On Wed, Nov 24, 2010 at 2:46 PM, <[email protected]> wrote: > Hi > > > > Still working on my issue from yesterday ( flagging ww files) > > > > 1# I just upgrade OSSEC to OSSEC HIDS v2.5.1 on a Solaris 10 Box > > 2# I added these to rules to my local rules > > > > <rule id="100018" level="7"> > > <if_group>syscheck,</if_group> > > <regex>Permissions changed from '\D+' to '\D\D\D\D\D\D\Dw\D'</regex> > > <description>World-writable File</description> > > </rule> > > > > <rule id="100019" level="0"> > > <if_sid>100018</if_sid> > > <regex>Permissions changed from '\D\D\D\D\D\D\Dw\D' to '\D+'</regex> > > <description>World-writable File</description> > > </rule> >
These would alert on a file's permissions changing to world writable, I don't know if they'll work for files that start out as world writable. But I haven't had a chance to test it out or check the logs/code to find out either. > > > 3# I also added this line to ossec.conf with not so good results > > <directories alert_new_file="yes" > check_all="yes">/cdpq,/users/</directories> > > > > 010/11/24 15:04:50 ossec-config(1703): ERROR: Invalid attribute > 'alert_new_file' for directory option. > > 2010/11/24 15:04:50 ossec-config(1202): ERROR: Configuration error at > '/opt/ossec/etc/ossec.conf'. Exiting. > > 2010/11/24 15:04:50 ossec-syscheckd(1202): ERROR: Configuration error at > '/opt/ossec/etc/ossec.conf'. Exiting. > > Add <alert_new_files>yes</alert_new_files> to the <syscheck> section in ossec.conf, not the <directories> sections. <syscheck> <alert_new_files>yes</alert_new_files> <directories ... ... </syscheck> > > In other words there is something I don’t understand in the Doc > > Help.. L > > > > > > Aut Viam Inveniam Aut Faciam! > > > > > > ________________________________ > Avis de confidentialité : Ce courriel et les pièces qui y sont jointes > contiennent de l'information confidentielle et peuvent être protégés par le > secret professionnel ou constituer de l’information privilégiée. Ils sont > destinés à l'usage exclusif de la (des) personne(s) à qui ils sont adressés. > Si vous n'êtes pas le destinataire visé ou la personne chargée de > transmettre ce document à son destinataire, vous êtes avisé par la présente > que toute divulgation, reproduction, copie, distribution ou autre > utilisation de cette information est strictement interdite. Si vous avez > reçu ce courriel par erreur, veuillez en aviser immédiatement l’expéditeur > par téléphone ainsi que détruire et effacer l'information que vous avez > reçue de tout disque dur ou autre média sur lequel elle peut être > enregistrée et ne pas en conserver de copie. Merci de votre collaboration. > Notice of Confidentiality: This electronic mail message, including any > attachments, is confidential and may be privileged and protected by > professional secrecy. They are intended for the exclusive use of the > addressee. If you are not the intended addressee or the person responsible > for delivering this document to the intended addressee, you are hereby > advised that any disclosure, reproduction, copy, distribution or other use > of this information is strictly forbidden. If you have received this > document by mistake, please immediately inform the sender by telephone, > destroy and delete the information received from any hard disk or any media > on which it may have been registered and do not keep any copy. Thank you for > your cooperation. >
