/usr/share/doc/samhain/manual.html/index.html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN""http://www.w3.org/TR/html4/loose.dtd">
<HTML
><HEAD
><TITLE
>The Samhain Host Integrity Monitoring System</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.79"><LINK
REL="NEXT"
TITLE="Introduction"
HREF="intro.html"><LINK
REL="STYLESHEET"
TYPE="text/css"
HREF="./docbook.css"></HEAD
><BODY
CLASS="BOOK"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/header.html"--><!--#endif --><DIV
CLASS="BOOK"
><A
NAME="INDEX"
></A
><DIV
CLASS="TITLEPAGE"
><H1
CLASS="TITLE"
><A
NAME="AEN2"
>The Samhain Host Integrity Monitoring System</A
></H1
><P
CLASS="COPYRIGHT"
>Copyright &copy; 2002-2013 Rainer Wichmann</P
><DIV
CLASS="LEGALNOTICE"
><P
></P
><A
NAME="AEN7"
></A
><P
>         Permission is granted to copy, distribute and/or modify this
         document under the terms of the <I
CLASS="CITETITLE"
>GNU Free
         Documentation License</I
>, Version 1.1 or any later
         version published by the Free Software Foundation with no
         Invariant Sections, no Front-Cover Texts, and no Back-Cover
         Texts. You may obtain a copy of the <I
CLASS="CITETITLE"
>GNU Free
         Documentation License</I
> from the Free Software
         Foundation by visiting <A
HREF="http://www.fsf.org"
TARGET="_top"
>their Web site</A
> or by writing
         to: Free Software Foundation, Inc., 59 Temple Place - Suite
         330, Boston, MA 02111-1307, USA.
       </P
><P
>	 This manual refers to version 3.1.0 of Samhain.
       </P
><P
></P
></DIV
><HR></DIV
><DIV
CLASS="TOC"
><DL
><DT
><B
>Table of Contents</B
></DT
><DT
>1. <A
HREF="intro.html"
>Introduction</A
></DT
><DT
>2. <A
HREF="installation.html"
>Compiling and installing</A
></DT
><DD
><DL
><DT
>2.1. <A
HREF="installation.html#INSTALLATION-OVERVIEW"
>Overview</A
></DT
><DT
>2.2. <A
HREF="installation-requirements.html"
>Requirements</A
></DT
><DT
>2.3. <A
HREF="installation-download.html"
>Download and extract</A
></DT
><DT
>2.4. <A
HREF="installation-configure.html"
>Configuring the source</A
></DT
><DT
>2.5. <A
HREF="installation-build.html"
>Build</A
></DT
><DT
>2.6. <A
HREF="installation-install.html"
>Install</A
></DT
><DT
>2.7. <A
HREF="installation-customize.html"
>Customize</A
></DT
><DT
>2.8. <A
HREF="installation-initialize.html"
>Initialize the baseline database</A
></DT
><DT
>2.9. <A
HREF="installation-running.html"
>Run samhain</A
></DT
><DT
>2.10. <A
HREF="layout.html"
>Files and directory layout</A
></DT
><DT
>2.11. <A
HREF="testsuite.html"
>The testsuite</A
></DT
></DL
></DD
><DT
>3. <A
HREF="usage.html"
>General usage notes</A
></DT
><DD
><DL
><DT
>3.1. <A
HREF="usage.html#HOW-TO-INVOKE"
>How to invoke</A
></DT
><DT
>3.2. <A
HREF="daemontool.html"
>Using daemontool (or similar utilities)</A
></DT
><DT
>3.3. <A
HREF="controlling-the-daemon.html"
>Controlling the daemon</A
></DT
><DT
>3.4. <A
HREF="signals.html"
>Signals</A
></DT
><DT
>3.5. <A
HREF="pid-file.html"
>PID file</A
></DT
><DT
>3.6. <A
HREF="log-file-rotation.html"
>Log file rotation</A
></DT
><DT
>3.7. <A
