/usr/share/doc/samhain/manual.html/sqldetails.html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN""http://www.w3.org/TR/html4/loose.dtd">
<HTML
><HEAD
><TITLE
>SQL Database</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.79"><LINK
REL="HOME"
TITLE="The Samhain Host Integrity Monitoring System"
HREF="index.html"><LINK
REL="UP"
TITLE="Configuration of logging facilities"
HREF="basic-configuration.html"><LINK
REL="PREVIOUS"
TITLE="Syslog"
HREF="syslogdetails.html"><LINK
REL="NEXT"
TITLE="Configuring samhain, the host integrity monitor"
HREF="file-monitor.html"><LINK
REL="STYLESHEET"
TYPE="text/css"
HREF="./docbook.css"></HEAD
><BODY
CLASS="SECT1"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/header.html"--><!--#endif --><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>The Samhain Host Integrity Monitoring System</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="syslogdetails.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
>Chapter 4. Configuration of logging facilities</TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="file-monitor.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="SQLDETAILS"
>4.12. SQL Database</A
></H1
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Requirements</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  This facility requires that you have compiled with the 
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>--enable-xml-log</I
></SPAN
> option to format
  log messages in XML (<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>also for the client</I
></SPAN
>, 
  even if you do SQL logging
  on the server), and of course with the 
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>--with-database=XXX</I
></SPAN
> option (where 'XXX'
  may be any of: mysql, postgresql, oracle, or odbc).
  </P
><P
>  If you are using the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>MessageHeader</I
></SPAN
> 
  directive in the configuration file for a user-defined
  message header, make sure that the log messages are still valid XML, and that
  all the default entities are still present.
  </P
></TD
></TR
></TABLE
></DIV
><P
>  Currently MySQL, PostgreSQL, and Oracle are implemented and tested.
  Support for unixODBC
  is implemented, but not fully tested.  
  If the header file
  'mysql.h' ('libpq-fe.h') is not found during compilation 
  ('mysql.h: No such file or directory'), you can use the option
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>--with-cflags=-I/dir/where/mysql.h/is</I
></SPAN
>. 
  If the library libmysqlclient.a
  (libpq.a) is not found ('/usr/bin/ld: cannot find -lmysqlclient'), you can
  use the option
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>--with-libs=-L/dir/where/libmysqlclient.a/is</I
></SPAN
>.
  </P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Note</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  PostgreSQL may fail with --enable-static. 
  This is a 
  postgresql bug.
  </P
></TD
></TR
></TABLE
></DIV
><P
>  By default,
  the database server is assumed to be on localhost, 
  the db name is 'samhain', the
  db table is 'log', and inserting is possible for any user without password.
  To <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>create</I
></SPAN
> the database/table with the required columns, 
  the distribution includes the scripts 
  'samhain.mysql.init', 'samhain.postgres.init', and 'samhain.oracle.init'. 
  E.g., for PostgreSQL
  you would setup the database like:
  </P
><PRE
CLASS="PROGRAMLISTING"
>      $ su postgres
      $ createdb samhain
      $ createuser -P samhain
      Enter password for new role: 
      Enter it again: 
      Shall the new role be a superuser? (y/n) n
      Shall the new role be allowed to create databases? (y/n) n
      Shall the new role be allowed to create more new roles? (y/n) n
      $ psql -d samhain &#60; samhain.postgres.init
      $ exit</PRE
><P
>  &hellip; and for MySQL:
  </P
><PRE
CLASS="PROGRAMLISTING"
>      $ mysql -p -u root &#60; samhain.mysql.init
      $ mysql -p -u root
      &gt; GRANT SELECT,INSERT ON samhain.log TO 'samhain'@'localhost';
      &gt; SET PASSWORD for 'samhain'@'localhost' = PASSWORD('...');
      &gt; FLUSH PRIVILEGES;</PRE
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Permissions</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  The PostgreSQL init script will grant INSERT permission only to
  a user 'samhain'. Please take note that for PostgreSQL, 
  inserting also requires SELECT 
  and UPDATE permission for the sequence 'log_log_index_seq' (see 
  bottom of init script). The MySQL init script will create the database,
  but not the user, and will not grant any permissions. 
