/usr/share/doc/samhain/manual.html/portcheck.html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN""http://www.w3.org/TR/html4/loose.dtd">
<HTML
><HEAD
><TITLE
>Checking for open ports</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.79"><LINK
REL="HOME"
TITLE="The Samhain Host Integrity Monitoring System"
HREF="index.html"><LINK
REL="UP"
TITLE="Configuring samhain, the host integrity monitor"
HREF="file-monitor.html"><LINK
REL="PREVIOUS"
TITLE="Checking for hidden/fake/missing processes"
HREF="processcheck.html"><LINK
REL="NEXT"
TITLE="Logfile monitoring/analysis"
HREF="logmon.html"><LINK
REL="STYLESHEET"
TYPE="text/css"
HREF="./docbook.css"></HEAD
><BODY
CLASS="SECT1"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/header.html"--><!--#endif --><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>The Samhain Host Integrity Monitoring System</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="processcheck.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
>Chapter 5. Configuring <SPAN
CLASS="APPLICATION"
>samhain</SPAN
>, the host integrity monitor</TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="logmon.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="PORTCHECK"
>5.15. Checking for open ports</A
></H1
><P
>  To compile with support for this option, use the configure option 
  </P
><P
>  <B
CLASS="COMMAND"
>./configure --enable-port-check</B
>
  </P
><P
>  This module enables <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> to check for
  open ports (services) on the local machine, and report ports that are 
  open, but not listed in the configuration. Reports are like:
  </P
><P
></P
><DIV
CLASS="VARIABLELIST"
><DL
><DT
>interface:portnumber/protocol (maybe_servicename)</DT
><DD
><P
>     This is a non-RPC service, e.g. 192.168.1.2:22/tcp (maybe_ssh).
     The service name is taken from <TT
CLASS="FILENAME"
>/etc/services</TT
>,
     and prepended by <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>maybe_</I
></SPAN
>, because
     <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> cannot determine whether it really
     is the SSH daemon that is listening on this port.
     </P
></DD
><DT
>interface:portnumber/protocol (servicename)</DT
><DD
><P
>     This is an RPC service, e.g. 192.168.1.2:2049/tcp (nfs).
     The service name is obtained by querying the portmapper daemon.
     The portmapper daemon may return a service name as listed in
     <TT
CLASS="FILENAME"
>/etc/rpc</TT
>, or just a number (if there is no name
     for the service). If the portmapper daemon only returns the number
     of the RPC service, samhain will list <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>RPC_number</I
></SPAN
>
     as servicename.
     </P
></DD
></DL
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN2782"
>5.15.1. Options</A
></H2
><P
>  By default, (only) the interface corresponding to the 'official name' of
  the host will be scanned. Additional interfaces can be added via the 
  option 
  <B
CLASS="COMMAND"
>PortCheckInterface=<TT
CLASS="REPLACEABLE"
><I
>(list of) IP address(es)</I
></TT
></B
>,
  where 'IP address' is the address of the interface that should be scanned.
  You can use this options multiple times to specify up to 15 additional 
  interfaces, or supply a list of interfaces.
  </P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Don't specify external interfaces</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  While it is possible to misuse this option to specify an external 
  IP address, the check will only work for interfaces on the local machine.
  </P
></TD
></TR
></TABLE
></DIV
><P
>  Services (open ports) that are required or optional (allowed, but not
  required) can be specified with the options
  <B
CLASS="COMMAND"
>PortCheckRequired=<TT
CLASS="REPLACEABLE"
><I
>interface:service list</I
></TT
></B
>, and/or
  <B
CLASS="COMMAND"
>PortCheckOptional=<TT
CLASS="REPLACEABLE"
><I
>interface:service list</I
></TT
></B
>.
  </P
><P
>  Services (open ports) that should be completely ignored can be specified with the option
  <B
CLASS="COMMAND"
>PortCheckIgnore=<TT
CLASS="REPLACEABLE"
><I
>interface:service list</I
></TT
></B
>.
  </P
><P
>  Here, 'interface' should be the IP address of an 
  interface, and 'service list'
  the comma-separated list of required/optional services. Each service
  must be listed as 'port/protocol' (e.g. 22/tcp) for a non-RPC service,
  and 'name/protocol' for an RPC service (e.g. portmapper/tcp). If an 
  RPC service has no name, but just an RPC program number, then the
  name must be given as 'RPC_number' (e.g. RPC_100075).
  </P
><P
>  By default, both TCP and UDP ports are scanned. To disable UDP scanning,
  the option 
  <B
CLASS="COMMAND"
>PortCheckUDP=<TT
CLASS="REPLACEABLE"
><I
>boolean</I
></TT
></B
>
  can be used.
  </P
><P
>  Ports that should be skipped during the check can be specified with 
  the option
  <B
CLASS="COMMAND"
>PortCheckSkip=<TT
CLASS="REPLACEABLE"
><I
>interface:port list</I
></TT
></B
>.
  </P
><P
>  Here, 'interface' should be the IP address of an 
  interface, and 'service list'
  the comma-separated list 'port/protocol' pairs (e.g.: 22/tcp,514/udp,...) 
  to skip.
  </P
><P
>  This option is different from <B
CLASS="COMMAND"
>PortCheckIgnore=...</B
> in 
  two ways:
  (i) since it allows
  to skip ports only, it does not work for RPC services which have no fixed 
  port, and (ii) since the port is not probed, you can avoid error messages by
  obnoxious deamons.
  </P
><DIV
CLASS="TIP"
><P
></P
><TABLE
CLASS="TIP"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/tip.gif"
HSPACE="5"
ALT="Tip"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>MySQL (port 3306)</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>      MySQL counts unsuccessful connection attempts and may refuse
      further connection if some limit is exceeded. You may want to
      use the <B
CLASS="COMMAND"
>PortCheckSkip</B
> option to avoid probing
      the MySQL port.
    </P
></TD
></TR
></TABLE
></DIV
><P
>    By default, all ports from 0 to 65535 are scanned. To change these limits,
    the options 
    <B
CLASS="COMMAND"
>PortCheckMinPort=<TT
CLASS="REPLACEABLE"
><I
>integer</I
></TT
></B
> and
    <B
CLASS="COMMAND"
>PortCheckMaxPort=<TT
CLASS="REPLACEABLE"
><I
>integer</I
></TT
></B
> 
    can be used.
  </P
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN2817"
>5.15.2. Example configuration</A
></H2
><PRE
CLASS="PROGRAMLISTING"
>  [PortCheck]
  #
  # Activate (default is on)
  #
  PortCheckActive = yes