HREF="updating-the-file-signature-database.html"
>Updating the file signature database</A
></DT
><DT
>3.8. <A
HREF="improving-the-signal-to-noise-ratio.html"
>Improving the signal-to-noise ratio</A
></DT
><DT
>3.9. <A
HREF="options-configuration-file.html"
>Runtime options: command-line &amp; configuration file</A
></DT
><DT
>3.10. <A
HREF="dnmalloc.html"
>Remarks on the dnmalloc allocator</A
></DT
><DT
>3.11. <A
HREF="support.html"
>Support / Bugs / Problems</A
></DT
></DL
></DD
><DT
>4. <A
HREF="basic-configuration.html"
>Configuration of logging facilities</A
></DT
><DD
><DL
><DT
>4.1. <A
HREF="basic-configuration.html#LOGDEF"
>General</A
></DT
><DT
>4.2. <A
HREF="configfacility.html"
>Available logging facilities</A
></DT
><DT
>4.3. <A
HREF="thresholds.html"
>Activating logging facilities and filtering messages</A
></DT
><DT
>4.4. <A
HREF="configuration-email.html"
>E-mail</A
></DT
><DT
>4.5. <A
HREF="trustedexample.html"
>Log file</A
></DT
><DT
>4.6. <A
HREF="configuration-logserver.html"
>Log server</A
></DT
><DT
>4.7. <A
HREF="configuration-external.html"
>External facilities</A
></DT
><DT
>4.8. <A
HREF="consoledetails.html"
>Console</A
></DT
><DT
>4.9. <A
HREF="preludedetails.html"
>Prelude</A
></DT
><DT
>4.10. <A
HREF="nagios.html"
>Using samhain with nagios</A
></DT
><DT
>4.11. <A
HREF="syslogdetails.html"
>Syslog</A
></DT
><DT
>4.12. <A
HREF="sqldetails.html"
>SQL Database</A
></DT
></DL
></DD
><DT
>5. <A
HREF="file-monitor.html"
>Configuring <SPAN
CLASS="APPLICATION"
>samhain</SPAN
>, the host integrity monitor</A
></DT
><DD
><DL
><DT
>5.1. <A
HREF="file-monitor.html#BASCLT"
>Usage overview</A
></DT
><DT
>5.2. <A
HREF="hash-function.html"
>Available checksum functions</A
></DT
><DT
>5.3. <A
HREF="file-signatures.html"
>File signatures</A
></DT
><DT
>5.4. <A
HREF="filedef.html"
>Defining file check policies: what, and how, to monitor</A
></DT
><DT
>5.5. <A
HREF="all-except.html"
>Excluding files and/or subdirectories (All except &hellip;)</A
></DT
><DT
>5.6. <A
HREF="timing-file-checks.html"
>Timing file checks</A
></DT
><DT
>5.7. <A
HREF="initializing-updating-checking.html"
>Initializing, updating, or checking</A
></DT
><DT
>5.8. <A
HREF="databasefile.html"
>The file signature database</A
></DT
><DT
>5.9. <A
HREF="suidchk.html"
>Checking the file system for SUID/SGID binaries</A
></DT
><DT
>5.10. <A
HREF="kerneldef.html"
>Detecting Kernel rootkits</A
></DT
><DT
>5.11. <A
HREF="mondef.html"
>Monitoring login/logout events</A
></DT
><DT
>5.12. <A
HREF="mountcheck.html"
>Checking mounted filesystem policies</A
></DT
><DT
>5.13. <A
HREF="usercheck.html"
>Checking sensitive files owned by users</A
></DT
><DT
>5.14. <A
HREF="processcheck.html"
>Checking for hidden/fake/missing processes</A
></DT
><DT
>5.15. <A
HREF="portcheck.html"
>Checking for open ports</A
></DT
><DT
>5.16. <A
HREF="logmon.html"
>Logfile monitoring/analysis</A
></DT
><DT
>5.17. <A
HREF="winreg.html"
>Checking the Windows registry</A
></DT
><DT
>5.18. <A
HREF="modules.html"
>Modules</A
></DT
><DT
>5.19. <A
HREF="performance-tuning.html"
>Performance tuning</A
></DT
><DT
>5.20. <A
