Hey, Real time monitoring using syscheck will not work on Solaris (only Linux with inotify and Windows). You could also use rootcheck to alert on those, but by default it will only flag files owned by root and with the write permissions to anyone...
Thanks, On Wed, Nov 24, 2010 at 10:36 PM, Michael Starks <[email protected]> wrote: > On 11/24/2010 01:46 PM, [email protected] wrote: >> >> Hi >> >> Still working on my issue from yesterday ( flagging ww files) >> >> 1# I just upgrade OSSEC to OSSEC HIDS v2.5.1 on a Solaris 10 Box >> >> 2# I added these to rules to my local rules > > The essence of the rules I wrote, like all rules, is that it matches on > something. For example, here's something that isn't too good: > > # chmod o+w /etc/fstab > > And here is the resulting alert: > > OSSEC HIDS Notification. > 2010 Nov 24 20:26:09 > > Received From: talyn->syscheck > Rule: 100018 fired (level 7) -> "World-writable File" > Portion of the log(s): > > Integrity checksum changed for: '/etc/fstab' > Permissions changed from 'rw-r--r--' to 'rw-r--rw-' > > > > --END OF NOTIFICATION > > Notice that the rule matches the write bit in the "other" position in the > line which begins with "Permissions changed...," which is why it works. > > For this to work, the file would have had to already been stored in the > syscheck database *not* world-writable. It flags on the transition from > "secure" to "not secure." Syscheck alerts are for changes to files, so > remember it is transitory. > > The second level 0 rule probably shouldn't be level 0. It would be good to > have a record of the file changing back, so upon reflection, I think it's > probably better off at something > 0, but maybe < 7. > > Rootcheck could also be used, which wouldn't require the file changing > state, but then it also wouldn't be real time. > > If you're still having issues, please post the normal alert that you get > when changing the file. > >> 3# I also added this line to ossec.conf with not so good results >> >> <directories alert_new_file="yes" >> check_all="yes">/cdpq,/users/</directories> >> >> 010/11/24 15:04:50 ossec-config(1703): ERROR: Invalid attribute >> 'alert_new_file' for directory option. >> >> 2010/11/24 15:04:50 ossec-config(1202): ERROR: Configuration error at >> '/opt/ossec/etc/ossec.conf'. Exiting. >> >> 2010/11/24 15:04:50 ossec-syscheckd(1202): ERROR: Configuration error at >> '/opt/ossec/etc/ossec.conf'. Exiting. >> >> In other words there is something I don’t understand in the Doc > > Maybe this is because you are on Solaris? Does Solaris use inotify? I'm > guessing not. > > -- > Michael Starks > [I] Immutable Security > http://www.immutablesecurity.com >
