|
|
|
@ -53,73 +53,86 @@ default["ossec"]["syscheck"]["alert_new_files"] = 'yes'
|
|
|
|
|
default["ossec"]["syscheck"]["auto_ignore"] = 'no'
|
|
|
|
|
|
|
|
|
|
default["ossec"]["syscheck"]["directories"]['/bin'] = {
|
|
|
|
|
'report_changes' => 'no',
|
|
|
|
|
'realtime' => 'yes'
|
|
|
|
|
}
|
|
|
|
|
default["ossec"]["syscheck"]["directories"]['/boot'] = {
|
|
|
|
|
'report_changes' => 'no',
|
|
|
|
|
'realtime' => 'no'
|
|
|
|
|
'report_changes' => 'yes',
|
|
|
|
|
'realtime' => 'yes',
|
|
|
|
|
'check_all' => 'yes'
|
|
|
|
|
}
|
|
|
|
|
#default["ossec"]["syscheck"]["directories"]['/boot'] = {
|
|
|
|
|
# 'report_changes' => 'no',
|
|
|
|
|
# 'realtime' => 'no'
|
|
|
|
|
#}
|
|
|
|
|
default["ossec"]["syscheck"]["directories"]['/etc'] = {
|
|
|
|
|
'report_changes' => 'yes',
|
|
|
|
|
'realtime' => 'no'
|
|
|
|
|
}
|
|
|
|
|
default["ossec"]["syscheck"]["directories"]['/lib/lsb'] = {
|
|
|
|
|
'report_changes' => 'no',
|
|
|
|
|
'realtime' => 'yes'
|
|
|
|
|
}
|
|
|
|
|
default["ossec"]["syscheck"]["directories"]['/lib/modules'] = {
|
|
|
|
|
'report_changes' => 'no',
|
|
|
|
|
'realtime' => 'yes'
|
|
|
|
|
}
|
|
|
|
|
default["ossec"]["syscheck"]["directories"]['/lib/plymouth'] = {
|
|
|
|
|
'report_changes' => 'no',
|
|
|
|
|
'realtime' => 'yes'
|
|
|
|
|
}
|
|
|
|
|
default["ossec"]["syscheck"]["directories"]['/lib/security'] = {
|
|
|
|
|
'report_changes' => 'no',
|
|
|
|
|
'realtime' => 'yes'
|
|
|
|
|
}
|
|
|
|
|
default["ossec"]["syscheck"]["directories"]['/lib/terminfo'] = {
|
|
|
|
|
'report_changes' => 'no',
|
|
|
|
|
'realtime' => 'yes'
|
|
|
|
|
}
|
|
|
|
|
default["ossec"]["syscheck"]["directories"]['/lib/ufw'] = {
|
|
|
|
|
'report_changes' => 'no',
|
|
|
|
|
'realtime' => 'yes'
|
|
|
|
|
}
|
|
|
|
|
default["ossec"]["syscheck"]["directories"]['/lib/xtables'] = {
|
|
|
|
|
'report_changes' => 'no',
|
|
|
|
|
'realtime' => 'no'
|
|
|
|
|
}
|
|
|
|
|
default["ossec"]["syscheck"]["directories"]['/media'] = {
|
|
|
|
|
'report_changes' => 'no',
|
|
|
|
|
'realtime' => 'no'
|
|
|
|
|
'realtime' => 'yes',
|
|
|
|
|
'check_all' => 'yes'
|
|
|
|
|
}
|
|
|
|
|
#default["ossec"]["syscheck"]["directories"]['/lib/lsb'] = {
|
|
|
|
|
# 'report_changes' => 'no',
|
|
|
|
|
# 'realtime' => 'yes'
|
|
|
|
|
#}
|
|
|
|
|
#default["ossec"]["syscheck"]["directories"]['/lib/modules'] = {
|
|
|
|
|
# 'report_changes' => 'no',
|
|
|
|
|
# 'realtime' => 'yes'
|
|
|
|
|
#}
|
|
|
|
|
#default["ossec"]["syscheck"]["directories"]['/lib/plymouth'] = {
|
|
|
|
|
# 'report_changes' => 'no',
|
|
|
|
|
# 'realtime' => 'yes'
|
|
|
|
|
#}
|
|
|
|
|
#default["ossec"]["syscheck"]["directories"]['/lib/security'] = {
|
|
|
|
|
# 'report_changes' => 'no',
|
|
|
|
|
# 'realtime' => 'yes'
|
|
|
|
|
#}
|
|
|
|
|
#default["ossec"]["syscheck"]["directories"]['/lib/terminfo'] = {
|
|
|
|
|
# 'report_changes' => 'no',
|
|
|
|
|
# 'realtime' => 'yes'
|
|
|
|
|
#}
|
|
|
|
|
#default["ossec"]["syscheck"]["directories"]['/lib/ufw'] = {
|
|
|
|
|
# 'report_changes' => 'no',
|
|
|
|
|
# 'realtime' => 'yes'
|
|
|
|
|
#}
|
|
|
|
|
#default["ossec"]["syscheck"]["directories"]['/lib/xtables'] = {
