source: trunk/docs/FAQ.html@ 91

Last change on this file since 91 was 91, checked in by rainer, 18 years ago

Slightly improved fix for samhain_hide module.
File size: 38.0 KB
Line 
1<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
2<html><head>
3<title>Frequently Asked Questions for Samhain</title>
4<meta name="author" content="Rainer Wichmann">
5
6<style type="text/css">
7<!--
8
9html { background: #eee; color: #000; }
10
11body { background: #eee; color: #000; margin: 0; padding: 0;}
12
13div.body {
14 background: #fff; color: #000;
15 margin: 0 1em 0 1em; padding: 1em;
16 font-family: serif;
17 font-size: 1em; line-height: 1.2em;
18 border-width: 0 1px 0 1px;
19 border-style: solid;
20 border-color: #aaa;
21}
22
23div.block {
24 background: #b6c5f2; color: #000;
25 margin: 1em; padding: 0 1em 0 1em;
26 border-width: 1px;
27 border-style: solid;
28 border-color: #2d4488;
29}
30
31div.warnblock {
32 background: #b6c5f2; color: #000;
33 background: #ffffcc; color: #000;
34 margin: 1em; padding: 0 1em 0 1em;
35 border-width: 1px;
36 border-style: solid;
37 border-color: #FF9900;
38}
39
40table {
41 background: #F8F8F8; color: #000;
42 margin: 1em;
43 border-width: 0 0 0 1px;
44 border-style: solid;
45 border-color: #C0C0C0;
46}
47
48td {
49 border-width: 0 1px 1px 0;
50 border-style: solid;
51 border-color: #C0C0C0;
52}
53
54th {
55 background: #F8F8FF;
56 border-width: 1px 1px 2px 0;
57 border-style: solid;
58 border-color: #C0C0C0;
59}
60
61
62/* body text, headings, and rules */
63
64p { margin: 0; text-indent: 0em; margin: 0 0 0.5em 0 }
65
66h1, h2, h3, h4, h5, h6 {
67 color: #206020; background: transparent;
68 font-family: Optima, Arial, Helvetica, sans-serif;
69 font-weight: normal;
70}
71
72h1 { font-size: 1.69em; margin: 1.4em 0 0.4em 0; }
73h2 { font-size: 1.44em; margin: 1.4em 0 0.4em 0; }
74h3 { font-size: 1.21em; margin: 1.4em 0 0.4em 0; }
75h4 { font-size: 1.00em; margin: 1.4em 0 0.4em 0; }
76h5 { font-size: 0.81em; margin: 1.4em 0 0.4em 0; }
77h6 { font-size: 0.64em; margin: 1.4em 0 0.4em 0; }
78
79hr {
80 color: transparent; background: transparent;
81 height: 0px; margin: 0.6em 0;
82 border-width: 1px ;
83 border-style: solid;
84 border-color: #999;
85}
86
87/* bulleted lists and definition lists */
88
89ul { margin: 0 1em 0.6em 2em; padding: 0; }
90li { margin: 0.4em 0 0 0; }
91
92dl { margin: 0.6em 1em 0.6em 2em; }
93dt { color: #285577; }
94
95tt { color: #602020; }
96
97/* links */
98
99a.link {
100 color: #33c; background: transparent;
101 text-decoration: none;
102}
103
104a:hover {
105 color: #000; background: transparent;
106}
107
108body > a {
109 font-family: Optima, Arial, Helvetica, sans-serif;
110 font-size: 0.81em;
111}
112
113h1, h2, h3, h4, h5, h6 {
114 color: #2d5588; background: transparent;
115 font-family: Optima, Arial, Helvetica, sans-serif;
116 font-weight: normal;
117}
118
119 -->
120</style></head>
121<body>
122<div class="body">
123<p style="text-align: center; background: #ccc; border: 1px solid #2d5588;"><a
124 style="text-decoration: none;"
125 href="http://www.la-samhna.de/samhain/">samhain file integrity
126 scanner</a>&nbsp;|&nbsp;<a style="text-decoration: none;"
127 href="http://www.la-samhna.de/samhain/s_documentation.html">online
128 documentation</a></p>
129<br><center><h1><a name="FAQ-top">Frequently Asked Questions for Samhain</a></h1></center>
130<br><center><h2>Rainer Wichmann</h2></center>
131<hr>
132<div class="warnblock">
133<ul>
134 <li>If you encounter problems after installing samhain, disable daemon
135 mode and run it in the foreground with
136 <tt>samhain --foreground [more options]</tt> for debugging.</li>
137 <li>If you have problems getting client/server mode to work, please check
138 the <a href="http://www.la-samhna.de/samhain/HOWTO-client+server-troubleshooting.html">HOWTO client+server troubleshooting</a> document.</li>
139</ul>
140</div>
141<p><i>FAQ Revised: Monday 12 February 2007 23:06:43</i></p>
142<hr><h2>Table of Contents</h2>
143<dl>
144<dt><b>1. Most frequently</b></dt>
145<dd><ul>
146<li><a href="#Most frequently0">1.1. Owner not trustworthy / Group writeable and member not trustworthy</a></li>
