The Samhain Host Integrity Monitoring System | ||
---|---|---|
Prev | Appendix C. Configuration file syntax and options | Next |
Section heading:
[SuidCheck]
Entries:
SuidCheckActive=boolean — '1' to switch on, '0' to switch off.
SuidCheckExclude=path — A directory (and its subdirectories) to exclude from the check. Only one directory can be specified this way.
SuidCheckSchedule=schedule — Crontab-like schedule for checks.
SeveritySuidCheck=severity — Severity for events.
SuidCheckFps=fps — Limit files per seconds for SUID check.
SuidCheckNosuid=boolean — Check filesystems mounted as nosuid. Defaults to not.
SuidCheckQuarantineFiles=boolean — Whether to quarantine files. Defaults to not.
SuidCheckQuarantineMethod=0|1|2 — Quarantine method. Delete = 1, remove suid/sgid flags = 1, move to quarantine directory = 2. Defaults to 1 (remove suid/sgid flags).
SuidCheckQuarantineDelete=boolean — Whether to delete rather than truncate, if method 0 (delete) is chosen. Default is truncate.