Checking the file system for SUID/SGID binaries

To compile with support for this option, use the configure option

./configure --with-suidcheck

If enabled, this will cause the samhain daemon to check the whole file system hierarchy for SUID/SGID files at user-defined intervals, and to report on any that are not included in the file database. Upon database initialization, all SUID/SGID files will automatically be included in the database. Excluded are nfs, proc, msdos, vfat, and iso9660 (CD-ROM) file systems, as well as file systems mounted with the 'nosuid' options (the latter is not supported on all OSes, but at least on Linux).

You can manually exclude one directory (see below); this should be used only for obscure problems (e.g.: /net/localhost on Solaris - the automounter will mirror the root directory twice, as '/net/localhost' and '/net/localhost/net/localhost', and any nfs file system in '/' will be labelled as ufs system in '/net/localhost/net/localhost' …).

NoteNOTE
 

The SUID check is very I/O expensive. Using 'nice' may not help, if the CPU is waiting for I/O all the time anyway. You can limit I/O with the SuidCheckFps=fps option (fps: files per second), and you can schedule execution at fixed times with SuidCheckSchedule=schedule.

The schedule should have the same syntax as a crontab entry (see crontab(5) and example below), with the following exceptions: (a) lists are not allowed, and (b) ranges of names are allowed. If a schedule is given, the SuidCheckInterval option will not take effect. You can specify a list of schedules with successive SuidCheckSchedule=... directives.

Configuration

This facility is configured in the SuidCheck section of the configuration file.

  [SuidCheck]  
  # activate (0 for switching off) 
  SuidCheckActive=1 
  # interval between checks (in seconds, default 7200)
  # SuidCheckInterval=86400 
  # scheduled check at 01:30 each night
  SuidCheckSchedule=30 1 * * * 
  # this is the severity (see the Section called Severity levels in the chapter called Configuration — Basic>) 
  SeveritySuidCheck=crit 
  # you may manually exclude one directory 
  SuidCheckExclude=/net/localhost
  # limit on files per seconds
  SuidCheckFps=250