NAME

integalert - filesystem integrity checking scanner

SYNOPSIS

integalert [options] [SUBPROFILE] [fix|check|configure]

DESCRIPTION

Integalert is an osec(1)-based filesystem integrity checking scanner with syslog alerts, triggers, log-file reporting and rotation, that is easy to setup and extend with the help of dynamic subprofiles.

The first optional argument is SUBPROFILE. If not specified, then the main subprofile is implicitly assumed (however, no _<SUBPROFILE> suffix is appended to names of configuration and log files in that case).

The second optional argument is the name of an action to execute. If not specified, then check is implicitly assumed.

INITIALIZATION AND CONFIGURATION

In order to just initialize a subprofile, use:

integalert [SUBPROFILE] configure

After configuration is done, you can examine and edit the following configuration files in /etc/osec/integalert[_<SUBPROFILE>]/ directory:

* dirs.conf --- the list of directories that should be scanned on fix action and scanned and compared to the fixed state on check;

* exclude.conf --- the list of filename patterns to exclude from scanning and checking;

* sender.conf --- the configuration of the given subprofile's sender script (the script that you shouldn't normally modify) mostly related to logging (log facility and priority);

* pipe.conf --- the main configuration file of the given subprofile that shouldn't normally be modified. For more information about options there see osec(1);

* files.list --- an alternative to dirs.conf (see below).

There is also /etc/logrotate.d/integalert[_<SUBPROFILE>].conf with initial set of log rotation parameters that is generated for each subprofile.

Existing configuration files listed above are not overwritten.

All initial configuration parameters depend, in turn, on the base parameters, specified in /etc/osec/integalert.conf and /etc/sysconfig/integalert configuration files (the latter is read last). Note, that configuration files are also sourced in the sender script (/usr/lib/integalert/sender).

FILELIST OPTION

As an alternative to specifying a list of directories in dirs.conf it is possible to define a list of directories and single files that should be checked using files.list configuration file. The file list can contain filename patterns. The resulting explicit list of files is written to /run/integalert/<SUBPROFILE>/files.list. Note that dirs.conf and exclude.conf is ignored if files.list is present.

FILESYSTEM STATE FIX

In order to fix (and optionally initialize) a subprofile, use:

integalert [SUBPROFILE] fix

All files from directories listed in dirs.conf, with exceptions defined in exclude.conf, are scanned and their state is fixed. Alternatively, if files.list is present, listed directories and single files are scanned and fixed. The report is written to /var/log/integalert[_<SUBPROFILE>]/lastlog[_<SUBPROFILE>] and is also appended to /var/log/integalert[_<SUBPROFILE>]/integalert[_<SUBPROFILE>].log (that is an object to log rotation).

FILESYSTEM STATE CHECK

In order to check the current state of files defined by a subprofile, use:

integalert [SUBPROFILE] [check]

All files from directories listed in dirs.conf, with exceptions defined in exclude.conf are scanned and their state is compared to the previously fixed state. Alternatively, if files.list is present, listed directories and single files are scanned and compared. Changes, if any, are listed in the report (lastlog[_<SUBPROFILE>] and also in integalert[_<SUBPROFILE>].log). If state is found to be different from the fixed state, then the warning message is written to standard error and the process return code is non-zero.

TRIGGERS

If the triggers are enabled and the filesystem state is found to be different from the fixed state, integalert executes script files found in /etc/osec/integalert[_<SUBPROFILE>]/trigger.d/ piping the report to standard input of each trigger. The triggers are disabled by default and may be enabled by specifying ENABLE_TRIGGERS=1 in /etc/osec/integalert.conf or /etc/sysconfig/integalert configuration files. Triggers for a particular subprofile may be disabled with a trigger.d/disable file.

BUGS

Report bugs to https://bugzilla.altlinux.org/.

COPYRIGHT

Copyright © BaseALT, Ltd. License GPLv2+: GNU GPL version 2 or later See <http://gnu.org/licenses/gpl.html> for more information.
This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law.

SEE ALSO

osec(1)