On Wed, Jun 9, 2010 at 12:38 PM, Richard Geddes <[email protected]> wrote: > 1. Does ossec File integrity checking, generate hashes for files in the > selected directories when initially installed?
The hashes will be generated when syscheck runs, generally soon after install. > - if yes: > - where is the database with the hashes? Somewhere in /var/ossec/queue I think. > - can ossec use hashes generated by my package mgmt process.. > (debian (debsums -a ) for example)? No. > - are the file hashes signed or is there a signed database hash? > No. > 2. I assume that when files from a monitored directory are created/deleted, > File Integrity checking will catch/report it as well.... yes? > Ossec can, but does not by default, alert when a new file is created. It will report when a file is missing and it cannot create a hash for the file. > 3. how are signatures (rootkit, SIM/SIEM) updated? Is there an automated way > to do this... cron maybe? > They are updated when you update them, generally during upgrades. > R > > -- > Richard Geddes > BlueGolf - www.BlueGolf.com > [email protected] | 610-293-0998 | 610-293-0987 (fax) >
