Hi, On Tue, May 17, 2011 at 4:36 PM, Daniel Cid <[email protected]> wrote:
> Btw, anyone interested in doing a config check for each of those > functions? So we can disable/enable them via ossec.conf? Good way > to get started coding on ossec :) > > I made the changes to ossec code to make these checks configurable via ossec.conf. The relevant changeset in my repo is https://bitbucket.org/cmoraes/ossec/changeset/46f14c668cfa <https://bitbucket.org/cmoraes/ossec/changeset/46f14c668cfa>This change adds the following configuration option in ossec.conf. <rootkit> <disable_check>/dev</disable_check> <disable_check>system</disable_check> <disable_check>processes</disable_check> <disable_check>allports</disable_check> <disable_check>openports</disable_check> <disable_check>interfaces</disable_check> </rootkit> The following comma separated notation is also supported <rootkit> <disable_check>/dev, system, processes, allports, openports, interfaces</disable_check> </rootkit> The values "/dev", "system", etc. must be spelled exactly as above (case is not important). HTH, Chris
