wheezy.conf.j2 38 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021
  1. {% if ansible_controlled is defined and ansible_controlled != "" %}
  2. #
  3. # {{ ansible_controlled }}
  4. #
  5. {% endif %}
  6. #
  7. # This is the main configuration file for Rootkit Hunter.
  8. #
  9. # You can either modify this file directly, or you can create a local
  10. # configuration file. The local file must be named 'rkhunter.conf.local',
  11. # and must reside in the same directory as this file. Please modify one
  12. # or both files to your own requirements. It is suggested that the
  13. # command 'rkhunter -C' is run after any changes have been made.
  14. #
  15. # Please review the documentation before posting bug reports or questions.
  16. # To report bugs, obtain updates, or provide patches or comments, please go to:
  17. # http://rkhunter.sourceforge.net
  18. #
  19. # To ask questions about rkhunter, please use the rkhunter-users mailing list.
  20. # Note this is a moderated list: please subscribe before posting.
  21. #
  22. # Lines beginning with a hash (#), and blank lines, are ignored.
  23. # End-of-line comments are not supported.
  24. #
  25. # Most of the following options need only be specified once. If
  26. # they appear more than once, then the last one seen will be used.
  27. # Some options are allowed to appear more than once, and the text
  28. # describing the option will say if this is so.
  29. #
  30. # Some of the options are space-separated lists of pathnames. If
  31. # wildcard characters (globbing) are allowed in the list, then the
  32. # text describing the option will say so.
  33. #
  34. # Space-separated lists may be enclosed by quotes, but these must only
  35. # appear at the start and end of the list, not in the middle.
  36. #
  37. # For example: XXX="abc def gh" (correct)
  38. # XXX="abc" "def" "gh" (incorrect)
  39. #
  40. #
  41. # If this option is set to 1, it specifies that the mirrors file
  42. # ('mirrors.dat'), which is used when the '--update' and '--versioncheck'
  43. # options are used, is to be rotated. Rotating the entries in the file
  44. # allows a basic form of load-balancing between the mirror sites whenever
  45. # the above options are used.
  46. # If the option is set to 0, then the mirrors will be treated as if in
  47. # a priority list. That is, the first mirror listed will always be used
  48. # first. The second mirror will only be used if the first mirror fails,
  49. # the third mirror will only be used if the second mirror fails, and so on.
  50. #
  51. # If the mirrors file is read-only, then the '--versioncheck' command-line
  52. # option can only be used if this option is set to 0.
  53. #
  54. ROTATE_MIRRORS=1
  55. #
  56. # If this option is set to 1, it specifies that when the '--update'
  57. # option is used, then the mirrors file is to be checked for updates
  58. # as well. If the current mirrors file contains any local mirrors,
  59. # these will be prepended to the updated file.
  60. # If this option is set to 0, the mirrors file can only be updated
  61. # manually. This may be useful if only using local mirrors.
  62. #
  63. UPDATE_MIRRORS=1
  64. #
  65. # The MIRRORS_MODE option tells rkhunter which mirrors are to be
  66. # used when the '--update' or '--versioncheck' command-line options
  67. # are given. Possible values are:
  68. # 0 - use any mirror (the default)
  69. # 1 - only use local mirrors
  70. # 2 - only use remote mirrors
  71. #
  72. # Local and remote mirrors can be defined in the mirrors file
  73. # by using the 'local=' and 'remote=' keywords respectively.
  74. #
  75. MIRRORS_MODE=0
  76. #
  77. # Email a message to this address if a warning is found when the
  78. # system is being checked. Multiple addresses may be specified
  79. # simply be separating them with a space. Setting this option to
  80. # null disables the option.
  81. #
  82. # NOTE: This option should be present in the configuration file.
  83. #
  84. #MAIL-ON-WARNING=me@mydomain root@mydomain
  85. MAIL-ON-WARNING=""
  86. #
  87. # Specify the mail command to use if MAIL-ON-WARNING is set.
  88. #
  89. # NOTE: Double quotes are not required around the command, but
  90. # are required around the subject line if it contains spaces.
  91. #
  92. MAIL_CMD=mail -s "[rkhunter] Warnings found for ${HOST_NAME}"
  93. #
  94. # Specify the temporary directory to use.
  95. #
  96. # NOTE: Do not use /tmp as your temporary directory. Some
  97. # important files will be written to this directory, so be
  98. # sure that the directory permissions are tight.
  99. #
  100. TMPDIR=/var/lib/rkhunter/tmp
  101. #
  102. # Specify the database directory to use.
  103. #
  104. DBDIR=/var/lib/rkhunter/db
  105. #
  106. # Specify the script directory to use.
  107. #
  108. SCRIPTDIR=/usr/share/rkhunter/scripts
  109. #
  110. # This option can be used to modify the command directory list used
  111. # by rkhunter to locate commands (that is, its PATH). By default
  112. # this will be the root PATH, and an internal list of some common
  113. # command directories.
  114. #
  115. # Any directories specified here will, by default, be appended to the
  116. # default list. However, if a directory name begins with the '+'
  117. # character, then that directory will be prepended to the list (that
  118. # is, it will be put at the start of the list).
  119. #
  120. # This is a space-separated list of directory names. The option may
  121. # be specified more than once.
  122. #
  123. #BINDIR="/bin /usr/bin /sbin /usr/sbin"
  124. #BINDIR="+/usr/local/bin +/usr/local/sbin"
  125. #
  126. # Specify the default language to use. This should be similar
  127. # to the ISO 639 language code.
  128. #
  129. # NOTE: Please ensure that the language you specify is supported.
