syscheck: whitelist for files in an sqlite database#1091
syscheck: whitelist for files in an sqlite database#1091ddpbsd merged 21 commits intoossec:masterfrom
Conversation
jrossi
left a comment
jrossi
left a comment
There was a problem hiding this comment.
Outside of the Makefile stuff this should just work. I would think it might make more sense to use this thought out ossec myabe inplace of cdb
src/Makefile
Outdated
|
|
||
| analysisd/decoders/%-test.o: analysisd/decoders/%.c | ||
| ${OSSEC_CC} ${OSSEC_CFLAGS} -DTESTRULE -DARGV0=\"ossec-analysisd\" -I./analysisd -I./analysisd/decoders -c $^ -o $@ | ||
| ${OSSEC_CC} ${OSSEC_CFLAGS} -DTESTRULE -DARGV0=\"ossec-analysisd\" -I./analysisd -I./analysisd/decoders -c $^ -lsqlite3 -o $@ |
There was a problem hiding this comment.
Why is the lib loaded on to each CC line? Should the it not be appended to correct CFLAGS?
There was a problem hiding this comment.
I had enough trouble figuring out how to get it working, that I didn't get around to "optimizing." I'll definitely work on this though, thanks!
src/analysisd/decoders/syscheck.c
Outdated
| return(0); | ||
| } | ||
| debug1("%s: Checking MD5 '%s' in %s", ARGV0, p, Config.md5db); | ||
| if (!(error = sqlite3_open(Config.md5db, &conn))) { |
There was a problem hiding this comment.
Could be completely wrong here, but open and closing the SQLite db for each operation seams incorrect. SHould it not be done during once?
There was a problem hiding this comment.
I pulled the code straight from Xavier, I haven't looked into it much more than that. Definitely something to work on though, thanks!
This will hopefully be a more descriptive name.
ddpbsd
dismissed
jrossi’s stale review
I made the changes, but can't figure out how to "approve" the review or whatever.
2 participants
Integrate a patch from Xavier Mertens to ignore MD5s for files in an sqlite database.
https://blog.rootshell.be/2013/05/13/improving-file-integrity-monitoring-with-ossec/
I have only done VERY light testing, so this needs to be tested before merge. For instance, I'm not sure the syscheck db entry gets updated if the file is in the sqlite db. Should it be? Not sure yet.
This change is