diff options
| -rw-r--r-- | roles/common/files/etc/rkhunter.conf | 1355 | ||||
| -rw-r--r-- | roles/common/tasks/rkhunter.yml | 2 |
2 files changed, 802 insertions, 555 deletions
diff --git a/roles/common/files/etc/rkhunter.conf b/roles/common/files/etc/rkhunter.conf index 542fcfd..9306631 100644 --- a/roles/common/files/etc/rkhunter.conf +++ b/roles/common/files/etc/rkhunter.conf @@ -1,220 +1,309 @@ # # This is the main configuration file for Rootkit Hunter. # -# You can either modify this file directly, or you can create a local -# configuration file. The local file must be named 'rkhunter.conf.local', -# and must reside in the same directory as this file. Please modify one -# or both files to your own requirements. It is suggested that the -# command 'rkhunter -C' is run after any changes have been made. +# You can modify this file directly, or you can create a local configuration +# file. The local file must be named 'rkhunter.conf.local', and must reside +# in the same directory as this file. Alternatively you can create a directory, +# named 'rkhunter.d', which also must be in the same directory as this +# configuration file. Within the 'rkhunter.d' directory you can place further +# configuration files. There is no restriction on the file names used, other +# than they must end in '.conf'. +# +# Please modify the configuration file(s) to your own requirements. It is +# recommended that the command 'rkhunter -C' is run after any changes have +# been made. # # Please review the documentation before posting bug reports or questions. -# To report bugs, obtain updates, or provide patches or comments, please go to: -# http://rkhunter.sourceforge.net +# To report bugs, obtain updates, or provide patches or comments, please go +# to: http://rkhunter.sourceforge.net # -# To ask questions about rkhunter, please use the rkhunter-users mailing list. -# Note this is a moderated list: please subscribe before posting. +# To ask questions about rkhunter, please use the 'rkhunter-users' mailing list. +# Note that this is a moderated list, so please subscribe before posting. # -# Lines beginning with a hash (#), and blank lines, are ignored. -# End-of-line comments are not supported. +# In the configuration files, lines beginning with a hash (#), and blank lines, +# are ignored. Also, end-of-line comments are not supported. # -# Most of the following options need only be specified once. If -# they appear more than once, then the last one seen will be used. -# Some options are allowed to appear more than once, and the text -# describing the option will say if this is so. +# Any of the configuration options may appear more than once. However, several +# options only take one value, and so the last one seen will be used. Some +# options are allowed to appear more than once, and the text describing the +# option will say if this is so. These configuration options will, in effect, +# have their values concatenated together. To delete a previously specified +# option list, specify the option with no value (that is, a null string). # -# Some of the options are space-separated lists of pathnames. If -# wildcard characters (globbing) are allowed in the list, then the +# Some of the options are space-separated lists, others, typically those +# specifying pathnames, are newline-separated lists. These must be entered +# as one item per line. Quotes must not be used to surround the pathname. +# +# For example, to specify two pathnames, '/tmp/abc' and '/tmp/xyz', for an +# option: XXX=/tmp/abc (correct) +# XXX=/tmp/xyz +# +# XXX="/tmp/abc" (incorrect) +# XXX="/tmp/xyz" +# +# XXX=/tmp/abc /tmp/xyz (incorrect) +# or XXX="/tmp/abc /tmp/xyz" (incorrect) +# or XXX="/tmp/abc" "/tmp/xyz" (incorrect) +# +# The last three examples are being configured as space-separated lists, +# which is incorrect, generally, for options specifying pathnames. They +# should be configured with one entry per line as in the first example. +# +# If wildcard characters (globbing) are allowed for an option, then the # text describing the option will say so. # -# Space-separated lists may be enclosed by quotes, but these must only -# appear at the start and end of the list, not in the middle. +# Space-separated lists may be enclosed by quotes, although they are not +# required. If they are used, then they must only appear at the start and +# end of the list, not in the middle. +# +# For example: XXX=abc def gh (correct) +# XXX="abc def gh" (correct) +# XXX="abc" "def" "gh" (incorrect) # -# For example: XXX="abc def gh" (correct) -# XXX="abc" "def" "gh" (incorrect) +# Space-separated lists may also be entered simply as one entry per line. +# +# For example: XXX=abc (correct) +# XXX=def +# XXX="gh" +# +# If a configuration option is never set, then the program will assume a +# default value. The text describing the option will state the default value. +# If there is no default, then rkhunter will calculate a value or pathname +# to use. # # -# If this option is set to 1, it specifies that the mirrors file +# If this option is set to '1', it specifies that the mirrors file # ('mirrors.dat'), which is used when the '--update' and '--versioncheck' -# options are used, is to be rotated. Rotating the entries in the file -# allows a basic form of load-balancing between the mirror sites whenever -# the above options are used. -# If the option is set to 0, then the mirrors will be treated as if in -# a priority list. That is, the first mirror listed will always be used -# first. The second mirror will only be used if the first mirror fails, -# the third mirror will only be used if the second mirror fails, and so on. +# options are used, is to be rotated. Rotating the entries in the file allows +# a basic form of load-balancing between the mirror sites whenever the above +# options are used. +# +# If the option is set to '0', then the mirrors will be treated as if in a +# priority list. That is, the first mirror listed will always be used first. +# The second mirror will only be used if the first mirror fails, the third +# mirror will only be used if the second mirror fails, and so on. # # If the mirrors file is read-only, then the '--versioncheck' command-line -# option can only be used if this option is set to 0. +# option can only be used if this option is set to '0'. +# +# The default value is '1'. # -ROTATE_MIRRORS=1 +#ROTATE_MIRRORS=1 # -# If this option is set to 1, it specifies that when the '--update' -# option is used, then the mirrors file is to be checked for updates -# as well. If the current mirrors file contains any local mirrors, -# these will be prepended to the updated file. -# If this option is set to 0, the mirrors file can only be updated -# manually. This may be useful if only using local mirrors. +# If this option is set to '1', it specifies that when the '--update' option is +# used, then the mirrors file is to be checked for updates as well. If the +# current mirrors file contains any local mirrors, these will be prepended to +# the updated file. If this option is set to '0', the mirrors file can only be +# updated manually. This may be useful if only using local mirrors. +# +# The default value is '1'. # -UPDATE_MIRRORS=1 +#UPDATE_MIRRORS=1 # -# The MIRRORS_MODE option tells rkhunter which mirrors are to be -# used when the '--update' or '--versioncheck' command-line options -# are given. Possible values are: -# 0 - use any mirror (the default) +# The MIRRORS_MODE option tells rkhunter which mirrors are to be used when +# the '--update' or '--versioncheck' command-line options are given. +# Possible values are: +# 0 - use any mirror # 1 - only use local mirrors # 2 - only use remote mirrors # -# Local and remote mirrors can be defined in the mirrors file -# by using the 'local=' and 'remote=' keywords respectively. +# Local and remote mirrors can be defined in the mirrors file by using the +# 'local=' and 'remote=' keywords respectively. +# +# The default value is '0'. # -MIRRORS_MODE=0 +#MIRRORS_MODE=0 # -# Email a message to this address if a warning is found when the -# system is being checked. Multiple addresses may be specified -# simply be separating them with a space. Setting this option to -# null disables the option. +# Email a message to this address if a warning is found when the system is +# being checked. Multiple addresses may be specified simply be separating +# them with a space. To disable the option, simply set it to the null string +# or comment it out. # -# NOTE: This option should be present in the configuration file. +# The option may be specified more than once. +# +# The default value is the null string. +# +# Also see the MAIL_CMD option. # -#MAIL-ON-WARNING=me@mydomain root@mydomain MAIL-ON-WARNING=admin@fripost.org # -# Specify the mail command to use if MAIL-ON-WARNING is set. +# This option specifies the mail command to use if MAIL-ON-WARNING is set. # -# NOTE: Double quotes are not required around the command, but -# are required around the subject line if it contains spaces. +# NOTE: Double quotes are not required around the command, but are required +# around the subject line if it contains spaces. # -MAIL_CMD=mail -s "[rkhunter] Warnings found for ${HOST_NAME}" +# The default is to use the 'mail' command, with a subject line +# of '[rkhunter] Warnings found for ${HOST_NAME}'. +# +#MAIL_CMD=mail -s "[rkhunter] Warnings found for ${HOST_NAME}" # -# Specify the temporary directory