  130. # For a list of supported languages use the following command:
  131. #
  132. # rkhunter --lang en --list languages
  133. #
  134. #LANGUAGE=en
  135. #
  136. # This option is a space-separated list of the languages that are to
  137. # be updated when the '--update' option is used. If unset, then all
  138. # the languages will be updated. If none of the languages are to be
  139. # updated, then set this option to just 'en'.
  140. #
  141. # The default is for all the languages to be updated. The default
  142. # language, specified above, and the English (en) language file will
  143. # always be updated regardless of this option.
  144. #
  145. UPDATE_LANG=""
  146. #
  147. # Specify the log file pathname.
  148. #
  149. # NOTE: This option should be present in the configuration file.
  150. #
  151. LOGFILE=/var/log/rkhunter.log
  152. #
  153. # Set the following option to 1 if the log file is to be appended to
  154. # whenever rkhunter is run.
  155. #
  156. APPEND_LOG=0
  157. #
  158. # Set the following option to 1 if the log file is to be copied when
  159. # rkhunter finishes and an error or warning has occurred. The copied
  160. # log file name will be appended with the current date and time
  161. # (in YYYY-MM-DD_HH:MM:SS format).
  162. # For example: rkhunter.log.2009-04-21_00:57:51
  163. #
  164. COPY_LOG_ON_ERROR=0
  165. #
  166. # Set the following option to enable the rkhunter check start and finish
  167. # times to be logged by syslog. Warning messages will also be logged.
  168. # The value of the option must be a standard syslog facility and
  169. # priority, separated by a dot. For example:
  170. #
  171. # USE_SYSLOG=authpriv.warning
  172. #
  173. # Setting the value to 'none', or just leaving the option commented out,
  174. # disables the use of syslog.
  175. #
  176. #USE_SYSLOG=authpriv.notice
  177. #
  178. # Set the following option to 1 if the second colour set is to be used.
  179. # This can be useful if your screen uses black characters on a white
  180. # background (for example, a PC instead of a server).
  181. #
  182. COLOR_SET2=0
  183. #
  184. # Set the following option to 0 if rkhunter should not detect if X is
  185. # being used. If X is detected as being used, then the second colour
  186. # set will automatically be used.
  187. #
  188. AUTO_X_DETECT=1
  189. #
  190. # Set the following option to 1 if it is wanted that any 'Whitelisted'
  191. # results are shown in white rather than green. For colour set 2 users,
  192. # setting this option will cause the result to be shown in black.
  193. #
  194. WHITELISTED_IS_WHITE=0
  195. #
  196. # The following option is checked against the SSH configuration file
  197. # 'PermitRootLogin' option. A warning will be displayed if they do not
  198. # match. However, if a value has not been set in the SSH configuration
  199. # file, then a value here of 'unset' can be used to avoid warning messages.
  200. # This option has a default value of 'no'.
  201. #
  202. ALLOW_SSH_ROOT_USER=without-password
  203. #
  204. # Set this option to '1' to allow the use of the SSH-1 protocol, but note
  205. # that theoretically it is weaker, and therefore less secure, than the
  206. # SSH-2 protocol. Do not modify this option unless you have good reasons
  207. # to use the SSH-1 protocol (for instance for AFS token passing or Kerberos4
  208. # authentication). If the 'Protocol' option has not been set in the SSH
  209. # configuration file, then a value of '2' may be set here in order to
  210. # suppress a warning message. This option has a default value of '0'.
  211. #
  212. ALLOW_SSH_PROT_V1=0
  213. #
  214. # This setting tells rkhunter the directory containing the SSH configuration
  215. # file. This setting will be worked out by rkhunter, and so should not
  216. # usually need to be set.
  217. #
  218. #SSH_CONFIG_DIR=/etc/ssh
  219. #
  220. # These two options determine which tests are to be performed.
  221. # The ENABLE_TESTS option can use the word 'all' to refer to all the
  222. # available tests. The DISABLE_TESTS option can use the word 'none' to
  223. # mean that no tests are disabled. The list of disabled tests is applied to
  224. # the list of enabled tests. Both options are space-separated lists of test
  225. # names. The currently available test names can be seen by using the command
  226. # 'rkhunter --list tests'.
  227. #
  228. # The program defaults are to enable all tests and disable none. However, if
  229. # either of the options below are specified, then they will override the
  230. # program defaults.
  231. #
  232. # The supplied configuration file has some tests already disabled, and these
  233. # are tests that will be used only occasionally, can be considered
  234. # "advanced" or that are prone to produce more than the average number of
  235. # false-positives.
  236. #
  237. # Please read the README file for more details about enabling and disabling
  238. # tests, the test names, and how rkhunter behaves when these options are used.
  239. #
  240. # hidden_procs test requires the unhide command which is part of the unhide
  241. # package in Debian.
  242. #
  243. # apps test is disabled by default as it triggers warnings about outdated
  244. # applications (and warns about possible security risk: we better trust
  245. # the Debian Security Team).
