Additional Features — Signed Configuration/Database Files

Both the configuration file (see the Section called General in the appendix called List of configuration file options>) and the database of file signatures (the Section called The file signature database in the chapter called Configuration — samhain, the file monitor>) may always be cleartext signed by GnuGP (gpg). The recommended options are: gpg -a --clearsign --not-dash-escaped FILE

If compiled with support for signatures, samhain will invoke gpg to verify the signature. To compile with gpg support, use the option:

./configure --with-gpg=/full/path/to/gpg

As signatures on files are only useful as long as you can trust the gpg executable, the configure script will determine the TIGER192 checksum of the gpg executable, which will be compiled into samhain. In case of an error, you can specify the checksum by hand with:

--with-checksum="CHECKSUM" — or — --without-checksum

CHECKSUM should be the checksum as printed by

gpg --load-extension tiger --print-md TIGER192 /path/to/gpg — or — samhain -H /path/to/gpg (the full line of output, with spaces).

Example: --with-checksum="/usr/bin/gpg: 1C739B6A F768C949 FABEF313 5F0B37F5 22ED4A27 60D59664"

Likewise, it is highly recommended to compile in the key fingerprint of the signature key, which then will be verified after checking the signature itself:

--with-fp=FINGERPRINT

Example (spaces in FINGERPRINT do not matter): --with-fp="EF6C EF54 701A 0AFD B86A F4C3 1AAD 26C8 0F57 1F6C"

TipTIP
 

make install will gpg sign the configuration file before installation.

bash$ ./configure --with-gpg=/usr/bin/gpg --with-fp=EF6CEF54701A0AFDB86AF4C31AAD26C80F571F6C
bash$ make
bash$ su
bash$ make install
bash$ samhain -t init
bash$ gpg -a --clearsign /var/lib/samhain/samhain_file
bash$ mv /var/lib/samhain/samhain_file.asc /var/lib/samhain/samhain_file

samhain will report the signature key owner and the key fingerprint as obtained from gpg. If both files are present and checked (i.e. when checking files against the database), both must be signed with the same key. If the verification is successful, samhain will only report the signature on the configuration file. If the verification fails, or the key for the configuration file is different from that of the database file, an error message will result.