So taking a look at report_changes I'm having some trouble figuring it
out...
my ossec.conf config:
<!-- Directories to check (perform all possible verifications) -->
<directories realtime="yes" report_changes="yes"
check_all="yes">/etc</directories>
<directories check_all="yes">/bin,/sbin</directories>
and here is what I get:
OSSEC HIDS Notification.
2010 Oct 09 19:35:14
Received From: ossec->syscheck
Rule: 552 fired (level 7) -> "Integrity checksum changed again (3rd time)."
Portion of the log(s):
Integrity checksum changed for: '/etc/php.ini'
Size changed from '45121' to '45152'
Old md5sum was: 'dc26fb421dae7b52b620c386e4a3de61'
New md5sum is : 'c146509741aa97cd53ef124b6b5dcd86'
Old sha1sum was: '3c04c9b4072d1b0ac662f8985715de13fc9e2971'
New sha1sum is : '21e6d3d31f28fa4850aa90a8ae8d5bd39a472f51'
-END OF NOTIFICATION
It's doing a diff, that I can tell. Looking at the diff directory I can see
the changes.
r...@ossec:/var/ossec/queue/diff/local/etc/php.ini# cat diff.1286675781
12c12
< ; the -c argument in command line mode.
---
> ; the -c argument in command line mode. and some other stuff
I had assumed there would be some kind of alert with config written into the
log or emailed (I understand this can be considered insecure). Am I once
again missing something obvious?
Thanks again for your help,
-Tim Eberhard
On Sat, Oct 9, 2010 at 5:56 PM, Tim Eberhard <[email protected]> wrote:
> Thanks sweet, thanks again guys. Amazing work.
>
> I would still love to see a roadmap posted just to see what cool new stuff
> is getting worked on. Just tossing that out there :)
>
> -Tim Eberhard
>
> On Oct 9, 2010, at 5:20 PM, Daniel Cid <[email protected]> wrote:
>
> > It is a new feature added on v2.5, so not available during the write
> > of the book.
> >
> > Just add report_changes="yes" to add monitored directory and you will get
> > the "diff" between versions.
> >
> > Thanks,
> >
> > On Sat, Oct 9, 2010 at 4:17 PM, Tim Eberhard <[email protected]> wrote:
> >> Wow, very nice. I'm amazed I haven't seen that feature before. I read
> the sygress book and it made no mention of that feature.
> >>
> >> Excellent stuff, I greatly appreciate the response. I'll check it out
> read up. Sorry to add white noise to the list.
> >>
> >> -Tim Eberhard
> >>
> >> On Oct 9, 2010, at 1:55 PM, "[email protected]" <[email protected]>
> wrote:
> >>
> >>> Oops, I meant the report_changes option in syscheck, check_diff is
> different.
> >>>
> >>>
> >>> -----Original Message-----
> >>> From: Tim Eberhard
> >>> Sent: 10/09/2010 12:15:51 PM
> >>> Subject: [ossec-list] dev roadmap?
> >>>
> >>> All,
> >>>
> >>> I hate to ask such a basic question but after browsing/googling I have
> been
> >>> unable to find any kind of documented roadmap for OSSEC.
> >>>
> >>> Of course I had a few specific features in mind that I wanted to see if
> were
> >>> on the roadmap.
> >>>
> >>> I searched the archive and I've found a few of them have been asked in
> the
> >>> past. The primary feature I'm looking for is the central repo/diff
> >>> capability for configuration files built into ossec. When evaluating
> OSSEC
> >>> vs some commercial alternatives some of the short comings we found were
> >>> mainly around the ability to track/alert on not only signature changes
> to
> >>> files but evaluate the configuration file and answer the commonly asked
> >>> question "great the md5 signature changed.. but WHAT changed?"
> >>>
> >>> I know you can hack something up with some active response combo with a
> >>> change repo but that really isn't a decent solution that integrates
> with
> >>> OSSEC.
> >>>
> >>> Thanks for your help, sorry if I missed the obvious.
> >>> -Tim Eberhard
> >>>
> >>
>