  246. #
  247. ENABLE_TESTS="all"
  248. {% set disable_tests = [] %}
  249. {% if not ansible_virtualization_role is defined or ansible_virtualization_role != 'guest' %}
  250. {% if disable_tests.append('os_specific') %}{% endif %}
  251. {%- endif %}
  252. {% if not ansible_virtualization_role is defined or ansible_virtualization_role != 'host' %}
  253. {% if disable_tests.append('promisc') %}{% endif %}
  254. {%- endif %}
  255. DISABLE_TESTS="suspscan hidden_procs deleted_files packet_cap_apps apps {{ disable_tests|join(' ') }}"
  256. #
  257. # The HASH_FUNC option can be used to specify the command to use
  258. # for the file hash value check. It can be specified as just the
  259. # command name or the full pathname. If just the command name is
  260. # given, and it is one of MD5, SHA1, SHA224, SHA256, SHA384 or
  261. # SHA512, then rkhunter will first look for the relevant command,
  262. # such as 'sha256sum', and then for 'sha256'. If neither of these
  263. # are found, it will then look to see if a perl module has been
  264. # installed which will support the relevant hash function. To see
  265. # which perl modules have been installed use the command
  266. # 'rkhunter --list perl'.
  267. #
  268. # The default is SHA1, or MD5 if SHA1 cannot be found.
  269. #
  270. # Systems using prelinking are restricted to using either the
  271. # SHA1 or MD5 function.
  272. #
  273. # A value of 'NONE' (in uppercase) can be specified to indicate that
  274. # no hash function should be used. Rootkit Hunter will detect this and
  275. # automatically disable the file hash checks.
  276. #
  277. # Examples:
  278. # For Solaris 9 : HASH_FUNC=gmd5sum
  279. # For Solaris 10: HASH_FUNC=sha1sum
  280. # For AIX (>5.2): HASH_FUNC="csum -hMD5"
  281. # For NetBSD : HASH_FUNC="cksum -a sha512"
  282. #
  283. # NOTE: If the hash function is changed then you MUST run rkhunter with
  284. # the '--propupd' option to rebuild the file properties database.
  285. #
  286. #HASH_FUNC=sha1sum
  287. #
  288. # The HASH_FLD_IDX option specifies which field from the HASH_FUNC
  289. # command output contains the hash value. The fields are assumed to
  290. # be space-separated. The default value is 1, but for *BSD users
  291. # rkhunter will, by default, use a value of 4 if the HASH_FUNC option
  292. # has not been set. The option value must be an integer greater
  293. # than zero.
  294. #
  295. #HASH_FLD_IDX=4
  296. #
  297. # The PKGMGR option tells rkhunter to use the specified package manager
  298. # to obtain the file property information. This is used when updating
  299. # the file properties file ('rkhunter.dat'), and when running the file
  300. # properties check. For RedHat/RPM-based systems, 'RPM' can be used to
  301. # get information from the RPM database. For Debian-based systems 'DPKG'
  302. # can be used, for *BSD systems 'BSD' can be used, and for Solaris
  303. # systems 'SOLARIS' can be used. No value, or a value of 'NONE',
  304. # indicates that no package manager is to be used. The default is 'NONE'.
  305. #
  306. # The current package managers, except 'SOLARIS', store the file hash
  307. # values using an MD5 hash function. The Solaris package manager includes
  308. # a checksum value, but this is not used by default (see USE_SUNSUM below).
  309. #
  310. # The 'DPKG' and 'BSD' package managers only provide MD5 hash values.
  311. # The 'RPM' package manager additionally provides values for the inode,
  312. # file permissions, uid, gid and other values. The 'SOLARIS' also provides
  313. # most of the values, similar to 'RPM', but not the inode number.
  314. #
  315. # For any file not part of a package, rkhunter will revert to using the
  316. # HASH_FUNC hash function instead.
  317. #
  318. # Whenever this option is changed 'rkhunter --propupd' must be run.
  319. #
  320. # NONE is the default for Debian as well, as running --propupd takes
  321. # about 4 times longer when it's set to DPKG
  322. #
  323. #PKGMGR=NONE
  324. #
  325. # It is possible that a file which is part of a package may be modified
  326. # by the administrator. Typically this occurs for configuration files.
  327. # However, the package manager may list the file as being modified. For
  328. # the RPM package manager this may well depend on how the package was
  329. # built. This option specifies those pathnames which are to be exempt
  330. # from the package manager verification process, and which will be treated
  331. # as non-packaged files. As such, the file properties are still checked.
  332. #
  333. # This option only takes effect if the PKGMGR option has been set, and
  334. # is not 'NONE'.
  335. #
  336. # This is a space-separated list of pathnames. The option may
  337. # be specified more than once.
  338. #
  339. # Whenever this option is changed 'rkhunter --propupd' must be run.
  340. #
  341. #PKGMGR_NO_VRFY=""
  342. #
  343. # This option can be used to tell rkhunter to ignore any prelink
  344. # dependency errors for the given commands. However, a warning will also
  345. # be issued if the error does not occur for a given command. As such
  346. # this option must only be used on commands which experience a persistent
  347. # problem.
  348. #
  349. # Short-term prelink dependency errors can usually be resolved simply by
  350. # running the 'prelink' command on the given pathname.
  351. #
  352. # NOTE: The command 'rkhunter --propupd' must be run whenever this option
  353. # is changed.
  354. #
  355. # This is a space-separated list of command pathnames. The option can be
  356. # specified more than once.
  357. #
  358. #IGNORE_PRELINK_DEP_ERR="/bin/ps /usr/bin/top"
  359. #
  360. # If the 'SOLARIS' package manager is used, then it is possible to use
  361. # the checksum (hash) value stored for a file. However, this is only a
  362. # 16-bit checksum, and as such is not nearly as secure as, for example,
  363. # a SHA-2 value. For that reason, the checksum is not used by default,
  364. # and the hash function given by HASH_FUNC is used instead. To enable
  365. # this option, set its value to 1. The Solaris 'sum' command must be
  366. # present on the system if this option is used.
