/usr/share/doc/samhain/manual.html/the-configuration-file.html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN""http://www.w3.org/TR/html4/loose.dtd">
<HTML
><HEAD
><TITLE
>Configuration file syntax and options</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.79"><LINK
REL="HOME"
TITLE="The Samhain Host Integrity Monitoring System"
HREF="index.html"><LINK
REL="PREVIOUS"
TITLE="yule"
HREF="command-line-yule.html"><LINK
REL="NEXT"
TITLE="Files to check"
HREF="files-to-check.html"><LINK
REL="STYLESHEET"
TYPE="text/css"
HREF="./docbook.css"></HEAD
><BODY
CLASS="APPENDIX"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/header.html"--><!--#endif --><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>The Samhain Host Integrity Monitoring System</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="command-line-yule.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
></TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="files-to-check.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="APPENDIX"
><H1
><A
NAME="THE-CONFIGURATION-FILE"
></A
>Appendix C. Configuration file syntax and options</H1
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="CONFIGFILE"
>C.1. General</A
></H1
><P
>  The  configuration file for 
  <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> is named <TT
CLASS="FILENAME"
>samhainrc</TT
>
  by default. Also by default, it is placed in 
  <TT
CLASS="FILENAME"
>/etc</TT
>.
  (Name and location is configurable at compile time).
  The distribution package comes with a commented sample 
  configuration file.</P
><P
>  This section introduces the general structure of the configuration file.
  Details on individual entries in the configuration files are
  discussed in <A
HREF="filedef.html"
>Section 5.4</A
>&#62; (which files to monitor), 
  <A
HREF="basic-configuration.html#LOGDEF"
>Section 4.1</A
>&#62; (what should be logged, which logging facilities 
  should be used, and how these facilities are properly configured), and
  <A
HREF="mondef.html"
>Section 5.11</A
>&#62; (monitoring login/logout events).</P
><P
>  The configuration file contains several <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>sections</I
></SPAN
>,  
  indicated  by  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>headings</I
></SPAN
>  in
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>square  brackets</I
></SPAN
> (e.g. <B
CLASS="COMMAND"
>[Database]</B
>).
  Sections exist to group related directives and avoid eventual name clashes
  among options. Any particular section may occur multiple times.</P
><P
>  Each  section  may  hold  zero or more
  <B
CLASS="COMMAND"
>key=<TT
CLASS="REPLACEABLE"
><I
>value</I
></TT
></B
> pairs. 
  Keys are not case sensitive, and 
  space around the '=' is allowed, as well as before the key and after the
  value. More specifically: the line is processed by splitting into key and
  value at the first '=', trimming whitespace from the beginning and end of
  both key and value, and converting the key to lowercase.</P
><P
>  Blank lines and lines starting  with  '#'
  are  comments.   Everything  before  the first section and
  after an <B
CLASS="COMMAND"
>[EOF]</B
> is ignored. 
  The <B
CLASS="COMMAND"
>[EOF]</B
> end-of-file marker is
  optional.
  The file thus looks like:</P
><PRE
CLASS="PROGRAMLISTING"
>  # this is a comment       
  [Section heading]   
  key1=value     
  key2=value     
  
