Checking sensitive files owned by users

Samhain
Prev | Chapter 5. Configuring samhain, the file monitor | Next

# 5.13. Checking sensitive files owned by users

To compile with support for this option, use the configure option

./configure --enable-userfiles

samhain can be compiled to support checking of files that are specified as being relative to the a user's home directory. It is intended to detect interference with files that influence process behaviour such as `.profile` It simply adds the appropriate file entries to the main samhain list, at the specified alerting level.

      [UserFiles]
      #
      # Activate (0 is off).
      #
      UserfilesActive=1

      #
      # Files to check for under each $HOME
      # A specific level can be specified.
      # The allowed values are:
      # allignore
      # attributes
      # logfiles
      # loggrow
      # noignore
      # readonly
      # user0
      # user1
      # user2
      # user3
      # user4
      #
      # The default is noignore
      #
      UserfilesName=.login noignore
      UserfilesName=.profile readonly
      UserfilesName=.ssh/authorized_keys
      #
      # A list of UIDs where we want to check.
      # The default is all.
      # IF THERE IS AN OPEN RANGE, IT MUST BE LAST
      #
      UserfilesCheckUids=0,100-500,1000-

This module by the eircom.net Computer Incident Response Team.

Prev | Home | Next
Checking mounted filesystem policies | Up | Checking for hidden/fake/missing processes