to use. +# This option specifies the directory to use for temporary files. +# +# NOTE: Do not use '/tmp' as your temporary directory. Some important files +# will be written to this directory, so be sure that the directory permissions +# are secure. # -# NOTE: Do not use /tmp as your temporary directory. Some -# important files will be written to this directory, so be -# sure that the directory permissions are tight. +# The installer program will set the default directory. If this default is +# subsequently commented out or removed, then the program will assume a +# default directory beneath the installation directory. # TMPDIR=/var/lib/rkhunter/tmp # -# Specify the database directory to use. +# This option specifies the database directory to use. +# +# The installer program will set the default directory. If this default is +# subsequently commented out or removed, then the program will assume a +# default directory beneath the installation directory. # DBDIR=/var/lib/rkhunter/db # -# Specify the script directory to use. +# This option specifies the script directory to use. +# +# The installer program will set the default directory. If this default is +# subsequently commented out or removed, then the program will not run. # SCRIPTDIR=/usr/share/rkhunter/scripts # -# This option can be used to modify the command directory list used -# by rkhunter to locate commands (that is, its PATH). By default -# this will be the root PATH, and an internal list of some common -# command directories. +# This option can be used to modify the command directory list used by rkhunter +# to locate commands (that is, its PATH). By default this will be the root PATH, +# and an internal list of some common command directories. +# +# Any directories specified here will, by default, be appended to the default +# list. However, if a directory name begins with the '+' character, then that +# directory will be prepended to the list (that is, it will be put at the start +# of the list). # -# Any directories specified here will, by default, be appended to the -# default list. However, if a directory name begins with the '+' -# character, then that directory will be prepended to the list (that -# is, it will be put at the start of the list). +# This is a space-separated list of directory names. The option may be +# specified more than once. # -# This is a space-separated list of directory names. The option may -# be specified more than once. +# The default value is based on the root account PATH environment variable. # -#BINDIR="/bin /usr/bin /sbin /usr/sbin" -#BINDIR="+/usr/local/bin +/usr/local/sbin" +#BINDIR=/bin /usr/bin /sbin /usr/sbin +#BINDIR=+/usr/local/bin +/usr/local/sbin # -# Specify the default language to use. This should be similar -# to the ISO 639 language code. +# This option specifies the default language to use. This should be similar to +# the ISO 639 language code. # # NOTE: Please ensure that the language you specify is supported. # For a list of supported languages use the following command: # # rkhunter --lang en --list languages # +# The default language is 'en' (English). +# #LANGUAGE=en # -# This option is a space-separated list of the languages that are to -# be updated when the '--update' option is used. If unset, then all -# the languages will be updated. If none of the languages are to be -# updated, then set this option to just 'en'. +# This option is a space-separated list of the languages that are to be updated +# when the '--update' option is used. If unset, then all the languages will be +# updated. If none of the languages are to be updated, then set this option to +# just 'en'. +# +# The default language, specified by the LANGUAGE option, and the English (en) +# language file will always be updated regardless of this option. +# +# This option may be specified more than once. # -# The default is for all the languages to be updated. The default -# language, specified above, and the English (en) language file will -# always be updated regardless of this option. +# The default value is the null string, indicating that all the language files +# will be updated. # -UPDATE_LANG="" +#UPDATE_LANG="" # -# Specify the log file pathname. +# This option specifies the log file pathname. The file will be created if it +# does not initially exist. If the option is unset, then the program will +# display a message each time it is run saying that the default value is being +# used. # -# NOTE: This option should be present in the configuration file. +# The default value is '/var/log/rkhunter.log'. # LOGFILE=/var/log/rkhunter.log # -# Set the following option to 1 if the log file is to be appended to -# whenever rkhunter is run. +# Set this option to '1' if the log file is to be appended to whenever rkhunter +# is run. A value of '0' will cause a new log file to be created whenever the +# program is run. # -APPEND_LOG=0 +# The default value is '0'. +# +#APPEND_LOG=0 # -# Set the following option to 1 if the log file is to be copied when -# rkhunter finishes and an error or warning has occurred. The copied -# log file name will be appended with the current date and time -# (in YYYY-MM-DD_HH:MM:SS format). +# Set the following option to '1' if the log file is to be copied when rkhunter +# finishes and an error or warning has occurred. The copied log file name will +# be appended with the current date and time (in YYYY-MM-DD_HH:MM:SS format). # For example: rkhunter.log.2009-04-21_00:57:51 +# If the option value is '0', then the log file will not be copied regardless +# of whether any errors or warnings occurred. +# +# The default value is '0'. # -COPY_LOG_ON_ERROR=0 +#COPY_LOG_ON_ERROR=0 # -# Set the following option to enable the rkhunter check start and finish -# times to be logged by syslog. Warning messages will also be logged. -# The value of the option must be a standard syslog facility and -# priority, separated by a dot. For example: +# Set the following option to enable the rkhunter check start and finish times +# to be logged by syslog. Warning messages will also be logged. The value of +# the option must be a standard syslog facility and priority, separated by a +# dot. For example: # # USE_SYSLOG=authpriv.warning # -# Setting the value to 'none', or just leaving the option commented out, +# Setting the value to 'NONE', or just leaving the option commented out, # disables the use of syslog. # +# The default value is not to use syslog. +# #USE_SYSLOG=authpriv.notice # -# Set the following option to 1 if the second colour set is to be used. -# This can be useful if your screen uses black characters on a white -# background (for example, a PC instead of a server). +# Set the following option to '1' if the second colour set is to be used. This +# can be useful if your screen uses black characters on a white background +# (for example, a PC instead of a server). A value of '0' will cause the default +# colour set to be used. # -COLOR_SET2=0 +# The default value is '0'. +# +#COLOR_SET2=0 # -# Set the following option to 0 if rkhunter should not detect if X is -# being used. If X is detected as being used, then the second colour -# set will automatically be used. +# Set the following option to '0' if rkhunter should not detect if X is being +# used. If X is detected as being used, then the second colour set will +# automatically be used. If set to '1', then the use of X will be detected. +# +# The default value is '0'. # AUTO_X_DETECT=1 # -# Set the following option to 1 if it is wanted that any 'Whitelisted' -# results are shown in white rather than green. For colour set 2 users, -# setting this option will cause the result to be shown in black. +# Set the following option to '1' if it is wanted that any 'Whitelisted' results +# are shown in white rather than green. For colour set 2 users, setting this +# option will cause the result to be shown in black. Setting the option to '0' +# causes whitelisted results to be displayed in green. +# +# The default value is '0'. # -WHITELISTED_IS_WHITE=0 +#WHITELISTED_IS_WHITE=0 # # The following option is checked against the SSH configuration file -# 'PermitRootLogin' option. A warning will be displayed if they do not -# match. However, if a value has not been set in the SSH configuration -# file, then a value here of 'unset' can be used to avoid warning messages. -# This option has a default value of 'no'. +# 'PermitRootLogin' option. A warning will be displayed if they do not match. +# However, if a value has not been set in the SSH configuration file, then a +# value here of 'unset' can be used to avoid warning messages. # -ALLOW_SSH_ROOT_USER=no +# The default value is 'no'. +# +#ALLOW_SSH_ROOT_USER=no # # Set this option to '1' to allow the use of the SSH-1 protocol, but note @@ -223,103 +312,107 @@ ALLOW_SSH_ROOT_USER=no # to use the SSH-1 protocol (for instance for AFS token passing or Kerberos4 # authentication). If the 'Protocol' option has not been set in the SSH # configuration file, then a value of '2' may be set here in order to -# suppress a warning message. This option has a default value of '0'. +# suppress a warning message. A value of '0' indicates that the use of +# SSH-1 is not allowed. +# +# The default value is '0'. # -ALLOW_SSH_PROT_V1=0 +#ALLOW_SSH_PROT_V1=0 # # This setting tells rkhunter the directory containing the SSH configuration # file. This setting will be worked out by rkhunter, and so should not # usually