  367. #
  368. #USE_SUNSUM=0
  369. #
  370. # This option is a space-separated list of commands, directories and file
  371. # pathnames which will be included in the file properties checks.
  372. # This option can be specified more than once.
  373. #
  374. # Whenever this option is changed, 'rkhunter --propupd' must be run.
  375. #
  376. # Simple command names - for example, 'top' - and directory names are
  377. # added to the internal list of directories to be searched for each of
  378. # the command names in the command list. Additionally, full pathnames
  379. # to files, which need not be commands, may be given. Any files or
  380. # directories which are already part of the internal lists will be
  381. # silently ignored from the configuration.
  382. #
  383. # Normal globbing wildcards are allowed, except for simple command names.
  384. # For example, 'top*' cannot be given, but '/usr/bin/top*' is allowed.
  385. #
  386. # Specific files may be excluded by preceding their name with an
  387. # exclamation mark (!). For example, '!/opt/top'. By combining this
  388. # with wildcarding, whole directories can be excluded. For example,
  389. # '/etc/* /etc/*/* !/etc/rc?.d/*'. This will look for files in the first
  390. # two directory levels of '/etc'. However, anything in '/etc/rc0.d',
  391. # '/etc/rc1.d', '/etc/rc2.d' and so on, will be excluded.
  392. #
  393. # NOTE: Only files and directories which have been added by the user,
  394. # and are not part of the internal lists, can be excluded. So, for
  395. # example, it is not possible to exclude the 'ps' command by using
  396. # '!/bin/ps'. These will be silently ignored from the configuration.
  397. #
  398. #USER_FILEPROP_FILES_DIRS="top /usr/local/sbin !/opt/ps*"
  399. #USER_FILEPROP_FILES_DIRS="/etc/rkhunter.conf"
  400. #USER_FILEPROP_FILES_DIRS="/etc/rkhunter.conf.local"
  401. #USER_FILEPROP_FILES_DIRS="/var/lib/rkhunter/db/*"
  402. #USER_FILEPROP_FILES_DIRS="!/var/lib/rkhunter/db/mirrors.dat"
  403. #USER_FILEPROP_FILES_DIRS="!/var/lib/rkhunter/db/rkhunter*"
  404. #USER_FILEPROP_FILES_DIRS="/var/lib/rkhunter/db/i18n/*"
  405. #
  406. # This option whitelists files and directories from existing,
  407. # or not existing, on the system at the time of testing. This
  408. # option is used when the configuration file options themselves
  409. # are checked, and during the file properties check, the hidden
  410. # files and directories checks, and the filesystem check of the
  411. # '/dev' directory.
  412. #
  413. # This is a space-separated list of pathnames. The option may be
  414. # specified more than once. The option may use wildcard characters,
  415. # but be aware that this is probably not what you want to do as the
  416. # wildcarding will be expanded after files have been deleted. As
  417. # such deleted files won't be whitelisted if wildcarded.
  418. #
  419. # NOTE: The user must take into consideration how often the file will
  420. # appear and disappear from the system in relation to how often
  421. # rkhunter is run. If the file appears, and disappears, too often
  422. # then rkhunter may not notice this. All it will see is that the file
  423. # has changed. The inode-number and DTM will certainly be different
  424. # for each new file, and rkhunter will report this.
  425. #
  426. #EXISTWHITELIST=""
  427. #
  428. # Whitelist various attributes of the specified files.
  429. # The attributes are those of the 'attributes' test.
  430. # Specifying a file name here does not include it being
  431. # whitelisted for the write permission test (see below).
  432. #
  433. # This is a space-separated list of filenames. The option may
  434. # be specified more than once. The option may use wildcard
  435. # characters.
  436. #
  437. #ATTRWHITELIST="/bin/ps /usr/bin/date"
  438. #
  439. # Allow the specified commands to have the 'others'
  440. # (world) permission have the write-bit set.
  441. #
  442. # For example, files with permissions r-xr-xrwx
  443. # or rwxrwxrwx.
  444. #
  445. # This is a space-separated list of filenames. The option may
  446. # be specified more than once. The option may use wildcard
  447. # characters.
  448. #
  449. #WRITEWHITELIST="/bin/ps /usr/bin/date"
  450. #
  451. # Allow the specified commands to be scripts.
  452. #
  453. # This is a space-separated list of filenames. The option may
  454. # be specified more than once. The option may use wildcard
  455. # characters.
  456. #
  457. SCRIPTWHITELIST=/bin/egrep
  458. SCRIPTWHITELIST=/bin/fgrep
  459. SCRIPTWHITELIST=/bin/which
  460. SCRIPTWHITELIST=/usr/bin/groups
  461. SCRIPTWHITELIST=/usr/bin/ldd
  462. SCRIPTWHITELIST=/usr/bin/lwp-request
  463. SCRIPTWHITELIST=/usr/sbin/adduser
  464. SCRIPTWHITELIST=/usr/sbin/prelink
  465. #
  466. # Allow the specified commands to have the immutable attribute set.
  467. #
  468. # This is a space-separated list of filenames. The option may
  469. # be specified more than once. The option may use wildcard
  470. # characters.
  471. #
  472. #IMMUTWHITELIST="/sbin/ifup /sbin/ifdown"
  473. #
  474. # If this option is set to 1, then the immutable-bit test is
  475. # reversed. That is, the files are expected to have the bit set.
  476. #
  477. IMMUTABLE_SET=0
  478. #
  479. # Allow the specified hidden directories to be whitelisted.
  480. #
  481. # This is a space-separated list of directory pathnames.
  482. # The option may be specified more than once. The option
  483. # may use wildcard characters.
