Miscellaneous

Samhain
Prev | Appendix C. List of configuration file options | Next

# C.13. Miscellaneous

Section heading:

[Misc]

Entries:

Daemon=`boolean` — Whether to become a daemon (default: no)

MessageHeader=`"\%S \%T \%F \%L \%C"` — Specify custom format for message header.

VersionString=`string` — Set version string to include in file signature database (along with hostname and date).

SetReverseLookup=`boolean` — If false, skip reverse lookups when connecting to a host known by name rather than IP address.

HideSetup=`boolean` — Don't log names of config/database files on startup.

SyslogFacility=`LOG_xxx` — Set syslog facility (default is LOG_AUTHPRIV).

MACType=`HASH-TIGER/HMAC-TIGER` — Set type of message authentication code (HMAC). Must be identical on client and server.

SetLoopTime=`seconds` — Interval between timestamp messages (60).

SetConsole=`device` — Set the console device (/dev/console).

MessageQueueActive=`boolean` — Use SysV IPC message queue (false).

PreludeMapToInfo=`list of samhain severities` — The severities that should be mapped to impact severity 'info' in prelude reports (default: none). This option is only available with libprelude 0.9.

PreludeMapToLow=`list of samhain severities` — The severities that should be mapped to impact severity 'low' in prelude reports (default: none). This option is only available with libprelude 0.9.

PreludeMapToMedium=`list of samhain severities` — The severities that should be mapped to impact severity 'medium' in prelude reports (default: none). This option is only available with libprelude 0.9.

PreludeMapToHigh=`list of samhain severities` — The severities that should be mapped to impact severity 'high' in prelude reports (default: none). This option is only available with libprelude 0.9.

PreludeProfile=`profile` — Set the profile (sensor name) for use with the Prelude IDS. This option is only available with libprelude 0.9. Default is 'samhain' (prelude 0.9) or 'Samhain' (prelude 0.8).

SetMailTime=`seconds` — Maximum time interval between mail messages (86400 sec).

SetMailNum=`0 -- 127` — Maximum number of pending mails on internal queue (10).

SetMailAddress=`recepient` — Add a recepient e-mail address (max. 8).

SetMailRelay=`IP address` — The mail relay (for offsite mail; default: none).

MailSubject=`string` — Custom format for the email subject (none).

SetMailSender=`string` — Sender for the 'From:' field.

SetMailFilterAnd=`list` — Defines a list of strings all of which must match a message, otherwise it will not be mailed.

SetMailFilterOr=`list` — Defines a list of strings at least one of which must match a message, otherwise it will not be mailed.

SetMailFilterNot=`list` — Defines a list of strings none of which should match a message, otherwise it will not be mailed.

SamhainPath=`path` — The path of the process image.

SetBindAddress=`IP address` — The IP address (i.e. interface on multi-interface box) to use for outgoing connections (e.g. e-mail).

SetTimeServer=`IP address` — The time server. Note that the simple 'time' service (port 37/tcp) is used.

TrustedUser=`username(,username,..)`. — List of additional trusted users.

SetLogfilePath=`AUTO or /path` — Path to log file (AUTO to tack hostname on compiled-in path).

SetLockfilePath=`AUTO or /path`— Path to lock file (AUTO to tack hostname on compiled-in path).

The following options are only relevant for standalone or client executables:

SetNiceLevel=`-19..19` — Set scheduling priority during file check. — (see 'man nice').

SetIOLimit=`bps` — Set IO limits (kilobytes per second) for file check.

SetFilecheckTime=`seconds` — Interval between file checks (600).

FileCheckScheduleOne=`schedule`— Crontab-like schedule for file checks.

UseHardlinkCheck=`boolean`— Compare number of hardlinks to number of subdirectories for directories.

HardlinkOffset=`N`:`/path` — Exception (use multiple times for multiple exceptions). N is offset (actual - expected hardlinks) for `/path`.

AddOKChars=`N1, N2, ..` — List of acceptable characters (byte value(s)) for the check for weird filenames. Nn may be hex (leading '0x': 0xNN), octal (leading zero: 0NNN), or decimal. Use 'all' for all.

FilenamesAreUTF8=`boolean` — If set, samhain will check for invalid UTF-8 encoding and for filenames ending in invisible characters.

IgnoreAdded=`path_regex`— Ignore if this file/directory is added/created.