need to be set. # +# This option has no default value. +# #SSH_CONFIG_DIR=/etc/ssh # -# These two options determine which tests are to be performed. -# The ENABLE_TESTS option can use the word 'all' to refer to all the -# available tests. The DISABLE_TESTS option can use the word 'none' to -# mean that no tests are disabled. The list of disabled tests is applied to -# the list of enabled tests. Both options are space-separated lists of test -# names. The currently available test names can be seen by using the command -# 'rkhunter --list tests'. +# These two options determine which tests are to be performed. The ENABLE_TESTS +# option can use the word 'ALL' to refer to all of the available tests. The +# DISABLE_TESTS option can use the word 'NONE' to mean that no tests are +# disabled. The list of disabled tests is applied to the list of enabled tests. # -# The program defaults are to enable all tests and disable none. However, if -# either of the options below are specified, then they will override the -# program defaults. +# Both options are space-separated lists of test names, and both options may +# be specified more than once. The currently available test names can be seen +# by using the command 'rkhunter --list tests'. # # The supplied configuration file has some tests already disabled, and these -# are tests that will be used only occasionally, can be considered -# "advanced" or that are prone to produce more than the average number of -# false-positives. +# are tests that will be used only occasionally, can be considered 'advanced' +# or that are prone to produce more than the average number of false-positives. # # Please read the README file for more details about enabling and disabling # tests, the test names, and how rkhunter behaves when these options are used. # -# hidden_procs test requires the unhide command which is part of the unhide -# package in Debian. +# The default values are to enable all tests and to disable none. However, if +# either of the options below are specified, then they will override the +# program defaults. +# +# hidden_procs test requires the unhide and/or unhide.rb commands which are +# part of the unhide respectively unhide.rb packages in Debian. # -# apps test is disabled by default as it triggers warnings about outdated +# apps test is disabled by default as it triggers warnings about outdated # applications (and warns about possible security risk: we better trust # the Debian Security Team). # -ENABLE_TESTS="all" -DISABLE_TESTS="suspscan hidden_procs deleted_files packet_cap_apps apps" +ENABLE_TESTS=ALL +DISABLE_TESTS=suspscan hidden_procs deleted_files packet_cap_apps apps # -# The HASH_FUNC option can be used to specify the command to use -# for the file hash value check. It can be specified as just the -# command name or the full pathname. If just the command name is -# given, and it is one of MD5, SHA1, SHA224, SHA256, SHA384 or -# SHA512, then rkhunter will first look for the relevant command, -# such as 'sha256sum', and then for 'sha256'. If neither of these -# are found, it will then look to see if a perl module has been -# installed which will support the relevant hash function. To see -# which perl modules have been installed use the command -# 'rkhunter --list perl'. -# -# The default is SHA1, or MD5 if SHA1 cannot be found. +# The HASH_CMD option can be used to specify the command to use for the file +# properties hash value check. It can be specified as just the command name or +# the full pathname. If just the command name is given, and it is one of MD5, +# SHA1, SHA224, SHA256, SHA384 or SHA512, then rkhunter will first look for the +# relevant command, such as 'sha256sum', and then for 'sha256'. If neither of +# these are found, it will then look to see if a perl module has been installed +# which will support the relevant hash function. To see which perl modules have +# been installed use the command 'rkhunter --list perl'. # -# Systems using prelinking are restricted to using either the -# SHA1 or MD5 function. +# Systems using prelinking are restricted to using either the SHA1 or MD5 +# function. # -# A value of 'NONE' (in uppercase) can be specified to indicate that -# no hash function should be used. Rootkit Hunter will detect this and -# automatically disable the file hash checks. +# A value of 'NONE' (in uppercase) can be specified to indicate that no hash +# function should be used. Rkhunter will detect this, and automatically disable +# the file properties hash check test. # # Examples: -# For Solaris 9 : HASH_FUNC=gmd5sum -# For Solaris 10: HASH_FUNC=sha1sum -# For AIX (>5.2): HASH_FUNC="csum -hMD5" -# For NetBSD : HASH_FUNC="cksum -a sha512" +# For Solaris 9 : HASH_CMD=gmd5sum +# For Solaris 10: HASH_CMD=sha1sum +# For AIX (>5.2): HASH_CMD="csum -hMD5" +# For NetBSD : HASH_CMD="cksum -a sha512" # -# NOTE: If the hash function is changed then you MUST run rkhunter with -# the '--propupd' option to rebuild the file properties database. +# NOTE: Whenever this option is changed 'rkhunter --propupd' must be run. # -HASH_FUNC=sha512sum +# The default value is the SHA1 function, or MD5 if SHA1 cannot be found. +# +# Also see the HASH_FLD_IDX option. +# +HASH_CMD=sha512sum # -# The HASH_FLD_IDX option specifies which field from the HASH_FUNC -# command output contains the hash value. The fields are assumed to -# be space-separated. The default value is 1, but for *BSD users -# rkhunter will, by default, use a value of 4 if the HASH_FUNC option -# has not been set. The option value must be an integer greater -# than zero. +# The HASH_FLD_IDX option specifies which field from the HASH_CMD command +# output contains the hash value. The fields are assumed to be space-separated. +# +# The option value must be an integer greater than zero. +# +# The default value is '1', but for *BSD users rkhunter will, by default, use a +# value of '4' if the HASH_CMD option has not been set. # #HASH_FLD_IDX=4 # -# The PKGMGR option tells rkhunter to use the specified package manager -# to obtain the file property information. This is used when updating -# the file properties file ('rkhunter.dat'), and when running the file -# properties check. For RedHat/RPM-based systems, 'RPM' can be used to -# get information from the RPM database. For Debian-based systems 'DPKG' -# can be used, for *BSD systems 'BSD' can be used, and for Solaris -# systems 'SOLARIS' can be used. No value, or a value of 'NONE', -# indicates that no package manager is to be used. The default is 'NONE'. +# The PKGMGR option tells rkhunter to use the specified package manager to +# obtain the file property information. This is used when updating the file +# properties file ('rkhunter.dat'), and when running the file properties check. +# For RedHat/RPM-based systems, 'RPM' can be used to get information from the +# RPM database. For Debian-based systems 'DPKG' can be used, for *BSD systems +# 'BSD' can be used, and for Solaris systems 'SOLARIS' can be used. No value, +# or a value of 'NONE', indicates that no package manager is to be used. # -# The current package managers, except 'SOLARIS', store the file hash -# values using an MD5 hash function. The Solaris package manager includes -# a checksum value, but this is not used by default (see USE_SUNSUM below). +# The current package managers, except 'SOLARIS', store the file hash values +# using an MD5 hash function. The Solaris package manager includes a checksum +# value, but this is not used by default (see USE_SUNSUM below). # # The 'DPKG' and 'BSD' package managers only provide MD5 hash values. # The 'RPM' package manager additionally provides values for the inode, @@ -327,9 +420,13 @@ HASH_FUNC=sha512sum # most of the values, similar to 'RPM', but not the inode number. # # For any file not part of a package, rkhunter will revert to using the -# HASH_FUNC hash function instead. +# HASH_CMD hash function instead. +# +# NOTE: Whenever this option is changed 'rkhunter --propupd' must be run. +# +# The default value is 'NONE'. # -# Whenever this option is changed 'rkhunter --propupd' must be run. +# Also see the PKGMGR_NO_VRFY and USE_SUNSUM options. # # NONE is the default for Debian as well, as running --propupd takes # about 4 times longer when it's set to DPKG @@ -337,286 +434,303 @@ HASH_FUNC=sha512sum #PKGMGR=NONE # -# It is possible that a file which is part of a package may be modified -# by the administrator. Typically this occurs for configuration files. -# However, the package manager may list the file as being modified. For -# the RPM package manager this may well depend on how the package was -# built. This option specifies those pathnames which are to be exempt -# from the package manager verification process, and which will be treated -# as non-packaged files. As such, the file properties are still checked. +# It is possible that a file, which is part of a package, may have been +# modified by the administrator. Typically this occurs for configuration +# files. However, the package manager may list the file as being modified. +# For the RPM package manager this may well depend on how the package was +# built. This option specifies a pathname which is to be exempt from the +# package manager verification process, and which will be treated +# as a non-packaged file. As such, the file properties are still checked. # # This option only takes effect if the PKGMGR option has been set, and # is not 