  484. #
  485. ALLOWHIDDENDIR="/etc/.java"
  486. ALLOWHIDDENDIR="/dev/.udev"
  487. #ALLOWHIDDENDIR="/dev/.static"
  488. ALLOWHIDDENDIR="/dev/.initramfs"
  489. #ALLOWHIDDENDIR="/dev/.SRC-unix"
  490. ALLOWHIDDENDIR="/dev/.mdadm"
  491. ALLOWHIDDENDIR="/etc/.git"
  492. #
  493. # Allow the specified hidden files to be whitelisted.
  494. #
  495. # This is a space-separated list of filenames. The option may
  496. # be specified more than once. The option may use wildcard
  497. # characters.
  498. #
  499. #ALLOWHIDDENFILE="/etc/.java"
  500. #ALLOWHIDDENFILE="/usr/share/man/man1/..1.gz"
  501. #ALLOWHIDDENFILE="/etc/.pwd.lock"
  502. #ALLOWHIDDENFILE="/etc/.init.state"
  503. #ALLOWHIDDENFILE="/lib/.libcrypto.so.0.9.8e.hmac /lib/.libcrypto.so.6.hmac"
  504. #ALLOWHIDDENFILE="/lib/.libssl.so.0.9.8e.hmac /lib/.libssl.so.6.hmac"
  505. #ALLOWHIDDENFILE="/usr/bin/.fipscheck.hmac"
  506. #ALLOWHIDDENFILE="/usr/bin/.ssh.hmac"
  507. #ALLOWHIDDENFILE="/usr/lib/.libfipscheck.so.1.1.0.hmac"
  508. #ALLOWHIDDENFILE="/usr/lib/.libfipscheck.so.1.hmac"
  509. #ALLOWHIDDENFILE="/usr/lib/.libgcrypt.so.11.hmac"
  510. #ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha1hmac.hmac"
  511. #ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha256hmac.hmac"
  512. #ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha384hmac.hmac"
  513. #ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha512hmac.hmac"
  514. #ALLOWHIDDENFILE="/usr/sbin/.sshd.hmac"
  515. #ALLOWHIDDENFILE="/usr/share/man/man5/.k5login.5.gz"
  516. #ALLOWHIDDENFILE="/etc/.gitignore"
  517. #ALLOWHIDDENFILE="/etc/.bzrignore"
  518. ALLOWHIDDENFILE="/etc/.etckeeper"
  519. ALLOWHIDDENFILE="/etc/.gitignore"
  520. #
  521. # Allow the specified processes to use deleted files. The
  522. # process name may be followed by a colon-separated list of
  523. # full pathnames. The process will then only be whitelisted
  524. # if it is using one of the given files. For example:
  525. #
  526. # ALLOWPROCDELFILE="/usr/libexec/gconfd-2:/tmp/abc:/var/tmp/xyz"
  527. #
  528. # This is a space-separated list of process names. The option
  529. # may be specified more than once. The option may use wildcard
  530. # characters, but only in the file names.
  531. #
  532. #ALLOWPROCDELFILE="/sbin/cardmgr /usr/sbin/gpm:/etc/X11/abc"
  533. #ALLOWPROCDELFILE="/usr/lib/libgconf2-4/gconfd-2"
  534. #ALLOWPROCDELFILE="/usr/sbin/mysqld:/tmp/ib*"
  535. #ALLOWPROCDELFILE="/usr/lib/iceweasel/firefox-bin"
  536. #ALLOWPROCDELFILE="/usr/bin/file-roller"
  537. #
  538. # Allow the specified processes to listen on any network interface.
  539. #
  540. # This is a space-separated list of process names. The option
  541. # may be specified more than once.
  542. #
  543. #ALLOWPROCLISTEN="/sbin/dhclient /usr/bin/dhcpcd"
  544. #ALLOWPROCLISTEN="/usr/sbin/pppoe /usr/sbin/tcpdump"
  545. #ALLOWPROCLISTEN="/usr/sbin/snort-plain"
  546. #
  547. # Allow the specified network interfaces to be in promiscuous mode.
  548. #
  549. # This is a space-separated list of interface names. The option may
  550. # be specified more than once.
  551. #
  552. #ALLOWPROMISCIF="eth0"
  553. #
  554. # SCAN_MODE_DEV governs how we scan '/dev' for suspicious files.
  555. # The two allowed options are: THOROUGH or LAZY.
  556. # If commented out we do a THOROUGH scan which will increase the runtime.
  557. # Even though this adds to the running time it is highly recommended to
  558. # leave it like this.
  559. #
  560. #SCAN_MODE_DEV=THOROUGH
  561. #
  562. # The PHALANX2_DIRTEST option is used to indicate if the Phalanx2 test is to
  563. # perform a basic check, or a more thorough check. If the option is set to 0,
  564. # then a basic check is performed. If it is set to 1, then all the directries
  565. # in the /etc and /usr directories are scanned. The default value is 0. Users
  566. # should note that setting this option to 1 will cause the test to take longer
  567. # to complete.
  568. #
  569. PHALANX2_DIRTEST=0
  570. #
  571. # Allow the specified files to be present in the /dev directory,
  572. # and not regarded as suspicious.
  573. #
  574. # This is a space-separated list of pathnames. The option may
  575. # be specified more than once. The option may use wildcard
  576. # characters.
  577. #
  578. ALLOWDEVFILE=/dev/shm/network/ifstate
  579. #ALLOWDEVFILE="/dev/shm/pulse-shm-*"
  580. #ALLOWDEVFILE="/dev/shm/sem.ADBE_*"
  581. #
  582. # This setting tells rkhunter where the inetd configuration
  583. # file is located.