HREF="file-content-store.html"
>Storing the full content of a file (aka: WHAT has changed?)</A
></DT
><DT
>5.21. <A
HREF="finotify.html"
>Inotify support on Linux (instantaneous reports, no I/O load)</A
></DT
></DL
></DD
><DT
>6. <A
HREF="yule.html"
>Configuring <SPAN
CLASS="APPLICATION"
>yule</SPAN
>, the log server</A
></DT
><DD
><DL
><DT
>6.1. <A
HREF="yule.html#GENERAL"
>General</A
></DT
><DT
>6.2. <A
HREF="droproot.html"
>Important installation notes</A
></DT
><DT
>6.3. <A
HREF="clients.html"
>Registering a client</A
></DT
><DT
>6.4. <A
HREF="enabling-logging-to-the-server.html"
>Enabling logging to the server</A
></DT
><DT
>6.5. <A
HREF="database-configuration-file-download.html"
>Enabling baseline database / configuration file download from the server</A
></DT
><DT
>6.6. <A
HREF="server-logging.html"
>Rules for logging of client messages</A
></DT
><DT
>6.7. <A
HREF="gcm.html"
>Detecting 'dead' clients</A
></DT
><DT
>6.8. <A
HREF="server-status-information.html"
>The HTML server status page</A
></DT
><DT
>6.9. <A
HREF="chroot.html"
>Chroot</A
></DT
><DT
>6.10. <A
HREF="libwrap.html"
>Restrict access with libwrap (tcp wrappers)</A
></DT
><DT
>6.11. <A
HREF="send-commands.html"
>Sending commands to clients</A
></DT
><DT
>6.12. <A
HREF="udp.html"
>Syslog logging</A
></DT
><DT
>6.13. <A
HREF="server-to-server.html"
>Server-to-server relay</A
></DT
><DT
>6.14. <A
HREF="performance-tuning-server.html"
>Performance tuning</A
></DT
></DL
></DD
><DT
>7. <A
HREF="extern.html"
>Hooks for External Programs</A
></DT
><DD
><DL
><DT
>7.1. <A
HREF="extern.html#PIPES"
>Pipes</A
></DT
><DT
>7.2. <A
HREF="system-v-message-queue.html"
>System V message queue</A
></DT
><DT
>7.3. <A
HREF="calling-external-programs.html"
>Calling external programs</A
></DT
></DL
></DD
><DT
>8. <A
HREF="signed-files.html"
>Additional Features &mdash; Signed Configuration/Database Files</A
></DT
><DD
><DL
><DT
>8.1. <A
HREF="signed-files.html#SAMHAINADMIN"
>The samhainadmin script</A
></DT
></DL
></DD
><DT
>9. <A
HREF="stealthmode.html"
>Additional Features &mdash; Stealth</A
></DT
><DD
><DL
><DT
>9.1. <A
HREF="stealthmode.html#HIDING-THE-EXECUTABLE"
>Hiding the executable</A
></DT
><DT
>9.2. <A
HREF="packing-the-executable.html"
>Packing the executable</A
></DT
></DL
></DD
><DT
>10. <A
HREF="deployment.html"
>Deployment to remote hosts</A
></DT
><DD
><DL
><DT
>10.1. <A
HREF="deployment.html#DEPLOY.SH"
>Method A: The deployment system</A
></DT
><DT
>10.2. <A
HREF="native-packages.html"
>Method B: The native package manager</A
></DT
></DL
></DD
><DT
>11. <A
HREF="security-design.html"
>Security Design</A
></DT
><DD
><DL
><DT
>11.1. <A
HREF="security-design.html#SECURITY-USAGE"
>Usage</A
></DT
><DT
>11.2. <A
HREF="keypad.html"
>Integrity of the samhain executable</A
></DT
><DT
>11.3. <A
HREF="client-integrity.html"
>Client executable integrity</A
></DT
><DT
>11.4. <A
HREF="server-security.html"
>The server</A
></DT
><DT
>11.5. <A
HREF="design.html"
>General</A
></DT
></DL
></DD
><DT
>A. <A
HREF="compilation-options.html"
>List of options for the ./configure script</A
></DT
><DD
><DL
><DT
>A.1. <A
