Defining which files/directories to monitor

This section explains how to specify in the configuration file, which files or directories should be monitored, and which monitoring policy should be used.

Monitoring policies

samhain offers several pre-defined monitoring policies. Each of these policies has its own section in the configuration file. Placing a file in one of these sections will select the respective policy for that file.

The available policies (section headings) are:

NoteNOTE
 

Each policy can be modified in the config file section Misc with entries like RedefReadOnly=+XXX or RedefReadOnly=-XXX to add (+XXX) or remove (-XXX) a test XXX, where XXX can be any of CHK (checksum), LNK (link), HLN (hardlink), INO (inode), USR (user), GRP (group), MTM (mtime), ATM (atime), CTM (ctime), SIZ (size), RDEV (device numbers) and/or MOD (file mode).

This must come before any file policies are used in the config file.

File/directory specification

Entries for files have the following syntax:

file=/full/path/to/the/file

Entries for directories have the following syntax:

dir=[recursion depth]/full/path/to/the/dir

The specification of a (numerical) recursion depth is optional (see the Section called Recursion depth(s)>). (Do not put the recursion depth in brackets -- they just indicate that this is an optional argument ...).

Wildcard patterns ('*', '?', '[...]') as in shell globbing are supported for paths. The leading '/' is mandatory.

All except …

To exclude individual files from a directory, place them under the policy IgnoreAll. Note that the existence of such files will still be checked (see next section).

To exclude subdirectories from a directory, place them under the policy IgnoreAll with an individual recursion depth of -1 (see the Section called Recursion depth(s)>).

NoteNOTE
 

Changes in a directory may also modify the directory inode itself (i.e. the special file that holds the directory information). If you want to check all but a few files in a directory (say, /etc), and you expect some of the excluded files to get modified, you should use a setup like:

  [ReadOnly] 
  #  
  dir=/etc
  # 
  [Attributes]  
  #  
  # less restrictive policy for the directory file itself
  #  
  file=/etc
  # 
  [IgnoreAll]  
  #  
  # exclude this file
  # 
  file=/etc/resolv.conf.save
  # 

Suppress messages about new/deleted files

If you want to suppress messages about the creation of certain files (e.g. rotated log files), you can use the options IgnoreAdded=regexp and/or IgnoreMissing=regexp (to be placed in the [Misc] section of the configuration files. If you want to add more regular expressions, you can use these options multiple times.

Dynamic database update (modified/disappeared/new files)

samhain reads the file signature database at startup and creates an in-memory copy. This in-memory copy is then dynamically updated to reflect changes in the file system.

I.e. for each modified/disappeared/new file you will receive an alarm, then the in-memory copy of the file signature database is updated, and you will only receive another alarm for that file if it is modified again (or disappears/appears again).

Note that the on-disk file signature database is not updated (if you have signed it, the daemon could not do that anyway). However, as long as the machine is not rebooted, there should be no need to update the on-disk file signature database.

If files disappear after initialization, you will get an error message with the severity specified for file access errors (except if the file is placed under the IgnoreAll policy, in which case a message of SeverityIgnoreAll — see the Section called Severity levels in the chapter called Configuration — Basic> — is generated).

If new files appear in a monitored directory after initialization, you will get an error message with the severity specified for that directory's file policy (except if the file is placed under the IgnoreAll policy, in which case a message of SeverityIgnoreAll — see the Section called Severity levels in the chapter called Configuration — Basic> — is generated).

The special treatment of files under the IgnoreAll policy allows to handle cases where a file might be deleted and/or recreated by the system more or less frequently.

Recursion depth(s)

Directories can be monitored up to a maximum recursion depth of 99 (i.e. 99 levels of subdirectories. The recursion depth actually used is defined in the following order of priority:

  1. The recursion depth specified for that individual directory (the Section called Defining which files/directories to monitor>). As a special case, for directories with the policy IgnoreAll, the recursion depth should be set to 0, if you want to monitor (the existence of) the files within that directory, but to -1, if you do not want samhain to look into that directory.

  2. The global default recursion depth specified in the configuration file. This is done in the configuration file section Misc with the entry SetRecursionLevel=number

  3. The default recursion depth, which is zero.

Codes in messages about reported files

As of version 1.8.2, reports about modified files include a short code in the message field to describe which properties have been modified. The codes are: 'C' for 'checksum', 'L' for (soft) 'link', 'D' for 'device number', 'I' for 'inode', 'H' for (number of) 'hardlinks', 'M' for 'mode', 'U' for 'user' (owner), 'G' for 'group' (owner), 'T' for 'time' (any), and finally 'S' for 'size'.

As an example, 'C--I----TS' would indicate that a file has been replaced by one with different checksum, inode, timestamp, and size, but (e.g.) same mode (type and access permissions) and same ownership.