  584. #
  585. #INETD_CONF_PATH=/etc/inetd.conf
  586. #
  587. # Allow the following enabled inetd services.
  588. #
  589. # This is a space-separated list of service names. The option may
  590. # be specified more than once.
  591. #
  592. # For non-Solaris users the simple service name should be used.
  593. # For example:
  594. #
  595. # INETD_ALLOWED_SVC=echo
  596. #
  597. # For Solaris 9 users the simple service name should also be used, but
  598. # if it is an RPC service, then the executable pathname should be used.
  599. # For example:
  600. #
  601. # INETD_ALLOWED_SVC=imaps
  602. # INETD_ALLOWED_SVC="/usr/sbin/rpc.metad /usr/sbin/rpc.metamhd"
  603. #
  604. # For Solaris 10 users the service/FMRI name should be used. For example:
  605. #
  606. # INETD_ALLOWED_SVC=/network/rpc/meta
  607. # INETD_ALLOWED_SVC=/network/rpc/metamed
  608. # INETD_ALLOWED_SVC=/application/font/stfsloader
  609. # INETD_ALLOWED_SVC=/network/rpc-100235_1/rpc_ticotsord
  610. #
  611. #INETD_ALLOWED_SVC=echo
  612. #
  613. # This setting tells rkhunter where the xinetd configuration
  614. # file is located.
  615. #
  616. #XINETD_CONF_PATH=/etc/xinetd.conf
  617. #
  618. # Allow the following enabled xinetd services. Whilst it would be
  619. # nice to use the service names themselves, at the time of testing
  620. # we only have the pathname available. As such, these entries are
  621. # the xinetd file pathnames.
  622. #
  623. # This is a space-separated list of service names. The option may
  624. # be specified more than once.
  625. #
  626. #XINETD_ALLOWED_SVC=/etc/xinetd.d/echo
  627. #
  628. # This option tells rkhunter the local system startup file pathnames.
  629. # The directories will be searched for files. By default rkhunter
  630. # will use certain filenames and directories. If the option is set
  631. # to 'none', then certain tests will be skipped.
  632. #
  633. # This is a space-separated list of file and directory pathnames.
  634. # The option may be specified more than once. The option may use
  635. # wildcard characters.
  636. #
  637. #STARTUP_PATHS="/etc/init.d /etc/rc.local"
  638. #
  639. # This setting tells rkhunter the pathname to the file containing the
  640. # user account passwords. This setting will be worked out by rkhunter,
  641. # and so should not usually need to be set. Users of TCB shadow files
  642. # should not set this option.
  643. #
  644. #PASSWORD_FILE=/etc/shadow
  645. #
  646. # Allow the following accounts to be root equivalent. These accounts
  647. # will have a UID value of zero. The 'root' account does not need to
  648. # be listed as it is automatically whitelisted.
  649. #
  650. # This is a space-separated list of account names. The option may
  651. # be specified more than once.
  652. #
  653. # NOTE: For *BSD systems you will probably need to use this option
  654. # for the 'toor' account.
  655. #
  656. #UID0_ACCOUNTS="toor rooty sashroot"
  657. #
  658. # Allow the following accounts to have no password. NIS/YP entries do
  659. # not need to be listed as they are automatically whitelisted.
  660. #
  661. # This is a space-separated list of account names. The option may
  662. # be specified more than once.
  663. #
  664. #PWDLESS_ACCOUNTS="abc"
  665. #
  666. # This setting tells rkhunter the pathname to the syslog configuration
  667. # file. This setting will be worked out by rkhunter, and so should not
  668. # usually need to be set. A value of 'NONE' can be used to indicate
  669. # that there is no configuration file, but that the syslog daemon process
  670. # may be running.
  671. #
  672. # This is a space-separated list of pathnames. The option may
  673. # be specified more than once.
  674. #
  675. #SYSLOG_CONFIG_FILE=/etc/syslog.conf
  676. #
  677. # This option permits the use of syslog remote logging.
  678. #
  679. ALLOW_SYSLOG_REMOTE_LOGGING=0
  680. #
  681. # Allow the following applications, or a specific version of an application,
  682. # to be whitelisted. This option may be specified more than once, and is a
  683. # space-separated list consisting of the application names. If a specific
  684. # version is to be whitelisted, then the name must be followed by a colon
  685. # and then the version number. For example:
  686. #
  687. # APP_WHITELIST="openssl:0.9.7d gpg httpd:1.3.29"
  688. #
  689. # Note above that for the Apache web server, the name 'httpd' is used.
  690. #
  691. #APP_WHITELIST=""
  692. #
  693. # Scan for suspicious files in directories containing temporary files and
  694. # directories posing a relatively higher risk due to user write access.
  695. # Please do not enable by default as suspscan is CPU and I/O intensive and prone to
  696. # producing false positives. Do review all settings before usage.
  697. # Also be aware that running suspscan in combination with verbose logging on,
  698. # RKH's default, will show all ignored files.
  699. # Please consider adding all directories the user the (web)server runs as has
  700. # write access to including the document root (example: "/var/www") and log
  701. # directories (example: "/var/log/httpd").
  702. #
  703. # This is a space-separated list of directory pathnames.
  704. # The option may be specified more than once.
  705. #
  706. SUSPSCAN_DIRS="/tmp /var/tmp"
  707. #
  708. # Directory for temporary files. A memory-based one is better (faster).
  709. # Do not use a directory name that is listed in SUSPSCAN_DIRS.