  </P
></TD
></TR
></TABLE
></DIV
><P
>  As with all logging facilities, logging to the SQL database
  must be enabled in the configuration file by setting an appropriate
  threshold, e.g.:
  </P
><PRE
CLASS="PROGRAMLISTING"
> 
  [Log]
  DatabaseSeverity=warn
  </PRE
><P
>  In the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Database</I
></SPAN
> section of the configuration file, 
  you can modify
  the defaults via the following directives:
  </P
><PRE
CLASS="PROGRAMLISTING"
> 
  [Database]
  SetDBName=<TT
CLASS="REPLACEABLE"
><I
>db_name</I
></TT
> 
  SetDBTable=<TT
CLASS="REPLACEABLE"
><I
>db_table</I
></TT
>
  SetDBHost=<TT
CLASS="REPLACEABLE"
><I
>db_host</I
></TT
> 
  SetDBUser=<TT
CLASS="REPLACEABLE"
><I
>db_user</I
></TT
> 
  SetDBPassword=<TT
CLASS="REPLACEABLE"
><I
>db_password</I
></TT
>
  UsePersistent=<TT
CLASS="REPLACEABLE"
><I
>yes/no</I
></TT
>
  </PRE
><P
>  The default is to use a persistent connection to the database.
  You can change this with <B
CLASS="COMMAND"
>UsePersistent=no</B
>
  </P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Note re. PostgreSQL</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  For PostgreSQL, db_host must be a numerical IP address.
  </P
></TD
></TR
></TABLE
></DIV
><P
>  
  When logging client messages, <SPAN
CLASS="APPLICATION"
>yule</SPAN
> will 
  wrap them into a server
  &lt;log sev=''RCVT'' tstamp=&hellip;  &gt; &hellip; &lt;/log&gt; message.
  The parser will 
  then create a separate database entry for this server timestamp.
  If you don't like this, you can use the option 
  <B
CLASS="COMMAND"
>SetDBServerTstamp=<TT
CLASS="REPLACEABLE"
><I
>false</I
></TT
></B
>.
  </P
><P
>  
  The table field 'log_ref' is NULL for client messages, 0 for server
  messages, and equal to 'log_index' of the client message for the
  aforementioned server timestamp of a client message.
  </P
><P
>  
  Log records can be tagged via a special (indexed) table 
  field 'log_hash', which is the MD5 checksum of
  (the concatenation of) any fields registered 
  with <B
CLASS="COMMAND"
>AddToDBHash=<TT
CLASS="REPLACEABLE"
><I
>field</I
></TT
></B
>. 
  The <SPAN
CLASS="APPLICATION"
>beltane</SPAN
> web-based console can use
  these tags to filter messages.
  There is no default set of fields over which the MD5 hash is 
  computed, so by default the tag is <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>equal</I
></SPAN
> for all rows.
  </P
><DIV
CLASS="TIP"
><P
></P
><TABLE
CLASS="TIP"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/tip.gif"
HSPACE="5"
ALT="Tip"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Tip</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  
  For security, you may want to set up a user/password for
  insertion into the db. However, as the password is in cleartext in
  the config file (and the connection to the db server is not encrypted), 
  for remote logging this facility is less secure than samhain's own
  client/server system (it is recommended to run the db server on the log host
  and have the log server, i.e. <SPAN
CLASS="APPLICATION"
>yule</SPAN
>, 
  log to the db).