  [Another section]    
  key3=value     
  key4=value     </PRE
><P
>For boolean values the following are equivalent (case-insensitive): 
True, Yes, or 1. 
Likewise, the following are equivalent (case-insensitive): False, No, or 0.</P
><P
>In lists, values can be separated by space, tabs, or commas. </P
><DIV
CLASS="TIP"
><P
></P
><TABLE
CLASS="TIP"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/tip.gif"
HSPACE="5"
ALT="Tip"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Tip</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>Each section may occur multiple times.</P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Note</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>You can explicitely end the configuration file with an
<B
CLASS="COMMAND"
>[EOF]</B
> (on a separate line), but this
is not required, unless there is some junk beyond that may
confuse the parser. A PGP signature does <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>not</I
></SPAN
> 
qualify as 'junk' if <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> 
is compiled to verify the signature.</P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="EXPANSION"
>C.1.1. Shell expansion</A
></H2
><P
>  As of version 2.5.3, it is possible to use shell expansion to define
  the value of an option. For any configuration file option written as
  <B
CLASS="COMMAND"
>Key = $( <TT
CLASS="REPLACEABLE"
><I
>shell_command</I
></TT
> )</B
>,
  the string contained within the $() will be passed 
  literally to the shell (by invoking 
  <B
CLASS="COMMAND"
>/bin/sh -c <TT
CLASS="REPLACEABLE"
><I
>shell_command</I
></TT
></B
>), 
  and the 
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>first</I
></SPAN
> line returned by the shell - after stripping the
  newline char - will replace the $(..). If there is no output 
  within 120 seconds, <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> will ignore the
  configuration option (and report an error).</P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Note</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>You cannot define just <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>part</I
></SPAN
> of an option value this way.
You need to write the shell expression such that it covers the 
<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>whole</I
></SPAN
> option value (e.g. by including an 'echo -n foobar').</P
></TD
></TR
></TABLE
></DIV
><P
>  The PATH environment variable
  will be set to &quot;/sbin:/bin:/usr/sbin:/usr/bin:/usr/ucb&quot;,
  the SHELL variable to &quot;/bin/sh&quot;, the IFS variable
  to &quot; \t\n&quot;, and the TZ variable will be copied from the
  startup environment. 
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>No other environment variables will be set</I
></SPAN
>.</P
><P
>  In case you are unsure about the need for escaping: yes, the whole string
  will be passed as a single argument to the shell, like calling 
  <B
CLASS="COMMAND"
>/bin/sh -c '<TT
CLASS="REPLACEABLE"
><I
>shell_command</I
></TT
>'</B
>
  from the shell, BUT since this is done from within a C program rather than
  from a shell, there are no single quotes surrounding the whole string.</P
><P
>  In the following example, we parse the output of 
  <B
CLASS="COMMAND"
>ifconfig</B
> to supply a list of all interfaces to the 
  &quot;PortCheckInterface&quot; option.</P
><PRE
CLASS="PROGRAMLISTING"
>#
# Lines broken for display purposes. Must be ONE line in config file!!!

# Linux/Solaris, FreeBSD, OpenBSD

$Linux:.*:.*
PortCheckInterface=$( /sbin/ifconfig | grep 'inet addr:' | 
    sed 's/.*r:\([0-9.]*\).*/\1 /' | tr -d '\n'; echo )
$end