'NONE'. # -# This is a space-separated list of pathnames. The option may -# be specified more than once. +# This option may be specified more than once. # -# Whenever this option is changed 'rkhunter --propupd' must be run. +# NOTE: Whenever this option is changed 'rkhunter --propupd' must be run. +# +# The default value is the null string. # #PKGMGR_NO_VRFY="" # -# This option can be used to tell rkhunter to ignore any prelink -# dependency errors for the given commands. However, a warning will also -# be issued if the error does not occur for a given command. As such -# this option must only be used on commands which experience a persistent -# problem. +# If the 'SOLARIS' package manager is used, then it is possible to use the +# checksum (hash) value stored for a file. However, this is only a 16-bit +# checksum, and as such is not nearly as secure as, for example, a SHA-2 value. +# If the option is set to '0', then the checksum is not used and the hash +# function given by HASH_CMD is used instead. To enable this option, set its +# value to '1'. The Solaris 'sum' command must be present on the system if this +# option is used. +# +# The default value is '0'. +# +#USE_SUNSUM=0 + +# +# This option can be used to tell rkhunter to ignore any prelink dependency +# errors for the given commands. However, a warning will also be issued if the +# error does not occur for a given command. As such this option must only be +# used on commands which experience a persistent problem. # # Short-term prelink dependency errors can usually be resolved simply by # running the 'prelink' command on the given pathname. # -# NOTE: The command 'rkhunter --propupd' must be run whenever this option -# is changed. -# # This is a space-separated list of command pathnames. The option can be # specified more than once. # -#IGNORE_PRELINK_DEP_ERR="/bin/ps /usr/bin/top" - +# NOTE: Whenever this option is changed 'rkhunter --propupd' must be run. # -# If the 'SOLARIS' package manager is used, then it is possible to use -# the checksum (hash) value stored for a file. However, this is only a -# 16-bit checksum, and as such is not nearly as secure as, for example, -# a SHA-2 value. For that reason, the checksum is not used by default, -# and the hash function given by HASH_FUNC is used instead. To enable -# this option, set its value to 1. The Solaris 'sum' command must be -# present on the system if this option is used. +# The default value is the null string. # -#USE_SUNSUM=0 +#IGNORE_PRELINK_DEP_ERR=/bin/ps /usr/bin/top # -# This option is a space-separated list of commands, directories and file -# pathnames which will be included in the file properties checks. -# This option can be specified more than once. +# These options specify a command, directory or file pathname which will be +# included or excluded in the file properties checks. +# +# For the USER_FILEPROP_FILES_DIRS option, simple command names - for example, +# 'top' - and directory names are added to the internal list of directories to +# be searched for each of the command names in the command list. Additionally, +# full pathnames to files, which need not be commands, may be given. Any files +# or directories which are already part of the internal lists will be silently +# ignored from the configuration. +# +# For the USER_FILEPROP_FILES_DIRS option, wildcards are allowed, except for +# simple command names. +# For example, 'top*' cannot be given, but '/usr/bin/top*' is allowed. +# +# Specific files may be excluded by using the EXCLUDE_USER_FILEPROP_FILES_DIRS +# option. Wildcards may be used with this option. +# +# By combining these two options, and using wildcards, whole directories can be +# excluded. For example: # -# Whenever this option is changed, 'rkhunter --propupd' must be run. +# USER_FILEPROP_FILES_DIRS=/etc/* +# USER_FILEPROP_FILES_DIRS=/etc/*/* +# EXCLUDE_USER_FILEPROP_FILES_DIRS=/etc/rc?.d/* # -# Simple command names - for example, 'top' - and directory names are -# added to the internal list of directories to be searched for each of -# the command names in the command list. Additionally, full pathnames -# to files, which need not be commands, may be given. Any files or -# directories which are already part of the internal lists will be +# This will look for files in the first two directory levels of '/etc'. However, +# anything in '/etc/rc0.d', '/etc/rc1.d', '/etc/rc2.d' and so on, will be +# excluded. +# +# NOTE: Only files and directories which have been added by the user, and are +# not part of the internal lists, can be excluded. So, for example, it is not +# possible to exclude the 'ps' command by using '/bin/ps'. These will be # silently ignored from the configuration. # -# Normal globbing wildcards are allowed, except for simple command names. -# For example, 'top*' cannot be given, but '/usr/bin/top*' is allowed. +# Both options can be specified more than once. +# +# NOTE: Whenever these options are changed 'rkhunter --propupd' must be run. +# +# The default value for both options is the null string. +# +#USER_FILEPROP_FILES_DIRS=top +#USER_FILEPROP_FILES_DIRS=/usr/local/sbin +#USER_FILEPROP_FILES_DIRS=/etc/rkhunter.conf +#USER_FILEPROP_FILES_DIRS=/etc/rkhunter.conf.local +#USER_FILEPROP_FILES_DIRS=/var/lib/rkhunter/db/* +#USER_FILEPROP_FILES_DIRS=/var/lib/rkhunter/db/i18n/* +#EXCLUDE_USER_FILEPROP_FILES_DIRS=/opt/ps* +#EXCLUDE_USER_FILEPROP_FILES_DIRS=/var/lib/rkhunter/db/mirrors.dat +#EXCLUDE_USER_FILEPROP_FILES_DIRS=/var/lib/rkhunter/db/rkhunter* + # -# Specific files may be excluded by preceding their name with an -# exclamation mark (!). For example, '!/opt/top'. By combining this -# with wildcarding, whole directories can be excluded. For example, -# '/etc/* /etc/*/* !/etc/rc?.d/*'. This will look for files in the first -# two directory levels of '/etc'. However, anything in '/etc/rc0.d', -# '/etc/rc1.d', '/etc/rc2.d' and so on, will be excluded. -# -# NOTE: Only files and directories which have been added by the user, -# and are not part of the internal lists, can be excluded. So, for -# example, it is not possible to exclude the 'ps' command by using -# '!/bin/ps'. These will be silently ignored from the configuration. -# -#USER_FILEPROP_FILES_DIRS="top /usr/local/sbin !/opt/ps*" -#USER_FILEPROP_FILES_DIRS="/etc/rkhunter.conf" -#USER_FILEPROP_FILES_DIRS="/etc/rkhunter.conf.local" -#USER_FILEPROP_FILES_DIRS="/var/lib/rkhunter/db/*" -#USER_FILEPROP_FILES_DIRS="!/var/lib/rkhunter/db/mirrors.dat" -#USER_FILEPROP_FILES_DIRS="!/var/lib/rkhunter/db/rkhunter*" -#USER_FILEPROP_FILES_DIRS="/var/lib/rkhunter/db/i18n/*" - -# -# This option whitelists files and directories from existing, -# or not existing, on the system at the time of testing. This -# option is used when the configuration file options themselves -# are checked, and during the file properties check, the hidden -# files and directories checks, and the filesystem check of the -# '/dev' directory. -# -# This is a space-separated list of pathnames. The option may be -# specified more than once. The option may use wildcard characters, -# but be aware that this is probably not what you want to do as the -# wildcarding will be expanded after files have been deleted. As -# such deleted files won't be whitelisted if wildcarded. -# -# NOTE: The user must take into consideration how often the file will -# appear and disappear from the system in relation to how often -# rkhunter is run. If the file appears, and disappears, too often -# then rkhunter may not notice this. All it will see is that the file -# has changed. The inode-number and DTM will certainly be different -# for each new file, and rkhunter will report this. +# This option whitelists files and directories from existing, or not existing, +# on the system at the time of testing. This option is used when the +# configuration file options themselves are checked, and during the file +# properties check, the hidden files and directories checks, and the filesystem +# check of the '/dev' directory. +# +# This option may be specified more than once, and may use wildcards. +# Be aware though that this is probably not what you want to do as the +# wildcarding will be expanded after files have been deleted. As such +# deleted files won't be whitelisted if wildcarded. +# +# NOTE: The user must take into consideration how often the file will appear +# and disappear from the system in relation to how often rkhunter is run. If +# the file appears, and disappears, too often then rkhunter may not notice +# this. All it will see is that the file has changed. The inode-number and DTM +# will certainly be different for each new file, and rkhunter will report this. +# +# The default value is the null string. # #EXISTWHITELIST="" # -# Whitelist various attributes of the specified files. -# The attributes are those of the 'attributes' test. -# Specifying a file name here does not include it being -# whitelisted for the write permission test (see below). +# Whitelist various attributes of the specified file. The attributes are those +# of the 'attributes' test. Specifying a file name here does not include it +# being whitelisted for the write permission test (see below). # -# This is a space-separated list of filenames. The option may -# be specified more than once. The option may use wildcard -# characters. +# This option may be specified more than once, and may use wildcard characters. # -#ATTRWHITELIST="/bin/ps /usr/bin/date" +# The