Hi Daniel, Thanks for that!
Can you also comment on whether you plan to include POSIX ACL checking in a future release? Regards, Josh E. On Aug 15, 5:22 am, "Daniel Cid" <[EMAIL PROTECTED]> wrote: > Hi Josh, > > Yes, it is a bug in the way we are reporting it. Internally we store > them correctly (just the int values), but > when sending the alerts (on the server side) we are not checking the > suid, sgid and stick bits. > > It is fixed on the following snapshot (you can run syscheck_control to > make sure it is showing properly): > > http://www.ossec.net/files/snapshots/ossec-hids-080814.tar.gz > > Thanks, > > -- > Daniel B. Cid > dcid ( at ) ossec.net > > On Wed, Aug 13, 2008 at 12:37 AM, <[EMAIL PROTECTED]> wrote: > > > Hi, > > > I am running OSSEC 1.5.1 on Linux and Solaris servers and have noticed > > the following for files with SUID and SGID bits... e.g., performing > > this action: > > > # chmod 5755 testfile2 > > # ls -al testfile2 > > -rwsr-xr-t 1 root root 23 2008-08-11 16:05 testfile2 > > > Will result in the following alert: > > > ** Alert 1218435850.41829: mail - ossec,syscheck, > > 2008 Aug 11 16:24:10 (############) XXX.XXX.XXX.XXX->syscheck > > Rule: 550 (level 7) -> 'Integrity checksum changed.' > > Src IP: (none) > > User: (none) > > Integrity checksum changed for: '/net/ossectest/testfile2' > > Size changed from '0' to '23' > > Permissions changed from 'rw-r--r--' to 'rwxr-xr-x' > > Old md5sum was: 'd41d8cd98f00b204e9800998ecf8427e' > > New md5sum is : '04894652601387eacb0244c00bf31f32' > > Old sha1sum was: 'da39a3ee5e6b4b0d3255bfef95601890afd80709' > > New sha1sum is : 'c6b0f2bd0653f2e1277621fe2277ec2aeff078f2' > > > Notice how it reports that permissions have changed to 'rwxr-xr-x' > > rather than '-rwsr-xr-t'. Is this a bug? > > > Also, are there any plans to include POSIX ACL checking? e.g., > > Currently, the following command does not yield an OSSEC alert: > > > # setfacl -m user:${UserName}:rwx testfile > > > Regards, > > Josh E.