147<li><a href="#Most frequently1">1.2. samhain exits with the message &quot;Untrusted path&quot; for config/log/pid/database files</a></li>
148<li><a href="#Most frequently2">1.3. It does not log anything / Can't stop logging to console</a></li>
149<li><a href="#Most frequently3">1.4. Client cannot self-resolve, but nslookup works fine</a></li>
150</ul></dd>
151<dt><b>2. Build and install</b></dt>
152<dd><ul>
153<li><a href="#Build and install0">2.1. [Fedora Core] Cannot compile with --enable-khide</a></li>
154<li><a href="#Build and install1">2.2. [Fedora Core] Cannot compile with --with-kcheck</a></li>
155<li><a href="#Build and install2">2.3. &quot;make&quot; loops infinitely !</a></li>
156<li><a href="#Build and install3">2.4. Why does static compiling (<code>--enable-static</code>) on Solaris fail ?</a></li>
157<li><a href="#Build and install4">2.5. Compilation fails with '/usr/bin/ld: cannot find -lnss_files'</a></li>
158<li><a href="#Build and install5">2.6. The executable is corrupted after installation</a></li>
159<li><a href="#Build and install6">2.7. --enable-xml-log has no effect</a></li>
160<li><a href="#Build and install7">2.8. ./install-sh: strip: not found (Solaris)</a></li>
161<li><a href="#Build and install8">2.9. What is sh_tiger1.s?</a></li>
162<li><a href="#Build and install9">2.10. Why does static compiling (<code>--enable-static</code>) on MaxOS X fail ?</a></li>
163</ul></dd>
164<dt><b>3. File checking</b></dt>
165<dd><ul>
166<li><a href="#File checking0">3.1. How can I exclude a (sub-)directory ?</a></li>
167<li><a href="#File checking1">3.2. In messages about policy violations, what does the code after POLICY [XYZ]
168mean ?</a></li>
169<li><a href="#File checking2">3.3. Does samhain support prelink ?</a></li>
170<li><a href="#File checking3">3.4. I get error messages about 'subdirectory count != hardlinks'</a></li>
171</ul></dd>
172<dt><b>4. Client/Server</b></dt>
173<dd><ul>
174<li><a href="#Client/Server0">4.1. I don't want to poke a hole into my firewall to let the client connect to the server !</a></li>
175<li><a href="#Client/Server1">4.2. The client sends 127.0.0.1 (or some other numerical address) as its name to the log server</a></li>
176<li><a href="#Client/Server2">4.3. The server wants to send rc.ip-adress rather than rc.fqdn to the client</a></li>
177<li><a href="#Client/Server3">4.4. Cannot resolve client name host=XXX</a></li>
178<li><a href="#Client/Server4">4.5. Cannot resolve socket peer IP for client host=XXX peer=YYY</a></li>
179<li><a href="#Client/Server5">4.6. Reverse lookup of socket peer failed host=XXX peer=YYY obj=ZZZ</a></li>
180<li><a href="#Client/Server6">4.7. No socket peer alias matches client name host=XXX peer=YYY</a></li>
181<li><a href="#Client/Server7">4.8. Session key negotiation failed</a></li>
182<li><a href="#Client/Server8">4.9. Invalid connection attempt: Not in client list</a></li>
183<li><a href="#Client/Server9">4.10. Invalid connection attempt: Session key mismatch</a></li>
184<li><a href="#Client/Server10">4.11. How do I update the file signature database ?</a></li>
185<li><a href="#Client/Server11">4.12. Time limit exceeded</a></li>
186<li><a href="#Client/Server12">4.13. Invalid connection attempt: Signature mismatch</a></li>
187<li><a href="#Client/Server13">4.14. [Server] PANIC .. Address already in use&nbsp; &nbsp;subroutine=bind</a></li>
188</ul></dd>
189<dt><b>5. Email</b></dt>
190<dd><ul>
191<li><a href="#Email0">5.1. Reverse lookup failed</a></li>
192<li><a href="#Email1">5.2. From daemon@example.com</a></li>
193<li><a href="#Email2">5.3. How do I define more than one email addresses ?</a></li>
194</ul></dd>
195<dt><b>6. Misc</b></dt>
196<dd><ul>
197<li><a href="#Misc0">6.1. Error message: &quot;Invalid line XYZ in configuration file&quot;</a></li>
198<li><a href="#Misc1">6.2. Why do I get a local logfile if I log to the server ?</a></li>
199<li><a href="#Misc2">6.3. Why is there no NIS support with a static samhain executable on Linux ?</a></li>
200<li><a href="#Misc3">6.4. Why do I get hundreds of messages about modified CTIME ?</a></li>
201<li><a href="#Misc4">6.5. PANIC &mdash; File not accessible</a></li>