HREF="compilation-options.html#COMPILATION-OPTIONS-GENERAL"
>General</A
></DT
><DT
>A.2. <A
HREF="compilation-checks.html"
>Optional modules to perform additional checks</A
></DT
><DT
>A.3. <A
HREF="openpgp-signatures.html"
>OpenPGP Signatures on Configuration/Database Files</A
></DT
><DT
>A.4. <A
HREF="client-server-connectivity.html"
>Client/Server Connectivity</A
></DT
><DT
>A.5. <A
HREF="paths.html"
>Paths</A
></DT
></DL
></DD
><DT
>B. <A
HREF="command-line.html"
>List of command line options</A
></DT
><DD
><DL
><DT
>B.1. <A
HREF="command-line.html#COMMAND-LINE-GENERAL"
>General</A
></DT
><DT
>B.2. <A
HREF="samhain-command-line.html"
><SPAN
CLASS="APPLICATION"
>samhain</SPAN
></A
></DT
><DT
>B.3. <A
HREF="command-line-yule.html"
><SPAN
CLASS="APPLICATION"
>yule</SPAN
></A
></DT
></DL
></DD
><DT
>C. <A
HREF="the-configuration-file.html"
>Configuration file syntax and options</A
></DT
><DD
><DL
><DT
>C.1. <A
HREF="the-configuration-file.html#CONFIGFILE"
>General</A
></DT
><DT
>C.2. <A
HREF="files-to-check.html"
>Files to check</A
></DT
><DT
>C.3. <A
HREF="severity-of-events.html"
>Severity of events</A
></DT
><DT
>C.4. <A
HREF="logging-thresholds.html"
>Logging thresholds</A
></DT
><DT
>C.5. <A
HREF="watching-login-logout-events.html"
>Watching login/logout events</A
></DT
><DT
>C.6. <A
HREF="checking-for-kernel-module-rootkits.html"
>Checking for kernel module rootkits</A
></DT
><DT
>C.7. <A
HREF="checking-for-suid-files.html"
>Checking for SUID/SGID files</A
></DT
><DT
>C.8. <A
HREF="checking-mounts.html"
>Checking for mount options</A
></DT
><DT
>C.9. <A
HREF="checking-userfiles.html"
>Checking for user files</A
></DT
><DT
>C.10. <A
HREF="checking-processes.html"
>Checking for hidden/fake/required processes</A
></DT
><DT
>C.11. <A
HREF="checking-ports.html"
>Checking for open ports</A
></DT
><DT
>C.12. <A
HREF="logmon-check.html"
>Logfile monitoring/analysis</A
></DT
><DT
>C.13. <A
HREF="database.html"
>Database</A
></DT
><DT
>C.14. <A
HREF="miscellaneous.html"
>Miscellaneous</A
></DT
><DT
>C.15. <A
HREF="external.html"
>External</A
></DT
><DT
>C.16. <A
HREF="configfile-clients.html"
>Clients</A
></DT
></DL
></DD
><DT
>D. <A
HREF="database-fields.html"
>List of database fields</A
></DT
><DD
><DL
><DT
>D.1. <A
HREF="database-fields.html#GEN-DB-FIELDS"
>General</A
></DT
><DT
>D.2. <A
HREF="mod-db-fields.html"
>Modules</A
></DT
><DT
>D.3. <A
HREF="sys-db-fields.html"
>Syslog</A
></DT
></DL
></DD
><DT
>E. <A
HREF="filetypes-defined.html"
>List of recognized file types</A
></DT
></DL
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>&nbsp;</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
>&nbsp;</TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="intro.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>&nbsp;</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
>&nbsp;</TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Introduction</TD
></TR
></TABLE
></DIV
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/footer.html"--><!--#endif --></BODY
></HTML
>
samhain 3.1.0-5ubuntu1 / usr / share / doc / samhain / manual.html / index.html