default value is the null string. +# +#ATTRWHITELIST=/usr/bin/date # -# Allow the specified commands to have the 'others' -# (world) permission have the write-bit set. +# Allow the specified file to have the 'others' (world) permission have the +# write-bit set. For example, files with permissions r-xr-xrwx or rwxrwxrwx. # -# For example, files with permissions r-xr-xrwx -# or rwxrwxrwx. +# This option may be specified more than once, and may use wildcard characters. # -# This is a space-separated list of filenames. The option may -# be specified more than once. The option may use wildcard -# characters. +# The default value is the null string. # -#WRITEWHITELIST="/bin/ps /usr/bin/date" +#WRITEWHITELIST=/usr/bin/date # -# Allow the specified commands to be scripts. +# Allow the specified file to be a script. +# +# This option may be specified more than once, and may use wildcard characters. # -# This is a space-separated list of filenames. The option may -# be specified more than once. The option may use wildcard -# characters. +# The default value is the null string. # SCRIPTWHITELIST=/bin/egrep SCRIPTWHITELIST=/bin/fgrep SCRIPTWHITELIST=/bin/which SCRIPTWHITELIST=/usr/bin/groups SCRIPTWHITELIST=/usr/bin/ldd -SCRIPTWHITELIST=/usr/bin/lwp-request +#SCRIPTWHITELIST=/usr/bin/lwp-request SCRIPTWHITELIST=/usr/sbin/adduser -SCRIPTWHITELIST=/usr/sbin/prelink +#SCRIPTWHITELIST=/usr/sbin/prelink +#SCRIPTWHITELIST=/usr/bin/unhide.rb # -# Allow the specified commands to have the immutable attribute set. +# Allow the specified file to have the immutable attribute set. # -# This is a space-separated list of filenames. The option may -# be specified more than once. The option may use wildcard -# characters. +# This option may be specified more than once, and may use wildcard characters. # -#IMMUTWHITELIST="/sbin/ifup /sbin/ifdown" +# The default value is the null string. +# +#IMMUTWHITELIST=/sbin/ifdown # -# If this option is set to 1, then the immutable-bit test is -# reversed. That is, the files are expected to have the bit set. +# If this option is set to '1', then the immutable-bit test is reversed. That +# is, the files are expected to have the bit set. A value of '0' means that the +# immutable-bit should not be set. +# +# The default value is '0'. # -IMMUTABLE_SET=0 +#IMMUTABLE_SET=0 # -# Allow the specified hidden directories to be whitelisted. +# Allow the specified hidden directory to be whitelisted. +# +# This option may be specified more than once, and may use wildcard characters. # -# This is a space-separated list of directory pathnames. -# The option may be specified more than once. The option -# may use wildcard characters. +# The default value is the null string. # -ALLOWHIDDENDIR="/etc/.java" -#ALLOWHIDDENDIR="/dev/.static" -#ALLOWHIDDENDIR="/dev/.SRC-unix" -ALLOWHIDDENDIR="/etc/.git" +#ALLOWHIDDENDIR=/etc/.java +ALLOWHIDDENDIR=/etc/.git # -# Allow the specified hidden files to be whitelisted. +# Allow the specified hidden file to be whitelisted. # -# This is a space-separated list of filenames. The option may -# be specified more than once. The option may use wildcard -# characters. +# This option may be specified more than once, and may use wildcard characters. +# +# The default value is the null string. # -#ALLOWHIDDENFILE="/etc/.java" -#ALLOWHIDDENFILE="/usr/share/man/man1/..1.gz" -#ALLOWHIDDENFILE="/etc/.pwd.lock" -#ALLOWHIDDENFILE="/etc/.init.state" -#ALLOWHIDDENFILE="/lib/.libcrypto.so.0.9.8e.hmac /lib/.libcrypto.so.6.hmac" -#ALLOWHIDDENFILE="/lib/.libssl.so.0.9.8e.hmac /lib/.libssl.so.6.hmac" -#ALLOWHIDDENFILE="/usr/bin/.fipscheck.hmac" -#ALLOWHIDDENFILE="/usr/bin/.ssh.hmac" -#ALLOWHIDDENFILE="/usr/lib/.libfipscheck.so.1.1.0.hmac" -#ALLOWHIDDENFILE="/usr/lib/.libfipscheck.so.1.hmac" -#ALLOWHIDDENFILE="/usr/lib/.libgcrypt.so.11.hmac" -#ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha1hmac.hmac" -#ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha256hmac.hmac" -#ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha384hmac.hmac" -#ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha512hmac.hmac" -#ALLOWHIDDENFILE="/usr/sbin/.sshd.hmac" -#ALLOWHIDDENFILE="/usr/share/man/man5/.k5login.5.gz" -ALLOWHIDDENFILE="/etc/.gitignore" -ALLOWHIDDENFILE="/etc/.etckeeper" -#ALLOWHIDDENFILE="/etc/.bzrignore" - -# -# Allow the specified processes to use deleted files. The -# process name may be followed by a colon-separated list of -# full pathnames. The process will then only be whitelisted -# if it is using one of the given files. For example: -# -# ALLOWPROCDELFILE="/usr/libexec/gconfd-2:/tmp/abc:/var/tmp/xyz" -# -# This is a space-separated list of process names. The option -# may be specified more than once. The option may use wildcard -# characters, but only in the file names. -# -#ALLOWPROCDELFILE="/sbin/cardmgr /usr/sbin/gpm:/etc/X11/abc" -#ALLOWPROCDELFILE="/usr/lib/libgconf2-4/gconfd-2" -#ALLOWPROCDELFILE="/usr/sbin/mysqld:/tmp/ib*" -#ALLOWPROCDELFILE="/usr/lib/iceweasel/firefox-bin" -#ALLOWPROCDELFILE="/usr/bin/file-roller" - -# -# Allow the specified processes to listen on any network interface. -# -# This is a space-separated list of process names. The option -# may be specified more than once. -# -#ALLOWPROCLISTEN="/sbin/dhclient /usr/bin/dhcpcd" -#ALLOWPROCLISTEN="/usr/sbin/pppoe /usr/sbin/tcpdump" -#ALLOWPROCLISTEN="/usr/sbin/snort-plain" +#ALLOWHIDDENFILE=/usr/share/man/man1/..1.gz +#ALLOWHIDDENFILE=/usr/bin/.fipscheck.hmac +#ALLOWHIDDENFILE=/usr/bin/.ssh.hmac +#ALLOWHIDDENFILE=/usr/lib/.libfipscheck.so.1.1.0.hmac +#ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac +#ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac +#ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac +#ALLOWHIDDENFILE=/usr/share/man/man5/.k5login.5.gz +ALLOWHIDDENFILE=/etc/.etckeeper +ALLOWHIDDENFILE=/etc/.gitignore +#ALLOWHIDDENFILE=/etc/.bzrignore + + +# +# Allow the specified process to use deleted files. The process name may be +# followed by a colon-separated list of full pathnames. The process will then +# only be whitelisted if it is using one of the given files. For example: +# +# ALLOWPROCDELFILE=/usr/libexec/gconfd-2:/tmp/abc:/var/tmp/xyz +# +# This option may be specified more than once. It may also use wildcards, but +# only in the file names. +# +# The default value is the null string. +# +#ALLOWPROCDELFILE=/sbin/cardmgr +#ALLOWPROCDELFILE=/usr/lib/libgconf2-4/gconfd-2 +#ALLOWPROCDELFILE=/usr/sbin/mysqld:/tmp/ib* +#ALLOWPROCDELFILE=/usr/lib/iceweasel/firefox-bin +#ALLOWPROCDELFILE=/usr/bin/file-roller + +# +# Allow the specified process to listen on any network interface. +# +# This option may be specified more than once, and may use wildcard characters. +# +# The default value is the null string. +# +#ALLOWPROCLISTEN=/sbin/dhclient +#ALLOWPROCLISTEN=/usr/bin/dhcpcd +#ALLOWPROCLISTEN=/usr/sbin/tcpdump +#ALLOWPROCLISTEN=/usr/sbin/snort-plain # # Allow the specified network interfaces to be in promiscuous mode. # -# This is a space-separated list of interface names. The option may -# be specified more than once. +# This is a space-separated list of interface names. The option may be +# specified more than once. +# +# The default value is the null string. # -#ALLOWPROMISCIF="eth0" +#ALLOWPROMISCIF=eth0 # -# SCAN_MODE_DEV governs how we scan '/dev' for suspicious files. -# The two allowed options are: THOROUGH or LAZY. -# If commented out we do a THOROUGH scan which will increase the runtime. -# Even though this adds to the running time it is highly recommended to -# leave it like this. +# This option specifies how rkhunter should scan the '/dev' directory for +# suspicious files. The only allowed values are 'THOROUGH' and 'LAZY'. +# +# A THOROUGH scan will increase the overall runtime of rkhunter. Despite this, +# it is highly recommended that this value is used. +# +# The default value is 'THOROUGH'. +# +# Also see the ALLOWDEVFILE option. # #SCAN_MODE_DEV=THOROUGH # -# The PHALANX2_DIRTEST option is used to indicate if the Phalanx2 test is to -# perform a basic check, or a more thorough check. If the option is set to 0, -# then a basic check is performed. If it is set to 1, then all the directries -# in the /etc and /usr directories are scanned. The default value is 0. Users -# should note that setting this option to 1 will cause the test to take longer -# to complete. +# Allow the specified file to be present in the '/dev' directory, and not +# regarded as suspicious. +# +# This option may be specified more than once, and may use wildcard characters. # -PHALANX2_DIRTEST=0 +# The default value is the null string. +# +#ALLOWDEVFILE=/dev/shm/pulse-shm-* +#ALLOWDEVFILE=/dev/shm/sem.ADBE_* # -# Allow the specified files to be present in the /dev directory, -# and not regarded as suspicious. +# This option is used to indicate if the Phalanx2 test is to perform a basic +# check, or a more thorough check. If the option is set to '0', then a basic +# check is performed. If it is set to '1', then all the directories in the +# '/etc' and '/usr' directories are scanned. +# +# NOTE: Setting this option to '1' will cause the test to take longer +# to complete. # -# This is a space-separated list of pathnames. The option may -# be specified more than once. The option may use wildcard -# characters. +# The default value is '0'. # -#ALLOWDEVFILE="/dev/shm/pulse-shm-*" -#ALLOWDEVFILE="/dev/shm/sem.ADBE_*" +#PHALANX2_DIRTEST=0 # -# This setting tells rkhunter