202<li><a href="#Misc5">6.6. How can I avoid error messages for invalid UIDs (no such user) ?</a></li>
203<li><a href="#Misc6">6.7. [Redhat] The /etc/init.d/(samhain|yule) init script hangs</a></li>
204<li><a href="#Misc7">6.8. The /etc/init.d/(samhain|yule) init script exits with: execvp: No such file or directory</a></li>
205<li><a href="#Misc8">6.9. Why am I not receiving the &quot;BEGIN LOGKEY&quot; message by email ?</a></li>
206<li><a href="#Misc9">6.10. Why does console logging fail if I compile with
207 <code>--enable-(micro-)stealth</code> ?</a></li>
208<li><a href="#Misc10">6.11. I need a list for my schedule !</a></li>
209<li><a href="#Misc11">6.12. The hiding kernel module has no effect !</a></li>
210<li><a href="#Misc12">6.13. What does the message &quot;Large lstat/open overhead&quot; mean ?</a></li>
211<li><a href="#Misc13">6.14. What does the message &quot;Device not available path=/dev/random&quot; mean ? I have /dev/random !</a></li>
212<li><a href="#Misc14">6.15. Logging to an external program fails; the program receives no data
213 on stdin !</a></li>
214<li><a href="#Misc15">6.16. SIGILL on AIX</a></li>
215</ul></dd>
216<dt><b>7. Database</b></dt>
217<dd><ul>
218<li><a href="#Database0">7.1. Why are client messages corrupted / incompletely stored in the DB ?</a></li>
219<li><a href="#Database1">7.2. I want / don't want the server timestamps (for client messages) in the SQL database</a></li>
220<li><a href="#Database2">7.3. I don't want the client TIMESTAMP messages in the SQL database</a></li>
221<li><a href="#Database3">7.4. What does the log_ref field mean ?</a></li>
222<li><a href="#Database4">7.5. How can I check what is in the database ?</a></li>
223</ul></dd>
224</dl>
225<hr><h2>1. Most frequently</h2>
226<dl>
227<dt><b><a name="Most frequently0">1.1. Owner not trustworthy / Group writeable and member not trustworthy</a></b></dt>
228<dd>An untrusted user (might be an untrusted group member
229 for group writeable files/directories) owns or can write to an
230 element in the path listed in the error message. This concerns
231 the configuration file, the log file, and the database file.
232 The offending element in the path is identified as obj=/xxx in the
233 error message.
234 To fix the problem, see next entry.<br><br></dd>
235<dt><b><a name="Most frequently1">1.2. samhain exits with the message &quot;Untrusted path&quot; for config/log/pid/database files</a></b></dt>
236<dd>Paths to critical
237 files (e.g. the configuration file) must be writeable by trusted users
238 only.
239 If a path element is group writeable, all group members must be trusted.
240 By default, only <i>root</i> and the (effective) <i>user</i> of
241 the program are trusted. To add trusted users, use the compile time
242 option
243<div class="block"><pre>
244$ ./configure --with-trusted=0,...
245</pre></div>
246 or the configure file option:
247<div class="block"><pre>
248[Misc]
249TrustedUser=username
250</pre></div>
251If the path to the configuration file itself is writeable
252 by other users than <i>root</i> and the
253 <i>effective user</i>
254 these must be defined as trusted already
255 at compile time.<br><br></dd>
256<dt><b><a name="Most frequently2">1.3. It does not log anything / Can't stop logging to console</a></b></dt>
257<dd>(1) There is a section in the manual dealing with
258logging and filtering.<br />
259
260(2) To log to the console:
261<div class="block"><pre>
262$ samhain -p info ...
263</pre></div>
264or in the configuration file:
265<div class="block"><pre>
266[Log]
267PrintSeverity=info
268</pre></div>
269
270To <i>stop</i> logging to the console:
271<div class="block"><pre>
272$ samhain -p none ...
273</pre></div>
274or in the configuration file:
275<div class="block"><pre>
276[Log]
277PrintSeverity=none
278</pre></div>
279Defining <tt>/dev/null</tt> as console device works as well, but
280is a bad idea, because samhain will open the device and write (i.e. it is
281a very inefficient method).<br><br></dd>
282<dt><b><a name="Most frequently3">1.4. Client cannot self-resolve, but nslookup works fine</a></b></dt>
283<dd><ul>
284<li>Nslookup is a program to query Internet domain name servers.
