Checking for SUID/SGID files

Samhain
Prev | Appendix C. List of configuration file options | Next

# C.7. Checking for SUID/SGID files

Section heading:

[SuidCheck]

Entries:

SuidCheckActive=`boolean` — '1' to switch on, '0' to switch off.

SuidCheckExclude=`path` — A directory (and its subdirectories) to exclude from the check. Only one directory can be specified this way.

SuidCheckSchedule=`schedule` — Crontab-like schedule for checks.

SeveritySuidCheck=`severity` — Severity for events.

SuidCheckFps=`fps` — Limit files per seconds for SUID check.

SuidCheckNosuid=`boolean` — Check filesystems mounted as nosuid. Defaults to not.

SuidCheckQuarantineFiles=`boolean` — Whether to quarantine files. Defaults to not.

SuidCheckQuarantineMethod=`0|1|2` — Quarantine method. Delete = 1, remove suid/sgid flags = 1, move to quarantine directory = 2. Defaults to 1 (remove suid/sgid flags).

SuidCheckQuarantineDelete=`boolean` — Whether to delete rather than truncate, if method 0 (delete) is chosen. Default is truncate.

Prev | Home | Next
Checking for kernel module rootkits | Up | Checking for mount options