where the inetd configuration -# file is located. +# This option tells rkhunter where the inetd configuration file is located. +# +# The default value is the null string. # #INETD_CONF_PATH=/etc/inetd.conf # -# Allow the following enabled inetd services. +# This option allows the specified enabled inetd services. # -# This is a space-separated list of service names. The option may -# be specified more than once. +# This is a space-separated list of service names. The option may be specified +# more than once. # # For non-Solaris users the simple service name should be used. # For example: @@ -628,7 +742,7 @@ PHALANX2_DIRTEST=0 # For example: # # INETD_ALLOWED_SVC=imaps -# INETD_ALLOWED_SVC="/usr/sbin/rpc.metad /usr/sbin/rpc.metamhd" +# INETD_ALLOWED_SVC=/usr/sbin/rpc.metad /usr/sbin/rpc.metamhd # # For Solaris 10 users the service/FMRI name should be used. For example: # @@ -637,207 +751,280 @@ PHALANX2_DIRTEST=0 # INETD_ALLOWED_SVC=/application/font/stfsloader # INETD_ALLOWED_SVC=/network/rpc-100235_1/rpc_ticotsord # +# The default value is the null string. +# #INETD_ALLOWED_SVC=echo # -# This setting tells rkhunter where the xinetd configuration -# file is located. +# This option tells rkhunter where the xinetd configuration file is located. +# +# The default value is the null string. # #XINETD_CONF_PATH=/etc/xinetd.conf # -# Allow the following enabled xinetd services. Whilst it would be -# nice to use the service names themselves, at the time of testing -# we only have the pathname available. As such, these entries are -# the xinetd file pathnames. +# This option allows the specified enabled xinetd services. Whilst it would be +# nice to use the service names themselves, at the time of testing we only have +# the pathname available. As such, these entries are the xinetd file pathnames. # -# This is a space-separated list of service names. The option may -# be specified more than once. +# This is a space-separated list of service names. The option may be specified +# more than once. +# +# The default value is the null string. # #XINETD_ALLOWED_SVC=/etc/xinetd.d/echo # -# This option tells rkhunter the local system startup file pathnames. -# The directories will be searched for files. By default rkhunter -# will use certain filenames and directories. If the option is set -# to 'none', then certain tests will be skipped. +# This option tells rkhunter the local system startup file pathnames. The +# directories will be searched for files. By default rkhunter will try and +# determine were the startup files are located. If the option is set to 'NONE', +# then certain tests will be skipped. +# +# This is a space-separated list of file and directory pathnames. The option +# may be specified more than once, and may use wildcard characters. # -# This is a space-separated list of file and directory pathnames. -# The option may be specified more than once. The option may use -# wildcard characters. +# This option has no default value. # -#STARTUP_PATHS="/etc/init.d /etc/rc.local" +#STARTUP_PATHS=/etc/init.d /etc/rc.local # -# This setting tells rkhunter the pathname to the file containing the -# user account passwords. This setting will be worked out by rkhunter, -# and so should not usually need to be set. Users of TCB shadow files -# should not set this option. +# This option tells rkhunter the pathname to the file containing the user +# account passwords. This setting will be worked out by rkhunter, and so +# should not usually need to be set. Users of TCB shadow files should not +# set this option. +# +# This option has no default value. # #PASSWORD_FILE=/etc/shadow # -# Allow the following accounts to be root equivalent. These accounts -# will have a UID value of zero. The 'root' account does not need to -# be listed as it is automatically whitelisted. +# This option allows the specified accounts to be root equivalent. These +# accounts will have a UID value of zero. The 'root' account does not need +# to be listed as it is automatically whitelisted. # -# This is a space-separated list of account names. The option may -# be specified more than once. +# This is a space-separated list of account names. The option may be specified +# more than once. # -# NOTE: For *BSD systems you will probably need to use this option -# for the 'toor' account. +# NOTE: For *BSD systems you will probably need to use this option for the +# 'toor' account. # -#UID0_ACCOUNTS="toor rooty sashroot" +# The default value is the null string. +# +#UID0_ACCOUNTS=toor rooty sashroot # -# Allow the following accounts to have no password. NIS/YP entries do -# not need to be listed as they are automatically whitelisted. +# This option allows the specified accounts to have no password. NIS/YP entries +# do not need to be listed as they are automatically whitelisted. +# +# This is a space-separated list of account names. The option may be specified +# more than once. # -# This is a space-separated list of account names. The option may -# be specified more than once. +# The default value is the null string. # -#PWDLESS_ACCOUNTS="abc" +#PWDLESS_ACCOUNTS=abc # -# This setting tells rkhunter the pathname to the syslog configuration -# file. This setting will be worked out by rkhunter, and so should not -# usually need to be set. A value of 'NONE' can be used to indicate -# that there is no configuration file, but that the syslog daemon process -# may be running. +# This option tells rkhunter the pathname to the syslog configuration file. +# This setting will be worked out by rkhunter, and so should not usually need +# to be set. A value of 'NONE' can be used to indicate that there is no +# configuration file, but that the syslog daemon process may be running. # -# This is a space-separated list of pathnames. The option may -# be specified more than once. +# This is a space-separated list of pathnames. The option may be specified +# more than once. +# +# This option has no default value. # #SYSLOG_CONFIG_FILE=/etc/syslog.conf # -# This option permits the use of syslog remote logging. +# If this option is set to '1', then the use of syslog remote logging is +# permitted. A value of '0' disallows the use of remote logging. +# +# The default value is '0'. # -ALLOW_SYSLOG_REMOTE_LOGGING=0 +#ALLOW_SYSLOG_REMOTE_LOGGING=0 # -# Allow the following applications, or a specific version of an application, -# to be whitelisted. This option may be specified more than once, and is a -# space-separated list consisting of the application names. If a specific -# version is to be whitelisted, then the name must be followed by a colon -# and then the version number. For example: +# This option allows the specified applications, or a specific version of an +# application, to be whitelisted. If a specific version is to be whitelisted, +# then the name must be followed by a colon and then the version number. +# For example: +# +# APP_WHITELIST=openssl:0.9.7d gpg httpd:1.3.29 # -# APP_WHITELIST="openssl:0.9.7d gpg httpd:1.3.29" +# This is a space-separated list of pathnames. The option may be specified +# more than once. # -# Note above that for the Apache web server, the name 'httpd' is used. +# The default value is the null string. # #APP_WHITELIST="" # -# Scan for suspicious files in directories containing temporary files and -# directories posing a relatively higher risk due to user write access. -# Please do not enable by default as suspscan is CPU and I/O intensive and prone to -# producing false positives. Do review all settings before usage. -# Also be aware that running suspscan in combination with verbose logging on, -# RKH's default, will show all ignored files. -# Please consider adding all directories the user the (web)server runs as has -# write access to including the document root (example: "/var/www") and log -# directories (example: "/var/log/httpd"). -# -# This is a space-separated list of directory pathnames. -# The option may be specified more than once. +# Set this option to scan for suspicious files in directories which pose a +# relatively higher risk due to user write access. +# +# Please do not enable the 'suspscan' test by default as it is CPU and I/O +# intensive, and prone to producing false positives. Do review all settings +# before usage. Also be aware that running 'suspscan' in combination with +# verbose logging on, rkhunter's default, will show all ignored files. # -#SUSPSCAN_DIRS="/tmp /var/tmp" +# Please consider adding all directories the user the (web)server runs as, +# and has write access to, including the document root (e.g: '/var/www') and +# log directories (e.g: '/var/log/httpd'). +# +# This is a space-separated list of directory pathnames. The option may be +# specified more than once. +# +# The default value is the '/tmp' and '/var/tmp' directories. +# +#SUSPSCAN_DIRS=/tmp /var/tmp # -# Directory for temporary files. A memory-based one is better (faster). -# Do not use a directory name that is listed in SUSPSCAN_DIRS. -# Please make sure you have a tempfs mounted and the directory exists. +# This option specifies the directory for temporary files used by the +# 'suspscan' test. A memory-based directory, such as a tempfs filesystem, is +# better (faster). Do not use a directory name that is listed in SUSPSCAN_DIRS +# as that is highly likely to cause false-positive results. +# +# The default value is '/dev/shm'. # -SUSPSCAN_TEMP=/dev/shm +#SUSPSCAN_TEMP=/dev/shm # -# Maximum filesize in