285</li>
286<li>Applications (like samhain) are not supposed to query DNS servers
287 directly. Rather, they are supposed to query the resolver library that:
288 <ul>
289 <li>is provided by the operating system,</li>
290 <li>configured by the system administrator,</li>
291 <li>may use several different method to determine host names, as
292 configured in <tt>/etc/nsswitch.conf</tt>, and</li>
293 <li>usually is configured to give precedence to
294 the <tt>/etc/hosts</tt> file.</li>
295 </ul>
296</li>
297<li>Therefore, whether nslookup gives correct answers may be completely
298 irrelevant. For self-resolving the own hostname, the resolver
299 library probably will use <tt>/etc/hosts</tt>, rather than
300 querying a DNS server.
301</li>
302</ul>
303<p>
304Below you can find some examples of good and bad <tt>/etc/hosts</tt> files:
305</p>
306<div class="block"><pre>
307 # CORRECT
308 #
309 127.0.0.1 localhost
310 xxx.xxx.xxx.xxx myhost.mydomain.tld myhost
311</pre></div>
312
313<div class="block"><pre>
314 # CORRECT
315 #
316 127.0.0.1 localhost.localdomain localhost
317 xxx.xxx.xxx.xxx myhost.mydomain.tld myhost
318</pre></div>
319
320<div class="block"><pre>
321 # BAD
322 #
323 127.0.0.1 myhost.mydomain.tld localhost
324 xxx.xxx.xxx.xxx myhost.mydomain.tld myhost
325</pre></div>
326
327<div class="block"><pre>
328 # BAD
329 #
330 127.0.0.1 localhost myhost
331 xxx.xxx.xxx.xxx myhost.mydomain.tld myhost
332</pre></div><br><br></dd>
333</dl>
334<hr><h2>2. Build and install</h2>
335<dl>
336<dt><b><a name="Build and install0">2.1. [Fedora Core] Cannot compile with --enable-khide</a></b></dt>
337<dd>The Fedora Core kernel is patched to unconditionally deny reading
338from /dev/kmem. Compiling the stealth kernel modules is not possible
339under these circumstances.<br><br></dd>
340<dt><b><a name="Build and install1">2.2. [Fedora Core] Cannot compile with --with-kcheck</a></b></dt>
341<dd>The Fedora Core kernel is patched to unconditionally deny reading
342from /dev/kmem. Checking the kernel for the presence of rootkits is
343not possible under these circumstances.<br><br></dd>
344<dt><b><a name="Build and install2">2.3. &quot;make&quot; loops infinitely !</a></b></dt>
345<dd>This may happen (e.g. when building via NFS for multiple architectures)
346 if the relative timestamps in the source directory are
347 wrong (time not in sync on different machines) or some intermediate
348 target is unusable (up-to-date, but built for a different OS). Use
349 &quot;touch * &amp;&amp; make distclean&quot; in the source directory
350 to recover.<br><br></dd>
351<dt><b><a name="Build and install3">2.4. Why does static compiling (<code>--enable-static</code>) on Solaris fail ?</a></b></dt>
352<dd>Ingo Rogalsky has provided the following information: It isn't possible
353 to link Samhain statically with Solaris. This
354 is a Solaris issue (see Sun Infodoc ID12624) and not a samhain problem.<br><br></dd>
355<dt><b><a name="Build and install4">2.5. Compilation fails with '/usr/bin/ld: cannot find -lnss_files'</a></b></dt>
356<dd>For Linux, this is a known problem with --enable-static if you compile
357 in MySQL support. The problem is that the
358 <tt>mysql_config</tt> that comes as part of the MySQL
359 distribution script incorrectly lists dependencies on
360 the libnss_files and libnss_dns libraries which are only available as
361 shared libraries, so the linker cannot find the static libraries.
362
363 You can check this by inspecting the output of
364 <code>mysql_config --libs</code>. The version of
365 <tt>mysql_config</tt> that comes with the RedHat mysql
366 RPM (RedHat 9) does not have this bug; the one distributed by the MySQL
367 people has. You can fix the problem by editing
368 <tt>mysql_config</tt>: search for the
369 <i>client_libs</i> variable, and remove all instances
370 of <i>-lnss_files</i> and <i>-lnss_dns</i>.<br><br></dd>
371<dt><b><a name="Build and install5">2.6. The executable is corrupted after installation</a></b></dt>
372<dd>The executable will get stripped during the installation. On
373 suitable systems (i386 Linux/FreeBSD currently), additionally
374 the &quot;sstrip&quot;
375 utility (copyright 1999 by Brian Raiter, under the GNU GPL)
376 will be used to strip the executable even more, to prevent
377 debugging with the GNU &quot;gdb&quot; debugger.