IgnoreMissing=`path_regex`— Ignore if this file/directory is missing/deleted.

ReportOnlyOnce=`boolean` — Report only once on a modified file (yes).

ReportFullDetail=`boolean` — Report in full detail on modified files (no).

UseLocalTime=`boolean` — Report file timestamps in local time rather than GMT (no). Do not use this with Beltane.

ChecksumTest=`none/init/update/check` — The default action (default is none).

SetPrelinkPath=`path` — The path to the prelink binary (default is `/usr/sbin/prelink`).

SetPrelinkChecksum=`checksum` — The checksum of the prelink binary.

SetLogServer=`IP address` — The log server.

SetServerPort=`port number` — The port on the log server (defaults to the compiled-in port, which is 49777 unless redefined at compile time).

SetDatabasePath=`AUTO or /path`— Path to database (AUTO to tack hostname on compiled-in path).

DigestAlgo=`SHA1 or MD5` — Use SHA1 or MD5 instead of the TIGER checksum (default: TIGER192).

RedefReadOnly=`+XXX or -XXX` — Add or subtract test XXX from the ReadOnly policy.

RedefAttributes=`+XXX or -XXX` — Add or subtract test XXX from the Attributes policy.

RedefLogFiles=`+XXX or -XXX` — Add or subtract test XXX from the LogFiles policy.

RedefGrowingLogFiles=`-XXX or ~XXX` — Add or subtract test XXX from the GrowingLogFiles policy.

RedefIgnoreAll=`+XXX or -XXX` — Add or subtract test XXX from the IgnoreAll policy.

RedefIgnoreNone=`+XXX or -XXX` — Add or subtract test XXX from the IgnoreNone policy.

RedefUser0=`+XXX or -XXX` — Add or subtract test XXX from the User0 policy.

RedefUser1=`+XXX or -XXX` — Add or subtract test XXX from the User1 policy.

RedefUser2=`+XXX or -XXX` — Add or subtract test XXX from the User2 policy.

RedefUser3=`+XXX or -XXX` — Add or subtract test XXX from the User3 policy.

RedefUser4=`+XXX or -XXX` — Add or subtract test XXX from the User4 policy.

UseACLCheck=`boolean` — Check ACL policies for files.

UseSelinuxCheck=`boolean` — Check SELINUX attributes for files.

The following options are only relevant for the server:

SetUseSocket=`boolean` — If unset, do not open the command socket (server only). This socket allows to advise the server to transmit commands to clients as soon as they connect to the server next time.

SetSocketAllowUid=`UID` — Which user can connect to the command socket. The default is 0 (root).

SetSocketPassword=`password` — Password (max. 14 chars, no '@') for password-based authentication on the command socket (only if the OS does not support passing credentials via sockets).

SetChrootDir=`path` — If set, chroot to this directory (server only).

SetStripDomain=`boolean` — Whether to strip the domain from the client hostname when logging client messages (server only; default: yes).

SetClientFromAccept=`boolean` — If true, use client address as known to the communication layer. Else (default) use client name as claimed by the client, try to verify against the address known to the communication layer, and accept (with a warning message) even if this fails.

UseClientSeverity=`boolean` — If set to 'yes', don't assign a special severity (priority) to client messages.

UseClientClass=`boolean` — If set to 'yes', don't assign a special class to client messages.

SetServerPort=`port number` — The port that the server should use for listening (default is 49777).

SetServerInterface=`IP address` — The IP address (i.e. interface on multi-interface box) that the server should use for listening (default is all). Use INADDR_ANY to reset to all.

SeverityLookup=`severity` — Severity for name lookup errors when verifying (on the server side) that the socket peer matches the hostname claimed by the client. See the preceding option.

UseSeparateLogs=`boolean` — If true, messages from different clients will be logged to separate log files (the name of the client will be appended to the name of the main log file to construct the logfile name). Default: false.

SetClientTimeLimit=`seconds` — Time limit until next client message (server-only).

SetUDPActive=`boolean` — yule 1.2.8+: Listen on 514/udp (syslog). Default: false.

Remarks: (i) root and the effective user are always trusted. (ii) If no time server is given, the local host clock is used. (iii) If the path of the process image is given, the process image will be checksummed at startup and exit, and both checksums compared.

Prev | Home | Next
Database | Up | External