bytes. Files larger than this will not be inspected. -# Do make sure you have enough space left in your temporary files directory. +# This option specifies the 'suspscan' test maximum filesize in bytes. Files +# larger than this will not be inspected. Do make sure you have enough space +# available in your temporary files directory. +# +# The default value is '1024000'. # -SUSPSCAN_MAXSIZE=10240000 +#SUSPSCAN_MAXSIZE=10240000 # -# Score threshold. Below this value no hits will be reported. -# A value of "200" seems "good" after testing on malware. Please adjust -# locally if necessary. +# This option specifies the 'suspscan' test score threshold. Below this value +# no hits will be reported. # -SUSPSCAN_THRESH=200 +# The default value is '200'. +# +#SUSPSCAN_THRESH=200 # -# The following option can be used to whitelist network ports which -# are known to have been used by malware. This option may be specified -# more than once. The option is a space-separated list of one or more -# of four types of whitelisting. These are: +# The following options can be used to whitelist network ports which are known +# to have been used by malware. # -# 1) a 'protocol:port' pair (e.g. TCP:25) -# 2) a pathname to an executable (e.g. /usr/sbin/squid) -# 3) a combined pathname, protocol and port -# (e.g. /usr/sbin/squid:TCP:3801) -# 4) an asterisk ('*') +# The PORT_WHITELIST option is a space-separated list of one or more of two +# types of whitelisting. These are: # -# Only the UDP or TCP protocol may be specified, and the port number -# must be between 1 and 65535 inclusive. +# 1) a 'protocol:port' pair +# 2) an asterisk ('*') # -# The asterisk can be used to indicate that any executable which rkhunter -# can locate as a command, is whitelisted. (See BINDIR in this file.) +# Only the UDP or TCP protocol may be specified, and the port number must be +# between 1 and 65535 inclusive. # -# For example: +# The asterisk can be used to indicate that any executable which rkhunter can +# locate as a command, is whitelisted. (Also see BINDIR) +# +# The PORT_PATH_WHITELIST option specifies one of two types of whitelisting. +# These are: +# +# 1) a pathname to an executable +# 2) a combined pathname, protocol and port +# +# As above, the protocol can only be TCP or UDP, and the port number must be +# between 1 and 65535 inclusive. +# +# Examples: +# +# PORT_WHITELIST=TCP:2001 UDP:32011 +# PORT_PATH_WHITELIST=/usr/sbin/squid +# PORT_PATH_WHITELIST=/usr/sbin/squid:TCP:3801 +# +# NOTE: In order to whitelist a pathname, or use the asterisk option, the +# 'lsof' command must be present. # -# PORT_WHITELIST="/home/user1/abc /opt/xyz TCP:2001 UDP:32011" +# Both options may be specified more than once. # -# NOTE: In order to whitelist a pathname, or use the asterisk option, -# the 'lsof' command must be present. +# The default value for both options is the null string. # #PORT_WHITELIST="" +#PORT_PATH_WHITELIST="" # -# The following option can be used to tell rkhunter where the operating -# system 'release' file is located. This file contains information -# specifying the current O/S version. RKH will store this information -# itself, and check to see if it has changed between each run. If it has -# changed, then the user is warned that RKH may issue warning messages -# until RKH has been run with the '--propupd' option. +# The following option can be used to tell rkhunter where the operating system +# 'release' file is located. This file contains information specifying the +# current O/S version. RKH will store this information, and check to see if it +# has changed between each run. If it has changed, then the user is warned that +# RKH may issue warning messages until RKH has been run with the '--propupd' +# option. # -# Since the contents of the file vary according to the O/S distribution, -# RKH will perform different actions when it detects the file itself. As -# such, this option should not be set unless necessary. If this option is -# specified, then RKH will assume the O/S release information is on the -# first non-blank line of the file. +# Since the contents of the file vary according to the O/S distribution, RKH +# will perform different actions when it detects the file itself. As such, this +# option should not be set unless necessary. If this option is specified, then +# RKH will assume the O/S release information is on the first non-blank line of +# the file. # -#OS_VERSION_FILE="/etc/debian_version" +# This option has no default value. +# +# Also see the WARN_ON_OS_CHANGE and UPDT_ON_OS_CHANGE options. +# +#OS_VERSION_FILE=/etc/debian_version # -# The following two options can be used to whitelist files and directories -# that would normally be flagged with a warning during the various rootkit -# and malware checks. If the file or directory name contains a space, then -# the percent character ('%') must be used instead. Only existing files and -# directories can be specified, and these must be full pathnames not links. +# Set the following option to '0' if you do not want to receive a warning if any +# O/S information has changed since the last run of 'rkhunter --propupd'. The +# warnings occur during the file properties check. Setting a value of '1' will +# cause rkhunter to issue a warning if something has changed. +# +# The default value is '1'. +# +#WARN_ON_OS_CHANGE=1 + +# +# Set the following option to '1' if you want rkhunter to automatically run a +# file properties update ('--propupd') if the O/S has changed. Detection of an +# O/S change occurs during the file properties check. Setting a value of '0' +# will cause rkhunter not to do an automatic update. +# +# WARNING: Only set this option if you are sure that the update will work +# correctly. That is, that the database directory is writeable, that a valid +# hash function is available, and so on. This can usually be checked simply by +# running 'rkhunter --propupd' at least once. +# +# The default value is '0'. +# +#UPDT_ON_OS_CHANGE=0 + +# +# The following two options can be used to whitelist files and directories that +# would normally be flagged with a warning during the various rootkit and +# malware checks. Only existing files and directories can be specified, and +# these must be full pathnames not links. # # Additionally, the RTKT_FILE_WHITELIST option may include a string after the # file name (separated by a colon). This will then only whitelist that string # in that file (as part of the malware checks). For example: # -# RTKT_FILE_WHITELIST="/etc/rc.local:hdparm" +# RTKT_FILE_WHITELIST=/etc/rc.local:hdparm # # If the option list includes the filename on its own as well, then the file # will be whitelisted from rootkit checks of the files existence, but still # only the specific string within the file will be whitelisted. For example: # -# RTKT_FILE_WHITELIST="/etc/rc.local:hdparm /etc/rc.local" +# RTKT_FILE_WHITELIST=/etc/rc.local +# RTKT_FILE_WHITELIST=/etc/rc.local:hdparm # # To whitelist a file from the existence checks, but not from the strings -# checks, then include the filename on its own and on its own but with -# just a colon appended. For example: +# checks, then include the filename on its own and on its own but with just +# a colon appended. For example: # -# RTKT_FILE_WHITELIST="/etc/rc.local /etc/rc.local:" +# RTKT_FILE_WHITELIST=/etc/rc.local +# RTKT_FILE_WHITELIST=/etc/rc.local: # # NOTE: It is recommended that if you whitelist any files, then you include # those files in the file properties check. See the USER_FILEPROP_FILES_DIRS # configuration option. # -# These are space-separated lists of file and directory pathnames. -# The options may be specified more than once. +# Both of these options may be specified more than once. +# +# For both options the default value is the null string. # #RTKT_DIR_WHITELIST="" #RTKT_FILE_WHITELIST="" @@ -852,18 +1039,22 @@ SUSPSCAN_THRESH=200 # those files in the file properties check. See the USER_FILEPROP_FILES_DIRS # configuration option. # -# This is a space-separated list of library pathnames. -# The option may be specified more than once. +# This option is a space-separated list of library pathnames. The option may be +# specified more than once. +# +# The default value is the null string. # -#SHARED_LIB_WHITELIST="/lib/snoopy.so" +#SHARED_LIB_WHITELIST=/lib/snoopy.so # # To force rkhunter to use the supplied script for the 'stat' or 'readlink' -# command, then the following two options can be used. The value must be -# set to 'BUILTIN'. +# command the following two options can be used. The value must be set to +# 'BUILTIN'. # # NOTE: IRIX users will probably need to enable STAT_CMD. # +# For both options the default value is the null string. +# #STAT_CMD=BUILTIN #READLINK_CMD=BUILTIN @@ -873,18 +1064,22 @@ SUSPSCAN_THRESH=200 # failing that the 'perl' command, to display the date and time in a # human-readable format as well. This option may be used if some other command # should be used instead. The given command must understand the '%s' and -# 'seconds ago' options found in the GNU date command. +# 'seconds ago' options found in the GNU 'date' command. # # A value of 'NONE' may be used to request that only the epoch seconds be shown. # A value of 'PERL' may be used to force rkhunter to use the 'perl' command, if # it is present. # +# This option has no default value. +# #EPOCH_DATE_CMD="" # -# This setting tells rkhunter the directory containing the available -# Linux kernel modules. This setting will be worked out by rkhunter, -# and so should not usually need to be set. +# This setting tells rkhunter the directory containing the available Linux +# kernel modules. This setting will be worked out by rkhunter, and so should +# not usually need to be set. +# +# This option has no default value. # #MODULES_DIR="" @@ -905,100 +1100,152 @@ SUSPSCAN_THRESH=200 # # WEB_CMD="/opt/bin/dlfile --timeout 5m -q" # -# *BSD users may want to use the 'ftp' command, provided that it supports -# the HTTP protocol: +# *BSD users may want to use the 'ftp' command, provided that it supports the +# HTTP protocol: # # WEB_CMD="ftp -o -" # -#WEB_CMD="" - -# -# Set the following option to 0 if you do not want to receive a warning if -# any O/S information has changed since the last run of 'rkhunter --propupd'. -# The warnings occur during the file properties check. The default is to -# issue a warning if something has changed. +# This option has no default value. # -#WARN_ON_OS_CHANGE=1 - -# -# Set the following option to 1 if you want rkhunter to automatically run -# a file properties update ('--propupd') if the O/S has changed. Detection -# of an O/S change occurs during the file properties check. The default is -# not to do an automatic update. -# -# WARNING: Only set this option if you are sure that the update will work -# correctly. That is, that the database directory is writeable, that a valid -# hash function is available, and so on. This can usually be checked simply -# by running 'rkhunter --propupd' at least once. -# -#UPDT_ON_OS_CHANGE=0 +#WEB_CMD="" # -# Set the following option to 1 if locking is to be used when rkhunter runs. +# Set the following option to '1' if locking is to be used when rkhunter runs. # The lock is set just before logging starts, and is removed when the program # ends. It is used to prevent items such as the log file, and the file # properties file, from becoming corrupted if rkhunter is running more than # once. The mechanism used is to simply create a lock file in the TMPDIR # directory. If the lock file already exists, because rkhunter is already # running, then the current process simply loops around sleeping for 10 seconds -# and then retrying the lock. +# and then retrying the lock. A value of '0' means not to use locking. +# +# The default value is '0'. # -# The default is not to use locking. +# Also see the LOCK_TIMEOUT and SHOW_LOCK_MSGS options. # -USE_LOCKING=0 +#USE_LOCKING=0 # # If locking is used, then rkhunter may have to wait to get the lock file. # This option sets the total amount of time, in seconds, that rkhunter should # wait. It will retry the lock every 10 seconds, until either it obtains the -# lock or the timeout value has been reached. If no value is set, then a -# default of 300 seconds (5 minutes) is used. +# lock or the timeout value has been reached. # -LOCK_TIMEOUT=300 +# The default value is 300 seconds (5 minutes). +# +#LOCK_TIMEOUT=300 # # If locking is used, then rkhunter may be doing nothing for some time if it -# has to wait for the lock. Some simple messages are echo'd to the users screen -# to let them know that rkhunter is waiting for the lock. Set this option to 0 -# if the messages are not to be displayed. The default is to show them. +# has to wait for the lock. If this option is set to '1', then some simple +# messages are echoed to the users screen to let them know that rkhunter is +# waiting for the lock. Set this option to '0' if the messages are not to be +# displayed. +# +# The default value is '1'. # -SHOW_LOCK_MSGS=1 +#SHOW_LOCK_MSGS=1 # -# If the option SCANROOTKITMODE is set to "THOROUGH" the scanrootkit() function -# will search (on a per rootkit basis) for filenames in all of the directories (as defined -# by the result of running 'find / -xdev'). While still not optimal, as it -# still searches for only file names as opposed to file contents, this is one step away -# from the rigidity of searching in known (evidence) or default (installation) locations. +# If this option is set to 'THOROUGH' then rkhunter will search (on a per +# rootkit basis) for filenames in all of the directories (as defined by the +# result of running 'find / -xdev'). While still not optimal, as it still +# searches for only file names as opposed to file contents, this is one step +# away from the rigidity of searching in known (evidence) or default +# (installation) locations. # # THIS OPTION SHOULD NOT BE ENABLED BY DEFAULT. # -# You should only activate this feature as part of a more thorough investigation which -# should be based on relevant best practices and procedures. +# You should only activate this feature as part of a more thorough +# investigation, which should be based on relevant best practices and +# procedures. # -# Enabling this feature implies you have the knowledge to interpret the results properly. +# Enabling this feature implies you have the knowledge to interpret the +# results properly. +# +# The default value is the null string. # #SCANROOTKITMODE=THOROUGH # -# The following option can be set to the name(s) of the tests the 'unhide' command is -# to use. In order to maintain compatibility with older versions of 'unhide', this -# option defaults to 'sys'. Options such as '-m' and '-v' may also be specified, but -# will only take effect when they are seen. The test names are a space-separated list, -# and will be executed in the order given. +# The following option can be set to the name(s) of the tests the 'unhide' +# command is to use. Options such as '-m' and '-v' may be specified, but will +# only take effect when they are seen. The test names are a space-separated +# list, and will be executed in the order given. +# +# This option may be specified more than once. +# +# The default value is 'sys' in order to maintain compatibility with older +# versions of 'unhide'. +# +#UNHIDE_TESTS=sys + +# +# The following option can be used to set options for the 'unhide-tcp' command. +# The options are space-separated. # -#UNHIDE_TESTS="sys" +# This option may be specified more than once. +# +# The default value is the null string. +# +#UNHIDETCP_OPTS="" # -# If both the C 'unhide', and Ruby 'unhide.rb', programs exist on the system, then it -# is possible to disable the execution of one of the programs if desired. By default -# rkhunter will look for both programs, and execute each of them as they are found. -# If the value of this option is 0, then both programs will be executed if they are -# present. A value of 1 will disable execution of the C 'unhide' program, and a value -# of 2 will disable the Ruby 'unhide.rb' program. The default value is 0. To disable -# both programs, then disable the 'hidden_procs' test. +# If both the C 'unhide', and Ruby 'unhide.rb', programs exist on the system, +# then it is possible to disable the execution of one of the programs if +# desired. By default rkhunter will look for both programs, and execute each +# of them as they are found. If the value of this option is '0', then both +# programs will be executed if they are present. A value of '1' will disable +# execution of the C 'unhide' program, and a value of '2' will disable the Ruby +# 'unhide.rb' program. To disable both programs, then disable the +# 'hidden_procs' test. +# +# The default value is '0'. # -DISABLE_UNHIDE=0 +DISABLE_UNHIDE=1 -INSTALLDIR="/usr" +INSTALLDIR=/usr + +# +# This option can be set to either '0' or '1'. If set to '1' then the summary, +# shown after rkhunter has run, will display the actual number of warnings +# found. If it is set to '0', then the summary will simply indicate that +# 'One or more' warnings were found. If no warnings were found, and this option +# is set to '1', then a "0" will be shown. If the option is set to '0', then +# the words 'No warnings' will be shown. +# +# The default value is '0'. +# +#SHOW_SUMMARY_WARNINGS_NUMBER=0 + +# +# This option is used to determine where, if anywhere, the summary scan time is +# displayed. A value of '0' indicates that it should not be displayed anywhere. +# A value of '1' indicates that the time should only appear on the screen, and a +# value of '2' that it should only appear in the log file. A value of '3' +# indicates that the time taken should appear both on the screen and in the log +# file. +# +# The default value is '3'. +# +#SHOW_SUMMARY_TIME=3 + +# +# The two options below may be used to check if a file is missing or empty +# (that is, it has a size of zero). The EMPTY_LOGFILES option will also check +# if the file is missing, since that can be interpreted as a file of no size. +# However, the file will only be reported as missing if the MISSING_LOGFILES +# option hasn't already done this. +# +# Both options are space-separated lists of pathnames, and may be specified +# more than once. +# +# NOTE: Log files are usually 'rotated' by some mechanism. At that time it is +# perfectly possible for the file to be either missing or empty. As such these +# options may produce false-positive warnings when log files are rotated. +# +# For both options the default value is the null string. +# +#EMPTY_LOGFILES="" +#MISSING_LOGFILES="" diff --git a/roles/common/tasks/rkhunter.yml b/roles/common/tasks/rkhunter.yml index d504a49..c9d26fa 100644 --- a/roles/common/tasks/rkhunter.yml +++ b/roles/common/tasks/rkhunter.yml @@ -3,7 +3,7 @@ with_items: - rkhunter - curl - - iproute + - iproute2 - lsof - unhide |