378 The &quot;strip&quot; utility cannot handle the resulting
379 executable, therefore trying to strip manually after installation
380 will corrupt the executable.<br><br></dd>
381<dt><b><a name="Build and install6">2.7. --enable-xml-log has no effect</a></b></dt>
382<dd>If you have compiled for stealth, you won't see much, because if
383 obfuscated, then both a 'normal' and an XML logfile look,
384 well ... obfuscated. Use <code>samhain -jL /path/to/logfile</code>
385 to view the logfile.<br><br></dd>
386<dt><b><a name="Build and install7">2.8. ./install-sh: strip: not found (Solaris)</a></b></dt>
387<dd>Install the SUNWbtool package.<br><br></dd>
388<dt><b><a name="Build and install8">2.9. What is sh_tiger1.s?</a></b></dt>
389<dd>This is a precompiled assembly file for the i386 architecture
390generated from sh_tiger1.c using gcc 3.4.0 with the following options,
391that were found to generate the fastest code:
392<pre>
393 -O1 -fno-delayed-branch -fexpensive-optimizations -fstrength-reduce
394 -fpeephole2 -fschedule-insns2 -fregmove -frename-registers -fweb
395 -momit-leaf-frame-pointer -funroll-loops
396</pre>
397These options were determined using
398<a href="http://www.coyotegulch.com/products/acovea/">acovea</a> 5.1.1
399by Scott Robert Ladd. The file is provided as precompiled assembly
400because different versions of gcc can have very different performance,
401require different options to compile optimal code, and
402it would be impossible to maintain a library of optimal compile options
403for every version of gcc.<br><br></dd>
404<dt><b><a name="Build and install9">2.10. Why does static compiling (<code>--enable-static</code>) on MaxOS X fail ?</a></b></dt>
405<dd>Static linking is not supported on MacOS X, see
406<a href="http://developer.apple.com/qa/qa2001/qa1118.html">Technical Q&A QA1118</a>.
407This is a MacOS X issue and not a bug in samhain.<br><br></dd>
408</dl>
409<hr><h2>3. File checking</h2>
410<dl>
411<dt><b><a name="File checking0">3.1. How can I exclude a (sub-)directory ?</a></b></dt>
412<dd><div class="block"><pre>
413[IgnoreAll]
414dir=-1/ignore/this/subdirectory
415</pre></div><br><br></dd>
416<dt><b><a name="File checking1">3.2. In messages about policy violations, what does the code after POLICY [XYZ]
417mean ?</a></b></dt>
418<dd>This code indicates which items are modified (e.g. C = checksum). You can
419find a description in section 5.4.9 in the user manual. It is there because
420then you can see in the message list of the Beltane web console what has been
421modified, without the need to look at the message in detail.<br><br></dd>
422<dt><b><a name="File checking2">3.3. Does samhain support prelink ?</a></b></dt>
423<dd>Yes. There is a special checking policy [Prelink]. Directories with
424prelinked executables / shared libraries (see /etc/prelink.conf) should be
425placed under this policy, rather than under the [ReadOnly] policy.<br><br></dd>
426<dt><b><a name="File checking3">3.4. I get error messages about 'subdirectory count != hardlinks'</a></b></dt>
427<dd>Some filesystems do not always follow the rule that the number
428of directory
429hardlinks equals the number of subdirectories. E.g. the root directory of
430reiserfs partitions generally seems to have two additional hardlinks.
431To account for such exceptions, you can either switch off the
432hardlink check globally, or specify exceptions:
433<div class="block"><pre>
434[Misc]
435# Switch off hardlink check
436#
437UseHardlinkCheck=no
438</pre></div>
439<div class="block"><pre>
440[Misc]
441# Specify exceptions for the hardlink check
442#
443HardlinkOffset=N:/path
444</pre></div>
445Here, N is the numerical offset (actual - expected hardlinks) for
446'/path'. For multiple exceptions, use
447this options multiple times (note that '/path N:/path2' would itself be a valid
448path, so using the option only once with multiple exceptions on the same line
449would be ambiguous).<br><br></dd>
450</dl>
451<hr><h2>4. Client/Server</h2>
452<dl>
453<dt><b><a name="Client/Server0">4.1. I don't want to poke a hole into my firewall to let the client connect to the server !</a></b></dt>
454<dd>Pat Smith has posted the following solution. On the client, create
455an iptable rule as follows (<i>note: you probably don't need this if you
456configure / compile in 127.0.0.1 as the server address</i>):
457<div class="block"><pre>
458iptables -t nat -A OUTPUT -p tcp -m tcp --dport 49777 -d <i>server-ip</i> -j REDIRECT
459</pre></div>
460
461On the server, create an ssh tunnel for each client outside the firewall:
462
463<div class="block"><pre>
464ssh -f -C -R 49777:localhost:49777 -N <i>client-ip</i>
465</pre></div>
466
467It is necessary that each client has a distinct name, and that the server
468knows the name of the client. With the setup above, each client will appear
469as &quot;localhost&quot; to the server, thus the server
470needs to trust the client name
471as reported by the client itself, and suppress all eroors on resolving
472this name to the apparent address. In the server configuration:
473
474<div class="block"><pre>
475[Misc]
476SetClientFromAccept = false
477SeverityLookup = debug
478</pre></div>
479
480Obviously, self-resolving must work on the client machine, otherwise
481you are in trouble (see next issue).<br><br></dd>
482<dt><b><a name="Client/Server1">4.2. The client sends 127.0.0.1 (or some other numerical address) as its name to the log server</a></b></dt>
483<dd>See 'Client cannot self-resolve' in the 'Most frequently' section<br><br></dd>
484<dt><b><a name="Client/Server2">4.3. The server wants to send rc.ip-adress rather than rc.fqdn to the client</a></b></dt>
485<dd>The client self-resolves to its ip address.
