On 11/24/2010 01:46 PM, [email protected] wrote:
Hi
Still working on my issue from yesterday ( flagging ww files)
1# I just upgrade OSSEC to OSSEC HIDS v2.5.1 on a Solaris 10 Box
2# I added these to rules to my local rules
The essence of the rules I wrote, like all rules, is that it matches on
something. For example, here's something that isn't too good:
# chmod o+w /etc/fstab
And here is the resulting alert:
OSSEC HIDS Notification.
2010 Nov 24 20:26:09
Received From: talyn->syscheck
Rule: 100018 fired (level 7) -> "World-writable File"
Portion of the log(s):
Integrity checksum changed for: '/etc/fstab'
Permissions changed from 'rw-r--r--' to 'rw-r--rw-'
--END OF NOTIFICATION
Notice that the rule matches the write bit in the "other" position in
the line which begins with "Permissions changed...," which is why it works.
For this to work, the file would have had to already been stored in the
syscheck database *not* world-writable. It flags on the transition from
"secure" to "not secure." Syscheck alerts are for changes to files, so
remember it is transitory.
The second level 0 rule probably shouldn't be level 0. It would be good
to have a record of the file changing back, so upon reflection, I think
it's probably better off at something > 0, but maybe < 7.
Rootcheck could also be used, which wouldn't require the file changing
state, but then it also wouldn't be real time.
If you're still having issues, please post the normal alert that you get
when changing the file.
3# I also added this line to ossec.conf with not so good results
<directories alert_new_file="yes"
check_all="yes">/cdpq,/users/</directories>
010/11/24 15:04:50 ossec-config(1703): ERROR: Invalid attribute
'alert_new_file' for directory option.
2010/11/24 15:04:50 ossec-config(1202): ERROR: Configuration error at
'/opt/ossec/etc/ossec.conf'. Exiting.
2010/11/24 15:04:50 ossec-syscheckd(1202): ERROR: Configuration error at
'/opt/ossec/etc/ossec.conf'. Exiting.
In other words there is something I don’t understand in the Doc
Maybe this is because you are on Solaris? Does Solaris use inotify? I'm
guessing not.
--
Michael Starks
[I] Immutable Security
http://www.immutablesecurity.com