  </P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="DB-UPGRADE"
>4.12.1. Upgrade to samhain 2.3</A
></H2
><P
>      Version 2.3 of <SPAN
CLASS="APPLICATION"
>Samhain</SPAN
> supports checking
      of SELinux attributes and/or Posix ACLs. For backward compatibility,
      this is off by default. If you upgrade <SPAN
CLASS="APPLICATION"
>Samhain</SPAN
>
      and enable this option, you need to update the database scheme as follows:
      </P
><P
>      Mysql:
      </P
><PRE
CLASS="PROGRAMLISTING"
> 
        ALTER TABLE samhain.log ADD COLUMN acl_old BLOB;
        ALTER TABLE samhain.log ADD COLUMN acl_new BLOB;</PRE
><P
>      PostgreSQL:
      </P
><PRE
CLASS="PROGRAMLISTING"
> 
        ALTER TABLE samhain.log ADD COLUMN acl_old TEXT;
        ALTER TABLE samhain.log ADD COLUMN acl_new TEXT;</PRE
><P
>      Oracle:
      </P
><PRE
CLASS="PROGRAMLISTING"
> 
        ALTER TABLE samhain.log ADD acl_old VARCHAR2(4000);
        ALTER TABLE samhain.log ADD acl_new VARCHAR2(4000);
        DROP TRIGGER trigger_on_log;</PRE
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="DB-UPGRADE2"
>4.12.2. Upgrade to samhain 2.4.4</A
></H2
><P
>      Version 2.4.4 of <SPAN
CLASS="APPLICATION"
>Samhain</SPAN
> supports
      storing the content of files. If you have created your Oracle 
      database using the database scheme from a previous version,
      you need to change at least the 'link_old' and 'link_new'
      columns from VARCHAR2 to CLOB:
      </P
><PRE
CLASS="PROGRAMLISTING"
> 
      ALTER TABLE samhain.log ADD tmp_name CLOB;
      UPDATE samhain.log SET tmp_name=link_old;
      ALTER TABLE samhain.log DROP COLUMN link_old;
      ALTER TABLE samhain.log RENAME COLUMN tmp_name to link_old;

      ALTER TABLE samhain.log ADD tmp_name CLOB;
      UPDATE samhain.log SET tmp_name=link_new;
      ALTER TABLE samhain.log DROP COLUMN link_new;
      ALTER TABLE samhain.log RENAME COLUMN tmp_name to link_new;</PRE
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="MYSQL-CFG"
>4.12.3. MySQL configuration details</A
></H2
><P
>  To pass the location of the MySQL Unix domain socket (for connections on 
  localhost) to <SPAN
CLASS="APPLICATION"
>samhain</SPAN
>, you can use 
  the environment variable MYSQL_UNIX_PORT
  (the value must be the path of the socket).
  </P
><P
>  Alternatively, as of <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> version 2.2, you
  can set options for the group &quot;samhain&quot; in 
  <TT
CLASS="FILENAME"
>my.cnf</TT
>. See the MySQL manual for the proper 
  <A
HREF="http://dev.mysql.com/doc/refman/5.0/en/option-files.html"
TARGET="_top"
>syntax</A
>
  of the <TT
CLASS="FILENAME"
>my.cnf</TT
> file, as well as for <A
HREF="http://dev.mysql.com/doc/refman/5.0/en/mysql-options.html"
TARGET="_top"
>possible
  options</A
>.
  </P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Note</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  It is not possible for an application (like 
  e.g. <SPAN
CLASS="APPLICATION"
>samhain</SPAN
>) to detect whether 
  <TT
CLASS="FILENAME"
>my.cnf</TT
> is readable (because the application does
  not know where the file resides). Interesting errors may result...
  </P
></TD
></TR
></TABLE
></DIV
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="syslogdetails.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="file-monitor.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Syslog</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="basic-configuration.html"
ACCESSKEY="U"
>Up</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Configuring <SPAN
CLASS="APPLICATION"
>samhain</SPAN
>, the host integrity monitor</TD
></TR
></TABLE
></DIV
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/footer.html"--><!--#endif --></BODY
></HTML
>
samhain 3.1.0-5ubuntu1 / usr / share / doc / samhain / manual.html / sqldetails.html