# Solaris, FreeBSD, OpenBSD

$(SunOS|FreeBSD|OpenBSD):.*:.*
PortCheckInterface = $( /sbin/ifconfig -a| grep 'inet ' | 
    sed 's/.*t \([0-9.]*\) .*/\1 /' | tr -d '\n';echo )
$end</PRE
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="CONDITIONALS"
>C.1.2. Conditionals</A
></H2
><P
>  Conditional inclusion of entries for some host(s) is  supported  
  via  any  number  of  @if.. / @else / @fi  directives.
  @if.., @else, and @fi must each be on separate  lines. Configuration
  options in the @if.. (or the optional @else) branch will be read or 
  ignored depending on the result of the test.</P
><P
>  Supported tests are as follows:</P
><P
></P
><DIV
CLASS="VARIABLELIST"
><DL
><DT
>hostname_matches</DT
><DD
><P
>	<B
CLASS="COMMAND"
>@if hostname_matches <TT
CLASS="REPLACEABLE"
><I
>regex</I
></TT
></B
> 
	will succeed if the hostname matches the regular expression given.
    </P
></DD
><DT
>system_matches</DT
><DD
><P
>	<B
CLASS="COMMAND"
>@if system_matches <TT
CLASS="REPLACEABLE"
><I
>regex</I
></TT
></B
> 
	will succeed if the string sysname:release:machine &mdash; i.e.
	$(uname -s):$(uname -r):$uname - m) &mdash; matches the 
	regular expression given.
    </P
></DD
><DT
>file_exists</DT
><DD
><P
>	<B
CLASS="COMMAND"
>@if file_exists <TT
CLASS="REPLACEABLE"
><I
>path</I
></TT
></B
> 
	will succeed if a file with the given absolute path exists. 
	Wildcards/regular expression are not supported.
    </P
></DD
><DT
>interface_exists</DT
><DD
><P
>	<B
CLASS="COMMAND"
>@if interface_exists <TT
CLASS="REPLACEABLE"
><I
>address</I
></TT
></B
> 
	will succeed if a network interface with the given address exists.
    </P
></DD
><DT
>command_succeeds</DT
><DD
><P
>	<B
CLASS="COMMAND"
>@if command_succeeds <TT
CLASS="REPLACEABLE"
><I
>command</I
></TT
></B
> 
	will execute <B
CLASS="COMMAND"
>/bin/sh -c <TT
CLASS="REPLACEABLE"
><I
>command</I
></TT
></B
>
	and succeed if the exit status is zero. The PATH environment variable
	will be set to &quot;/sbin:/bin:/usr/sbin:/usr/bin:/usr/ucb&quot;,
	the SHELL variable to &quot;/bin/sh&quot;, the IFS variable
	to &quot; \t\n&quot;, and the TZ variable will be copied from the
	startup environment. 
	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>No other environment variables will be set</I
></SPAN
>.
    </P
></DD
></DL
></DIV
><P
>  You can negate a test by saying '@if not ..'. The 'not' may be replaced
  by a '!'. The following are all valid: '@if not file_exists /etc/motd',
  '@if !file_exists /etc/motd', and '@if ! file_exists /etc/motd'.</P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Note on backward compatibility</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>    For backward compatibility, instead of 
    <B
CLASS="COMMAND"
>@if hostname_matches <TT
CLASS="REPLACEABLE"
><I
>hostname</I
></TT
></B
> 
    you can also say <B
CLASS="COMMAND"
>@<TT
CLASS="REPLACEABLE"
><I
>hostname</I
></TT
></B
>.
  </P
><P
>    Likewise, instead of 
    <B
CLASS="COMMAND"
>@if system_matches <TT
CLASS="REPLACEABLE"
><I
>sysname:release:machine</I
></TT
></B
> 
    you can also say <B
CLASS="COMMAND"
>$<TT
CLASS="REPLACEABLE"
><I
>sysname:release:machine</I
></TT
></B
>.
  </P
><P
>    Also, the old method of negating by prepending a '!' to 
    the '@' ('$') is still
    supported, as well as the use of '@end' ('$end') instead of '@fi'.
  </P
></TD
></TR
></TABLE
></DIV
><PRE
CLASS="PROGRAMLISTING"
>  @if hostname_matches foobar                                   
  # only read if hostname is 'foobar'
  @else
  # read if hostname is NOT 'foobar'
  @fi
                                              
  @if not hostname_matches foobar                                 
  # not read if hostname is 'foobar'    
  @fi                                               

  @if system_matches Linux:2.6.24-21-generic:i686
  # only read if $(uname -s):$(uname -r):$(uname -m)
  #   matches Linux:2.6.24-21-generic:i686
  @fi

  @if !system_matches Linux:2.6.24-21-generic:i686         
  # not read if $(uname -s):$(uname -r):$(uname -m)
  #   matches Linux:2.6.24-21-generic:i686
  @fi                                              </PRE
></DIV
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="command-line-yule.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="files-to-check.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><SPAN
CLASS="APPLICATION"
>yule</SPAN
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
>&nbsp;</TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Files to check</TD
></TR
></TABLE
></DIV
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/footer.html"--><!--#endif --></BODY
></HTML
>
samhain 3.1.0-5ubuntu1 / usr / share / doc / samhain / manual.html / the-configuration-file.html
