
|
|
#
|
|
-# --------- /stand -----------
|
|
-#
|
|
-
|
|
-[ReadOnly]
|
|
-dir = 99/stand
|
|
-
|
|
-#
|
|
# --------- /usr -----------
|
|
#
|
|
|
|
[ReadOnly]
|
|
dir = 99/usr
|
|
|
|
-[Attributes]
|
|
-dir = /usr/.snap
|
|
-dir = /usr/share/man/cat?
|
|
-file = /usr/compat/linux/etc
|
|
-file = /usr/compat/linux/etc/ld.so.cache
|
|
-
|
|
-[IgnoreAll]
|
|
-dir = -1/usr/home
|
|
-
|
|
#
|
|
# --------- /var -----------
|
|
#
|
|
@@ -200,6 +153,7 @@ dir = 99/var/log
|
|
# rotated logs will change inode
|
|
#
|
|
file = /var/log/*.[0-9].bz2
|
|
+file = /var/log/*.[0-9].gz
|
|
file = /var/log/*.[0-9].log
|
|
file = /var/log/*.[0-9]
|
|
file = /var/log/*.[0-9][0-9]
|