486See 'Client cannot self-resolve' in the 'Most frequently' section<br><br></dd>
487<dt><b><a name="Client/Server3">4.4. Cannot resolve client name host=XXX</a></b></dt>
488<dd><div class="block"><pre>
489The server must be able to determine the client name.
490This is because only authenticated connections from registered
491clients are allowed, and
492the server must be able to check the client hostname against the list of
493allowed hosts, and look up the password verifier for that
494host.
495</pre></div>
496There are two different ways to accomplish this. Unfortunately, judging
497from customer feedback as well from common sense, both do not work very well
498with a messed up local DNS (including /etc/hosts files) and/or
499&uuml;berparanoid or misconfigured firewalls (in case of connections
500across one).
501<ul>
502 <li>
503 <p>
504 <i>First method: Determine client name on client, and
505 try to cross-check on server</i>
506 <p>
507 <p>
508 This does not work for a number of people because (1) the
509 <tt>/etc/hosts</tt> file on the client machine has errors
510 (yes, there are plenty machines with a completely
511 messed up <tt>/etc/hosts</tt> file), (2) the
512 server cannot resolve the client address because the local DNS is
513 f***ed up, or (3) the client machine has multiple network interfaces, and
514 the interface used is not the one the client name resolves to.
515 </p>
516 <p>
517 If the client uses the wrong interface on a multi-interface machine,
518 there is a config file option
519 <tt>SetBindAddress=</tt><i>IP address</i>
520 that allows to choose the interface the client will use for
521 outgoing connections.
522 </p>
523 <p>
524 If you want to download the config file from the server, you
525 should instead use the corresponding command line
526 <tt>--bind-address=</tt><i>IP address</i>
527 to select the interface.
528 </p>
529
530 <p>
531 If you encounter problems, you may (1) fix your
532 <tt>/etc/hosts</tt> file(s), (2) fix your local DNS, or
533 (3) switch to the second method.
534 </p>
535 <p>
536 Errors in name resolving/cross-checking can be avoided by setting a
537 very low severity (lower than the logging threshold), e.g.
538 </p>
539 <p>
540 <tt>SeverityLookup=</tt><i>debug</i>
541 </p>
542 <p>
543 in the <i>Misc</i> section of the server configuration,
544 if you prefer running <i>unsafe</i> at any speed
545 instead of fixing the problem (you have been warned). Doing so will
546 allow an attacker to pose as the client.
547 </p>
548 </li>
549 <li>
550 <p><i>Second method: Use address of connecting entity as
551 known to the communication layer</i></p>
552 <p>
553 This has been dropped as default
554 long ago because it may not always be the
555 address of the client machine.
556 To enable this method, use
557 </p>
558 <p>
559 <tt>SetClientFromAccept=</tt><i>true</i>
560 </p>
561 <p>
562 in the <i>Misc</i> section of the server configuration
563 file. If the address cannot be resolved, or reverse lookup of the
564 resolved name fails, <i>no</i> error message will be issued,
565 but the numerical address will be used.
566 </p>
567 </li>
568</ul><br><br></dd>
569<dt><b><a name="Client/Server4">4.5. Cannot resolve socket peer IP for client host=XXX peer=YYY</a></b></dt>
570<dd>See above<br><br></dd>
571<dt><b><a name="Client/Server5">4.6. Reverse lookup of socket peer failed host=XXX peer=YYY obj=ZZZ</a></b></dt>
572<dd>See above<br><br></dd>
573<dt><b><a name="Client/Server6">4.7. No socket peer alias matches client name host=XXX peer=YYY</a></b></dt>
574<dd>See above<br><br></dd>
575<dt><b><a name="Client/Server7">4.8. Session key negotiation failed</a></b></dt>
576<dd>See the document <a href="HOWTO-client+server-troubleshooting.html">HOWTO client+server troubleshooting</a><br><br></dd>
577<dt><b><a name="Client/Server8">4.9. Invalid connection attempt: Not in client list</a></b></dt>
578<dd>See the document <a href="HOWTO-client+server-troubleshooting.html">HOWTO client+server troubleshooting</a><br><br></dd>
579<dt><b><a name="Client/Server9">4.10. Invalid connection attempt: Session key mismatch</a></b></dt>
580<dd>See the document <a href="HOWTO-client+server-troubleshooting.html">HOWTO client+server troubleshooting</a><br><br></dd>
581<dt><b><a name="Client/Server10">4.11. How do I update the file signature database ?</a></b></dt>
582<dd>If you keep the file signature database on the server,
583 the database is supposed to be updated on the server, using the
584 <a href="http://www.la-samhna.de/beltane/">beltane</a>
585 web-based console (currently in beta) and the
586 log messages from the client.