|
|
|
|
|
# 'report_changes' => 'no',
|
|
|
|
|
# 'realtime' => 'no'
|
|
|
|
|
#}
|
|
|
|
|
#default["ossec"]["syscheck"]["directories"]['/media'] = {
|
|
|
|
|
# 'report_changes' => 'no',
|
|
|
|
|
# 'realtime' => 'no'
|
|
|
|
|
#}
|
|
|
|
|
default["ossec"]["syscheck"]["directories"]['/opt'] = {
|
|
|
|
|
'report_changes' => 'no',
|
|
|
|
|
'realtime' => 'no'
|
|
|
|
|
}
|
|
|
|
|
default["ossec"]["syscheck"]["directories"]['/root'] = {
|
|
|
|
|
'report_changes' => 'yes',
|
|
|
|
|
'realtime' => 'no'
|
|
|
|
|
}
|
|
|
|
|
default["ossec"]["syscheck"]["directories"]['/srv'] = {
|
|
|
|
|
'report_changes' => 'no',
|
|
|
|
|
'realtime' => 'no'
|
|
|
|
|
}
|
|
|
|
|
#default["ossec"]["syscheck"]["directories"]['/root'] = {
|
|
|
|
|
# 'report_changes' => 'yes',
|
|
|
|
|
# 'realtime' => 'no'
|
|
|
|
|
#}
|
|
|
|
|
#default["ossec"]["syscheck"]["directories"]['/srv'] = {
|
|
|
|
|
# 'report_changes' => 'no',
|
|
|
|
|
# 'realtime' => 'no'
|
|
|
|
|
#}
|
|
|
|
|
default["ossec"]["syscheck"]["directories"]['/sbin'] = {
|
|
|
|
|
'report_changes' => 'no',
|
|
|
|
|
'realtime' => 'yes'
|
|
|
|
|
}
|
|
|
|
|
default["ossec"]["syscheck"]["directories"]['/usr/'] = {
|
|
|
|
|
'report_changes' => 'yes',
|
|
|
|
|
'realtime' => 'yes'
|
|
|
|
|
'realtime' => 'yes',
|
|
|
|
|
'check_all' => 'yes'
|
|
|
|
|
}
|
|
|
|
|
default["ossec"]["syscheck"]["directories"]['/tmp'] = {
|
|
|
|
|
'report_changes' => 'no',
|
|
|
|
|
'realtime' => 'no'
|
|
|
|
|
#default["ossec"]["syscheck"]["directories"]['/usr/'] = {
|
|
|
|
|
# 'report_changes' => 'yes',
|
|
|
|
|
# 'realtime' => 'yes'
|
|
|
|
|
#}
|
|
|
|
|
default["ossec"]["syscheck"]["directories"]['/usr/bin'] = {
|
|
|
|
|
'report_changes' => 'yes',
|
|
|
|
|
'realtime' => 'yes',
|
|
|
|
|
'check_all' => 'yes'
|
|
|
|
|
}
|
|
|
|
|
default["ossec"]["syscheck"]["directories"]['/usr/sbin'] = {
|
|
|
|
|
'report_changes' => 'yes',
|
|
|
|
|
'realtime' => 'yes',
|
|
|
|
|
'check_all' => 'yes'
|
|
|
|
|
}
|
|
|
|
|
#default["ossec"]["syscheck"]["directories"]['/tmp'] = {
|
|
|
|
|
# 'report_changes' => 'no',
|
|
|
|
|
# 'realtime' => 'no'
|
|
|
|
|
#}
|
|
|
|
|
|
|
|
|
|
# Syscheck Ignore Files
|
|
|
|
|
default["ossec"]["syscheck"]["ignore"]['/etc/openvpn/openvpn-status.log'] = {}
|
|
|
|
@ -131,8 +144,8 @@ default["ossec"]["syscheck"]["ignore"]['/etc/mail/statistics'] = {}
|
|
|
|
|
default["ossec"]["syscheck"]["ignore"]['/etc/random-seed'] = {}
|
|
|
|
|
default["ossec"]["syscheck"]["ignore"]['/etc/adjtime'] = {}
|
|
|
|
|
default["ossec"]["syscheck"]["ignore"]['/etc/prelink.cache'] = {}
|
|
|
|
|
default["ossec"]["syscheck"]["ignore"]['/root/.bash_history'] = {}
|
|
|
|
|
default["ossec"]["syscheck"]["ignore"]['/root/.viminfo'] = {}
|
|
|
|
|
#default["ossec"]["syscheck"]["ignore"]['/root/.bash_history'] = {}
|
|
|
|
|
#default["ossec"]["syscheck"]["ignore"]['/root/.viminfo'] = {}
|
|
|
|
|
default["ossec"]["syscheck"]["ignore"]['/etc/dnscache/stats'] = {}
|
|
|
|
|
default["ossec"]["syscheck"]["ignore"]['/etc/dnscache/log'] = {}
|
|
|
|
|
default["ossec"]["syscheck"]["ignore"]['/etc/dnscache2/stats'] = {}
|
|
|
|
|