  # The severity of reports: debug/info/notice/warn/err/crit/alert
  # (default is crit)
  #
  SeverityPortCheck = crit

  # These are the defaults
  #
  PortCheckMinPort = 0
  PortCheckMaxPort = 65535
 
  # Services that are required. This example specifies ssl (22/tcp), 
  # smtp (25/tcp), http (80/tcp), and portmapper.
  #
  PortCheckRequired = 192.168.1.128:22/tcp,25/tcp,80/tcp,portmapper/tcp,portmapper/udp

  # Services that are optional. This example specifies 
  # mysql (3306/tcp).
  #
  PortCheckOptional = 192.168.1.128:3306/tcp

  # Additional interfaces to scan. This example presumes that
  # the 'official hostname' corresponds to 192.168.1.128, and
  # that the machine has three more interfaces.
  # 127.0.0.1 (localhost) is not listed, hence not scanned.
  #
  PortCheckInterface = 192.168.1.129
  PortCheckInterface = 192.168.1.130
  PortCheckInterface = 192.168.1.131

  # The interval (in seconds) for port checks (default is 300 sec)
  #
  PortCheckInterval = 300

  # By default, UDP ports are checked as well as TCP ports.
  #
  PortCheckUDP = yes
  </PRE
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="processcheck.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="logmon.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Checking for hidden/fake/missing processes</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="file-monitor.html"
ACCESSKEY="U"
>Up</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Logfile monitoring/analysis</TD
></TR
></TABLE
></DIV
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/footer.html"--><!--#endif --></BODY
></HTML
>
samhain 3.1.0-5ubuntu1 / usr / share / doc / samhain / manual.html / portcheck.html
