Hi Marco, The rule seems ok to me here. I added to the bottom of system_audit.rcl and it fired properly.
A good way to test is to go to src/rootcheck (inside ossec package) and do: # make binary # ./ossec-rootcheck It will read the rules from ./db/ so you can easily debug it. Thanks, On Tue, Oct 12, 2010 at 1:13 PM, Marco C. <[email protected]> wrote: > Hi, > > I am translating some of our policy requirements in rootcheck checks > but I am having problem with a very simple rule. I want to detect if > sudo is configured to give access to users without asking for > password. To do this I have put a custom rule in a file configured in > a "<system_audit>" directive. The custom rule file is correctly merged > in merged.mg and sent across to all the agents but the rule doesn't > work. > I am checking the word NOPASSWD in the file /etc/passwd on a line that > doesn't start with a comment. To do so I use the following: > > [TEST] [any] [https://test/test] > f:/etc/sudoers -> !r:^# && r:NOPASSWD; > > Unfortunately this doesn't seem to work. Any thoughts? How I can > troubleshoot this? Is there a way to put rootcheck in debug mode? > > Thank You, > > --MC
