/usr/share/doc/samhain/manual.html/mondef.html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN""http://www.w3.org/TR/html4/loose.dtd">
<HTML
><HEAD
><TITLE
>Monitoring login/logout events</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.79"><LINK
REL="HOME"
TITLE="The Samhain Host Integrity Monitoring System"
HREF="index.html"><LINK
REL="UP"
TITLE="Configuring samhain, the host integrity monitor"
HREF="file-monitor.html"><LINK
REL="PREVIOUS"
TITLE="Detecting Kernel rootkits"
HREF="kerneldef.html"><LINK
REL="NEXT"
TITLE="Checking mounted filesystem policies"
HREF="mountcheck.html"><LINK
REL="STYLESHEET"
TYPE="text/css"
HREF="./docbook.css"></HEAD
><BODY
CLASS="SECT1"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/header.html"--><!--#endif --><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>The Samhain Host Integrity Monitoring System</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="kerneldef.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
>Chapter 5. Configuring <SPAN
CLASS="APPLICATION"
>samhain</SPAN
>, the host integrity monitor</TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="mountcheck.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="MONDEF"
>5.11. Monitoring login/logout events</A
></H1
><P
>  To compile with support for this option, use the configure option 
  </P
><P
>  <B
CLASS="COMMAND"
>./configure --enable-login-watch</B
>
  </P
><P
>  <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> can be compiled to monitor 
  login/logout events of system users.
  For initialization, the system <TT
CLASS="FILENAME"
>utmp</TT
> file is searched 
  for users currently
  logged in. To recognize changes (i.e. logouts or logins), the system
  <TT
CLASS="FILENAME"
>wtmp</TT
> file is then used.
  </P
><P
>    Optionally, it is possible to perform further checks for login 
    events. All these additional checks are off by default. 
    The following checks are provided:
  </P
><P
></P
><DIV
CLASS="VARIABLELIST"
><DL
><DT
>First login</DT
><DD
><P
>     Report on the first login from a host or a domain / subnet. This
     option is configured with the directive:
     </P
><P
>     <B
CLASS="COMMAND"
>LoginCheckFirst = <TT
CLASS="REPLACEABLE"
><I
>no|yes|domain</I
></TT
></B
>
     </P
><P
>     If set to <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>yes</I
></SPAN
>, samhain will issue a report when 
     a user logs in from some host they haven't logged in from before. 
     If set to <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>domain</I
></SPAN
>, the domain (or C-class subnet, if
     the host cannot be resolved) is checked instead of the host.
     </P
></DD
><DT
>Statistical outlier</DT
><DD
><P
>     Report unusual login times. This option will only take effect once
     a user has logged in several times, and a database of login times has
     been built which can be analyzed for statistical outlier detection.
     Since this is based on statistics, it will inevitably cause false
     positives (legitimate logins reported as outliers).
     This option is configured with the directive:
     </P
><P
>     <B
CLASS="COMMAND"
>LoginCheckOutlier = <TT
CLASS="REPLACEABLE"
><I
>no|yes|paranoid</I
></TT
></B
>
     </P
><P
>     If set to <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>yes</I
></SPAN
>, samhain will issue a report when 
     a login time is found to be an outlier with 99 per cent probability. 
     If set to <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>paranoid</I
></SPAN
>, the required outlier probability
     is lowered to 95 per cent, resulting in more reports and more false
     positives (legitimate logins reported as outliers).
     </P
></DD
><DT
>Login date (global)</DT
><DD
><P
>     Report login events occuring outside some given date restrictions.
     This option is configured with the directive:
     </P
><P
>     <B
CLASS="COMMAND"
>LoginCheckDate = <TT
CLASS="REPLACEABLE"
><I
>date</I
></TT
></B
>
     </P
><P
>     Possible values for <TT
CLASS="REPLACEABLE"
><I
>date</I
></TT
> are: 
     <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>always</I
></SPAN
>, <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>never</I
></SPAN
>, and
     <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>workdays|saturday|sunday(list of time ranges)</I
></SPAN
>,
     e.g. workdays(8:00-10:00,13:00-16:00) or saturday(08:10-17:20).
     To set date restriction for workdays (Mo-Fr) and saturday and/or
     sunday, use LoginCheckDate multiple times. The internal time resolution
     is ten minutes, i.e. 8:09 will be interpreted as 8:00.
     </P
></DD
><DT
>Login date (individual)</DT
><DD
><P
>     Report login events occuring outside some date restrictions
     defined for the given individual user. This option, if defined
     for a given user, overrides the global setting above, and
     is configured with the directive:
     </P
><P
>     <B
CLASS="COMMAND"
>LoginCheckUserDate = <TT
CLASS="REPLACEABLE"
><I
>user:date</I
></TT
></B
>
     </P
><P
>     Here, <TT
CLASS="REPLACEABLE"
><I
>user</I
></TT
> must be the login name for
     a user, and <TT
CLASS="REPLACEABLE"
><I
>date</I
></TT
> has to be given as
     in the global option.
     </P
></DD
></DL
></DIV
><P
>  This facility is configured in the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Utmp</I
></SPAN
> 
  section of the configuration
  file:
  <PRE
CLASS="PROGRAMLISTING"
>  [Utmp]  
  #  
  # activate (0 for switching off) 
  # 
  LoginCheckActive=1 
  #  
  # interval between checks (in seconds)
  # 
  LoginCheckInterval=600 
  #  
  # these are the severities (see section <A
HREF="basic-configuration.html#SEVERITYDEF"
>Section 4.1.1</A
>) 
  # 
  SeverityLogin=info 
  SeverityLogout=info 
  #  
  # multiple logins by same user 
  # 
  SeverityLoginMulti=crit
  </PRE
>
  </P
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="kerneldef.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="mountcheck.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Detecting Kernel rootkits</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="file-monitor.html"
ACCESSKEY="U"
>Up</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Checking mounted filesystem policies</TD
></TR
></TABLE
></DIV
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/footer.html"--><!--#endif --></BODY
></HTML
>
samhain 3.1.0-5ubuntu1 / usr / share / doc / samhain / manual.html / mondef.html