  710. # Please make sure you have a tempfs mounted and the directory exists.
  711. #
  712. SUSPSCAN_TEMP=/dev/shm
  713. #
  714. # Maximum filesize in bytes. Files larger than this will not be inspected.
  715. # Do make sure you have enough space left in your temporary files directory.
  716. #
  717. SUSPSCAN_MAXSIZE=10240000
  718. #
  719. # Score threshold. Below this value no hits will be reported.
  720. # A value of "200" seems "good" after testing on malware. Please adjust
  721. # locally if necessary.
  722. #
  723. SUSPSCAN_THRESH=200
  724. #
  725. # The following option can be used to whitelist network ports which
  726. # are known to have been used by malware. This option may be specified
  727. # more than once. The option is a space-separated list of one or more
  728. # of four types of whitelisting. These are:
  729. #
  730. # 1) a 'protocol:port' pair (e.g. TCP:25)
  731. # 2) a pathname to an executable (e.g. /usr/sbin/squid)
  732. # 3) a combined pathname, protocol and port
  733. # (e.g. /usr/sbin/squid:TCP:3801)
  734. # 4) an asterisk ('*')
  735. #
  736. # Only the UDP or TCP protocol may be specified, and the port number
  737. # must be between 1 and 65535 inclusive.
  738. #
  739. # The asterisk can be used to indicate that any executable which rkhunter
  740. # can locate as a command, is whitelisted. (See BINDIR in this file.)
  741. #
  742. # For example:
  743. #
  744. # PORT_WHITELIST="/home/user1/abc /opt/xyz TCP:2001 UDP:32011"
  745. #
  746. # NOTE: In order to whitelist a pathname, or use the asterisk option,
  747. # the 'lsof' command must be present.
  748. #
  749. #PORT_WHITELIST=""
  750. #
  751. # The following option can be used to tell rkhunter where the operating
  752. # system 'release' file is located. This file contains information
  753. # specifying the current O/S version. RKH will store this information
  754. # itself, and check to see if it has changed between each run. If it has
  755. # changed, then the user is warned that RKH may issue warning messages
  756. # until RKH has been run with the '--propupd' option.
  757. #
  758. # Since the contents of the file vary according to the O/S distribution,
  759. # RKH will perform different actions when it detects the file itself. As
  760. # such, this option should not be set unless necessary. If this option is
  761. # specified, then RKH will assume the O/S release information is on the
  762. # first non-blank line of the file.
  763. #
  764. #OS_VERSION_FILE="/etc/debian_version"
  765. #
  766. # The following two options can be used to whitelist files and directories
  767. # that would normally be flagged with a warning during the various rootkit
  768. # and malware checks. If the file or directory name contains a space, then
  769. # the percent character ('%') must be used instead. Only existing files and
  770. # directories can be specified, and these must be full pathnames not links.
  771. #
  772. # Additionally, the RTKT_FILE_WHITELIST option may include a string after the
  773. # file name (separated by a colon). This will then only whitelist that string
  774. # in that file (as part of the malware checks). For example:
  775. #
  776. # RTKT_FILE_WHITELIST="/etc/rc.local:hdparm"
  777. #
  778. # If the option list includes the filename on its own as well, then the file
  779. # will be whitelisted from rootkit checks of the files existence, but still
  780. # only the specific string within the file will be whitelisted. For example:
  781. #
  782. # RTKT_FILE_WHITELIST="/etc/rc.local:hdparm /etc/rc.local"
  783. #
  784. # To whitelist a file from the existence checks, but not from the strings
  785. # checks, then include the filename on its own and on its own but with
  786. # just a colon appended. For example:
  787. #
  788. # RTKT_FILE_WHITELIST="/etc/rc.local /etc/rc.local:"
  789. #
  790. # NOTE: It is recommended that if you whitelist any files, then you include
  791. # those files in the file properties check. See the USER_FILEPROP_FILES_DIRS
  792. # configuration option.
  793. #
  794. # These are space-separated lists of file and directory pathnames.
  795. # The options may be specified more than once.
  796. #
  797. #RTKT_DIR_WHITELIST=""
  798. #RTKT_FILE_WHITELIST=""
  799. #
  800. # The following option can be used to whitelist shared library files that would
  801. # normally be flagged with a warning during the preloaded shared library check.
  802. # These library pathnames usually exist in the '/etc/ld.so.preload' file or in
  803. # the LD_PRELOAD environment variable.
  804. #
  805. # NOTE: It is recommended that if you whitelist any files, then you include
  806. # those files in the file properties check. See the USER_FILEPROP_FILES_DIRS
  807. # configuration option.
  808. #
  809. # This is a space-separated list of library pathnames.
  810. # The option may be specified more than once.
  811. #
  812. #SHARED_LIB_WHITELIST="/lib/snoopy.so"
  813. #
  814. # To force rkhunter to use the supplied script for the 'stat' or 'readlink'
  815. # command, then the following two options can be used. The value must be
  816. # set to 'BUILTIN'.
  817. #
  818. # NOTE: IRIX users will probably need to enable STAT_CMD.
  819. #
  820. #STAT_CMD=BUILTIN
  821. #READLINK_CMD=BUILTIN
  822. #
  823. # In the file properties test any modification date/time is displayed as the
  824. # number of epoch seconds. Rkhunter will try and use the 'date' command, or
  825. # failing that the 'perl' command, to display the date and time in a
  826. # human-readable format as well. This option may be used if some other command
  827. # should be used instead. The given command must understand the '%s' and
  828. # 'seconds ago' options found in the GNU date command.