587 <p>
588 Alternatively, you can <code>scp</code> the database
589 to the client, run <code>samhain -t update -l none</code> (you
590 need to avoid logging because otherwise you will get in conflict with
591 the running samhain daemon), and then <code>scp</code> the
592 database back to the server. Actually, with a properly set up
593 &quot;ssh&quot;, using RSA/DSA authentication
594 and ssh-agent you could write a script to automate this.<br><br></dd>
595<dt><b><a name="Client/Server11">4.12. Time limit exceeded</a></b></dt>
596<dd>The respective client for that this message is generated has not
597 sent anything for some interval of time (default 84600 sec = 1 day).
598 The interval can be set as follows:
599<div class="block"><pre>
600 [Misc]
601 # unit is seconds
602 SetClientTimeLimit=NNN
603</pre></div>
604
605 This feature has the purpose to detect if a client is dead. You
606 might want to ensure that timestamps are sent to the server:
607<div class="block"><pre>
608 [Log]
609 ExportSeverity=mark
610</pre></div>
611 If you don't want to use this feature, set the time limit to some
612 very large value.<br><br></dd>
613<dt><b><a name="Client/Server12">4.13. Invalid connection attempt: Signature mismatch</a></b></dt>
614<dd>Clients sign their messages using a session key negotiated
615 with the server. The message indicates that the server could
616 not verify the signature. This may be caused by a running two
617 instances of samhain on the same client machine, both of them
618 accessing the server (and negotiating different session keys
619 ...). The system will recover automatically from the problem
620 by forcing the failed client to negotiate a fresh session key.<br><br></dd>
621<dt><b><a name="Client/Server13">4.14. [Server] PANIC .. Address already in use&nbsp; &nbsp;subroutine=bind</a></b></dt>
622<dd>The server cannot bind to its port because the port is already used.
623 Maybe you have accidentially already an instance of the
624 server running.<br><br></dd>
625</dl>
626<hr><h2>5. Email</h2>
627<dl>
628<dt><b><a name="Email0">5.1. Reverse lookup failed</a></b></dt>
629<dd>Fix your DNS (reverse lookup: numerical IP address to FQDN, to verify
630 FQDN to numerical IP address).
631<div class="block"><pre>
632Whether &quot;nslookup&quot; works is not very informative, because
633&quot;nslookup&quot; does not use the resolver library of the operating
634system. Therefore,
635it is not exactly the
636best tool for debugging name resolving problems (see the book
637&quot;DNS and bind&quot;).
638</pre></div><br><br></dd>
639<dt><b><a name="Email1">5.2. From daemon@example.com</a></b></dt>
640<dd>samhain fails to resolve the
641 self-address of the host.
642See 'Client cannot self-resolve' in the 'Most frequently' section.<br><br></dd>
643<dt><b><a name="Email2">5.3. How do I define more than one email addresses ?</a></b></dt>
644<dd>Use <tt>SetMailAddress=...</tt> multiple times (upt to eight addresses
645are possible, with at most 63 characters per address):
646<div class="block"><pre>
647[Misc]
648SetMailAddress=aaa@foo.com
649SetMailAddress=bbb@foo.com
650</pre></div><br><br></dd>
651</dl>
652<hr><h2>6. Misc</h2>
653<dl>
654<dt><b><a name="Misc0">6.1. Error message: &quot;Invalid line XYZ in configuration file&quot;</a></b></dt>
655<dd>This message indicates that line XYZ in the configuration file contains
656an unrecognized directive. The primary reasons are:<br />
657
658(a) The directive should be placed into a particular section of the
659configuration file, but the section header is not present (or you forgot
660to uncomment it).<br />
661
662(b) Samhain is compiled without support for this directive.<br />
663
664(c) You have a typo in the directive.<br /><br><br></dd>
665<dt><b><a name="Misc1">6.2. Why do I get a local logfile if I log to the server ?</a></b></dt>
666<dd>Because you can use all log facilities in parallel. You should
667 switch off in the config file what you don't want/need:
668<div class="block"><pre>
669 [Log]
670 # local log file
671 LogSeverity=none
672</pre></div><br><br></dd>
673<dt><b><a name="Misc2">6.3. Why is there no NIS support with a static samhain executable on Linux ?</a></b></dt>
674<dd>Some functions (including NIS) require
675 libraries that are only available as shared libraries
676 with modern GLIBC versions. While you can always compile a static
677 executable, normally it would still open the shared library at runtime.
