On Wed, Jun 13, 2012 at 10:44 AM, Wilson Ricardo <[email protected]> wrote: > Hi, > > I configured the ossec.conf to ignore the mounted volumes, but the > ossec is still checking nfs volumes. > ossec.conf: > > <syscheck> > <!-- Frequency that syscheck is executed - default to every 22 hours --> > <frequency>79200</frequency> > > <!-- Directories to check (perform all possible verifications) --> > <directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories> > <directories check_all="yes">/bin,/sbin</directories> > > <!-- Files/directories to ignore --> > <ignore>/etc/mtab</ignore> > <ignore>/etc/mnttab</ignore> > <ignore>/etc/hosts.deny</ignore> > <ignore>/etc/mail/statistics</ignore> > <ignore>/etc/random-seed</ignore> > <ignore>/etc/adjtime</ignore> > <ignore>/etc/httpd/logs</ignore> > <ignore>/etc/utmpx</ignore> > <ignore>/etc/wtmpx</ignore> > <ignore>/etc/cups/certs</ignore> > <ignore>/etc/dumpdates</ignore> > <ignore>/etc/prelink.cache</ignore> > <ignore>/etc/svc/volatile</ignore> > <ignore>/usr/bin/inotifywait</ignore> > <ignore>/usr/bin/inotifywatch</ignore> > <ignore type="sregex">/var/www*</ignore> > (...) > > <rootcheck> > <rootkit_files>/var/ossec//etc/shared/rootkit_files.txt</rootkit_files> > > <rootkit_trojans>/var/ossec//etc/shared/rootkit_trojans.txt</rootkit_trojans> > <system_audit>/var/ossec//etc/shared/system_audit_rcl.txt</system_audit> > <system_audit>/var/ossec//etc/shared/cis_rhel_linux_rcl.txt</system_audit> > <system_audit>/var/ossec//etc/shared/cis_rhel5_linux_rcl.txt</system_audit> > <ignore type="sregex">/var/www*</ignore> > </rootcheck> > > Versions: > ossec-hids-client-2.6-12.el5.art > ossec-hids-2.6-12.el5.art > Linux img02 2.6.18-194.3.1.el5 #1 SMP Thu May 13 13:08:30 EDT 2010 > x86_64 x86_64 x86_64 GNU/Linux > CentOS release 5.5 (Final) > > Mount points: > [root@img02 ~]# mount > /dev/sdb1 on / type ext3 (rw) > proc on /proc type proc (rw) > sysfs on /sys type sysfs (rw) > devpts on /dev/pts type devpts (rw,gid=5,mode=620) > /dev/sdb5 on /tmp type ext3 (rw) > /dev/sda1 on /boot type ext3 (rw) > tmpfs on /dev/shm type tmpfs (rw) > none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw) > sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw) > IP:/vol2/db_files/xml/galerias on /var/www/html/galerias type nfs > (ro,rsize=32768,wsize=32768) > IP:/vol2/mm_files/fotos on /var/www/html/fotos type nfs > (ro,rsize=32768,wsize=32768) > IP:/vol4/ on /var/www/vol4 type nfs (rw,rsize=32768,wsize=32768) > (...) > > I already tried <ignore>/var/www</ignore>, and tried to ignore every > mount point creating one <ignore> each one. > > What am I missing? > > Thank you.
It doesn't even look like you have a <directories> setup for /var(/www). So I'm not sure why it would be checking it in the first place. But I don't think ignore works like everyone thinks it does. It still checks everything, just ignores the results.