  829. #
  830. # A value of 'NONE' may be used to request that only the epoch seconds be shown.
  831. # A value of 'PERL' may be used to force rkhunter to use the 'perl' command, if
  832. # it is present.
  833. #
  834. #EPOCH_DATE_CMD=""
  835. #
  836. # This setting tells rkhunter the directory containing the available
  837. # Linux kernel modules. This setting will be worked out by rkhunter,
  838. # and so should not usually need to be set.
  839. #
  840. #MODULES_DIR=""
  841. #
  842. # The following option can be set to a command which rkhunter will use when
  843. # downloading files from the Internet - that is, when the '--update' or
  844. # '--versioncheck' option is used. The command can take options.
  845. #
  846. # This allows the user to use a command other than the one automatically
  847. # selected by rkhunter, but still one which it already knows about.
  848. # For example:
  849. #
  850. # WEB_CMD=curl
  851. #
  852. # Alternatively, the user may specify a completely new command. However, note
  853. # that rkhunter expects the downloaded file to be written to stdout, and that
  854. # everything written to stderr is ignored. For example:
  855. #
  856. # WEB_CMD="/opt/bin/dlfile --timeout 5m -q"
  857. #
  858. # *BSD users may want to use the 'ftp' command, provided that it supports
  859. # the HTTP protocol:
  860. #
  861. # WEB_CMD="ftp -o -"
  862. #
  863. #WEB_CMD=""
  864. #
  865. # Set the following option to 0 if you do not want to receive a warning if
  866. # any O/S information has changed since the last run of 'rkhunter --propupd'.
  867. # The warnings occur during the file properties check. The default is to
  868. # issue a warning if something has changed.
  869. #
  870. #WARN_ON_OS_CHANGE=1
  871. #
  872. # Set the following option to 1 if you want rkhunter to automatically run
  873. # a file properties update ('--propupd') if the O/S has changed. Detection
  874. # of an O/S change occurs during the file properties check. The default is
  875. # not to do an automatic update.
  876. #
  877. # WARNING: Only set this option if you are sure that the update will work
  878. # correctly. That is, that the database directory is writeable, that a valid
  879. # hash function is available, and so on. This can usually be checked simply
  880. # by running 'rkhunter --propupd' at least once.
  881. #
  882. #UPDT_ON_OS_CHANGE=0
  883. #
  884. # Set the following option to 1 if locking is to be used when rkhunter runs.
  885. # The lock is set just before logging starts, and is removed when the program
  886. # ends. It is used to prevent items such as the log file, and the file
  887. # properties file, from becoming corrupted if rkhunter is running more than
  888. # once. The mechanism used is to simply create a lock file in the TMPDIR
  889. # directory. If the lock file already exists, because rkhunter is already
  890. # running, then the current process simply loops around sleeping for 10 seconds
  891. # and then retrying the lock.
  892. #
  893. # The default is not to use locking.
  894. #
  895. USE_LOCKING=0
  896. #
  897. # If locking is used, then rkhunter may have to wait to get the lock file.
  898. # This option sets the total amount of time, in seconds, that rkhunter should
  899. # wait. It will retry the lock every 10 seconds, until either it obtains the
  900. # lock or the timeout value has been reached. If no value is set, then a
  901. # default of 300 seconds (5 minutes) is used.
  902. #
  903. LOCK_TIMEOUT=300
  904. #
  905. # If locking is used, then rkhunter may be doing nothing for some time if it
  906. # has to wait for the lock. Some simple messages are echo'd to the users screen
  907. # to let them know that rkhunter is waiting for the lock. Set this option to 0
  908. # if the messages are not to be displayed. The default is to show them.
  909. #
  910. SHOW_LOCK_MSGS=1
  911. #
  912. # If the option SCANROOTKITMODE is set to "THOROUGH" the scanrootkit() function
  913. # will search (on a per rootkit basis) for filenames in all of the directories (as defined
  914. # by the result of running 'find / -xdev'). While still not optimal, as it
  915. # still searches for only file names as opposed to file contents, this is one step away
  916. # from the rigidity of searching in known (evidence) or default (installation) locations.
  917. #
  918. # THIS OPTION SHOULD NOT BE ENABLED BY DEFAULT.
  919. #
  920. # You should only activate this feature as part of a more thorough investigation which
  921. # should be based on relevant best practices and procedures.
  922. #
  923. # Enabling this feature implies you have the knowledge to interpret the results properly.
  924. #
  925. #SCANROOTKITMODE=THOROUGH
  926. #
  927. # The following option can be set to the name(s) of the tests the 'unhide' command is
  928. # to use. In order to maintain compatibility with older versions of 'unhide', this
  929. # option defaults to 'sys'. Options such as '-m' and '-v' may also be specified, but
  930. # will only take effect when they are seen. The test names are a space-separated list,
  931. # and will be executed in the order given.
  932. #
  933. #UNHIDE_TESTS="sys"
  934. #
  935. # If both the C 'unhide', and Ruby 'unhide.rb', programs exist on the system, then it
  936. # is possible to disable the execution of one of the programs if desired. By default
  937. # rkhunter will look for both programs, and execute each of them as they are found.
  938. # If the value of this option is 0, then both programs will be executed if they are
  939. # present. A value of 1 will disable execution of the C 'unhide' program, and a value
  940. # of 2 will disable the Ruby 'unhide.rb' program. The default value is 0. To disable
  941. # both programs, then disable the 'hidden_procs' test.
  942. #
  943. DISABLE_UNHIDE=1
  944. INSTALLDIR="/usr"