diff options
| author | Mario Preksavec <mario at slackware dot hr> | 2016-10-14 13:46:35 +0700 |
|---|---|---|
| committer | Willy Sudiarto Raharjo <willysr@slackbuilds.org> | 2016-10-14 22:20:05 +0700 |
| commit | 0642251adaff342231ea8c8c7bbde22c09a33afe (patch) | |
| tree | a9d70b7fa8b05ac0900be5c13a6020a30fedf2e0 /system/ossec-agent/ossec-agent.conf | |
| parent | 5e6a573b5acb43f5f6f8432b6f49ec9e08463fe8 (diff) | |
| download | slackbuilds-0642251adaff342231ea8c8c7bbde22c09a33afe.tar.gz | |
system/ossec-agent: Added (Open Source Host-based IDS).
Signed-off-by: Willy Sudiarto Raharjo <willysr@slackbuilds.org>
Diffstat (limited to 'system/ossec-agent/ossec-agent.conf')
| -rw-r--r-- | system/ossec-agent/ossec-agent.conf | 105 |
1 files changed, 105 insertions, 0 deletions
diff --git a/system/ossec-agent/ossec-agent.conf b/system/ossec-agent/ossec-agent.conf new file mode 100644 index 0000000000..be938c59e5 --- /dev/null +++ b/system/ossec-agent/ossec-agent.conf @@ -0,0 +1,105 @@ +<!-- OSSEC Slackware example config --> +<!-- Written by Mario Preksavec <mario at slackware dot hr> --> + +<ossec_config> + <client> + <!-- Server IP address --> + <server-ip>127.0.0.1</server-ip> + </client> + + <syscheck> + <!-- Frequency that syscheck is executed -- default every 2 hours --> + <frequency>7200</frequency> + + <!-- Directories to check (perform all possible verifications) --> + <directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories> + <directories check_all="yes">/bin,/sbin,/boot</directories> + + <!-- Files/directories to ignore --> + <ignore>/etc/mtab</ignore> + <ignore>/etc/hosts.deny</ignore> + <ignore>/etc/mail/statistics</ignore> + <ignore>/etc/random-seed</ignore> + <ignore>/etc/adjtime</ignore> + <ignore>/etc/ntp/drift</ignore> + </syscheck> + + <rootcheck> + <!-- Local of the rootkit_files and rootkit_trojans files --> + <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files> + <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans> + <system_audit>/var/ossec/etc/shared/system_audit_rcl.txt</system_audit> + <system_audit>/var/ossec/etc/shared/cis_debian_linux_rcl.txt</system_audit> + <system_audit>/var/ossec/etc/shared/cis_rhel_linux_rcl.txt</system_audit> + <system_audit>/var/ossec/etc/shared/cis_rhel5_linux_rcl.txt</system_audit> + <system_audit>/var/ossec/etc/shared/cis_rhel6_linux_rcl.txt</system_audit> + <system_audit>/var/ossec/etc/shared/cis_rhel7_linux_rcl.txt</system_audit> + </rootcheck> + + <!-- Files to monitor (localfiles) --> + + <localfile> + <log_format>syslog</log_format> + <location>/var/log/messages</location> + </localfile> + + <localfile> + <log_format>syslog</log_format> + <location>/var/log/syslog</location> + </localfile> + + <localfile> + <log_format>syslog</log_format> + <location>/var/log/debug</location> + </localfile> + + <localfile> + <log_format>syslog</log_format> + <location>/var/log/secure</location> + </localfile> + + <localfile> + <log_format>syslog</log_format> + <location>/var/log/cron</location> + </localfile> + + <localfile> + <log_format>syslog</log_format> + <location>/var/log/maillog</location> + </localfile> + + <localfile> + <log_format>syslog</log_format> + <location>/var/log/spooler</location> + </localfile> + + <localfile> + <log_format>apache</log_format> + <location>/var/log/httpd/access_log</location> + </localfile> + + <localfile> + <log_format>apache</log_format> + <location>/var/log/httpd/error_log</location> + </localfile> + + <localfile> + <log_format>command</log_format> + <command>df -h</command> + </localfile> + + <localfile> + <log_format>full_command</log_format> + <command>netstat -tan | grep LISTEN | grep -v 127.0.0.1 | sort</command> + </localfile> + + <localfile> + <log_format>full_command</log_format> + <command>last -n 5</command> + </localfile> + + <localfile> + <log_format>full_command</log_format> + <command>lastb -n 5</command> + </localfile> +</ossec_config> |