Samhain | ||
---|---|---|
<<< Previous | Next >>> |
The entropy gatherer to use. 'egd' is the Entropy Gathering Daemon (EGD), 'dev' is /dev/random, 'unix' is the built-in Unix entropy gatherer (similar to EGD), and 'default' will check for /dev/random first, and use 'unix' as fallback.
The path to the EGD socket. Default is localstatedir/lib/samhain/entropy (see the Section called Paths).
Compile in the module to watch for login/logout events.
Compile in the module to check for correct mount options.
Compile in the module to check for files in user home directories (i.e. with paths relative to $HOME for all users).
The username to use when dropping root privileges (default nobody).
The username of the sender for e-mail, or a complete e-mail address. If only a username is given, SENDER@{FQDN_of_local_host} will be used for the sender. Default is daemon.
The recepient(s) for e-mail, seperated by whitespace (max. 8). You can add recepients in the configuration file as well.
Trusted users (must be a comma-separated list of numerical UIDs). Only required if the configuration file must be on a path writeable by others than root and the effective user.
Set host address for time server (default is to use own clock). You can set this in the configuration file as well. An address in the configuration file will take precedence. Note that the simple 'time' service (port 37/tcp) is used.
Set host address for an alternative (backup) time server.
Check file system for SUID/SGID binaries not in the database.
(Linux/FreeBSD only) Check for clobbered kernel syscalls (to detect kernel module rootkits). SYSTEM_MAP must be the path to the System.map file corresponding to the kernel.
Enable stealth mode, and set XOR_VAL. XOR_VAL must be decimal, in the range 127 -- 255, and will be used to obfuscate literal strings.
As --with-stealth, but without steganographic hidden configuration file.
Command line parsing is disabled, but command-line arguments will be read from STDIN if the first command line argument is PW. PW="" (empty string) will disable command line parsing completely. This option may be used as addition to --enable(-micro)-stealth to prevent interactive enforcement of telltale output.
Upon installation, rename every file from samhain (or yule for the server) to NAME. To be used in conjunction with --with-(micro-)stealth.
(Linux only) compile kernel modules to hide all files with NAME (from --enable-install-name=NAME) within the path. By default, NAME is 'samhain' for the client/standalone version, and 'yule' for the server. SYSTEM_MAP must be the path to the System.map file corresponding to the kernel.
Set base key for one-time pads. Must be ONE string (no space) made of TWO comma-separated integers in the range 0 -- 2147483647. Caveat: If this option is not used, a random value will be chosen at compile time (by the configuration script). Binaries compiled with different values cannot verify the audit trail(s) of each other.
Enable reload of file database on SIGHUP (otherwise, only the config file will be read again).
Enable XML format for the log file.
Support logging to a relational database (MySQL, PostgreSQL, Oracle or unixODBC). Oracle and unixODBC are not fully tested.
Enable debugging. Will slow down things, increase resource usage, and may leak information that should be kept secure. Will dump 'core' and 'samhain_backtrace' in the root directory on segfault. Do not use in production code.
Periodically check whether a debugger is attached, and abort if yes. Only takes effect if --enable-debug is not used. Only tested on Linux.
Additional flags to pass to the compiler.
Additional libraries to link with.
Disable support for large files (> 2GB). Large file support is enabled automatically if your system supports it.
<<< Previous | Home | Next >>> |
General | OpenPGP Signatures on Configuration/Database Files |