678 As of version 1.8.11, samhain avoids this by providing replacement
679 functions from uClibc. However, these do not include NIS support.<br><br></dd>
680<dt><b><a name="Misc3">6.4. Why do I get hundreds of messages about modified CTIME ?</a></b></dt>
681<dd>This happens because some
682 backup applications reset the atime/mtime timestamps, which causes
683 the ctime timestamp to be modified (rootkits avoid this by
684 temporarily resetting the system clock to the original ctime ...).
685 <p>
686 To fix this problem, read the manual of your backup application, or
687 redefine the ReadOnly policy to <i>not</i> check
688 the ctime timestamp:
689<div class="block"><pre>
690 [Misc]
691 RedefReadOnly=-CTM
692</pre></div>
693<div class="warnblock"><pre>
694 Order matters - you must <i>first</i> redefine
695 ReadOnly <i>before</i> you use it
696</pre></div><br><br></dd>
697<dt><b><a name="Misc4">6.5. PANIC &mdash; File not accessible</a></b></dt>
698<dd>Most likely permission denied because of unsufficient privileges.<br><br></dd>
699<dt><b><a name="Misc5">6.6. How can I avoid error messages for invalid UIDs (no such user) ?</a></b></dt>
700<dd>Set SeverityNames to a low value
701<div class="block"><pre>
702[EventSeverity]
703SeverityNames=debug
704</pre></div><br><br></dd>
705<dt><b><a name="Misc6">6.7. [Redhat] The /etc/init.d/(samhain|yule) init script hangs</a></b></dt>
706<dd>Redhat uses &quot;initlog&quot; (see
707 <code>man initlog</code>) in initscripts. If it hangs, most probably
708 samhain/yule runs in the foreground rather than as daemon. Set
709 daemon mode in the configuration file:
710<div class="block"><pre>
711[Misc]
712Daemon=yes
713</pre></div><br><br></dd>
714<dt><b><a name="Misc7">6.8. The /etc/init.d/(samhain|yule) init script exits with: execvp: No such file or directory</a></b></dt>
715<dd>Either the program is not installed, or it is not in the PATH (the one
716 used by the init script, which may be different from your PATH).<br><br></dd>
717<dt><b><a name="Misc8">6.9. Why am I not receiving the &quot;BEGIN LOGKEY&quot; message by email ?</a></b></dt>
718<dd>This message (which contains the key to verify the log file) is generated
719 when logging to the log file starts. It has the severity &quot;ALRT&quot;,
720 thus you should make sure that you have set the logging threshold for
721 email correctly to receive it.<br><br></dd>
722<dt><b><a name="Misc9">6.10. Why does console logging fail if I compile with
723 <code>--enable-(micro-)stealth</code> ?</a></b></dt>
724<dd>The default logging options are more &quot;stealthy&quot;. Set the
725 threshold explicitely rather than relying on the default.<br><br></dd>
726<dt><b><a name="Misc10">6.11. I need a list for my schedule !</a></b></dt>
727<dd>You can have the same effect with a list of schedules. See the section
728&quot;Timing file checks&quot; in the manual.<br><br></dd>
729<dt><b><a name="Misc11">6.12. The hiding kernel module has no effect !</a></b></dt>
730<dd>Most probably you compiled using the wrong &quot;System.map&quot; file.<br><br></dd>
731<dt><b><a name="Misc12">6.13. What does the message &quot;Large lstat/open overhead&quot; mean ?</a></b></dt>
732<dd>Your system needs several seconds to proceed from an lstat() system call
733 to an open() system call. This is a tremenduous overhead, and
734 indicates that either your system has a really severe performance problem,
735 or someone tries to slow down samhain.<br><br></dd>
736<dt><b><a name="Misc13">6.14. What does the message &quot;Device not available path=/dev/random&quot; mean ? I have /dev/random !</a></b></dt>
737<dd>/dev/random blocks unless there is some entropy it can deliver. Samhain
738 will time out and fall back on /dev/urandom after some seconds to avoid
739 hanging for a potentially long time. It will try /dev/random again next
740 time it needs entropy.<br><br></dd>
741<dt><b><a name="Misc14">6.15. Logging to an external program fails; the program receives no data
742 on stdin !</a></b></dt>
743<dd>Probably your program is not designed to <i>wait for input</i>, but exits
744 if reading fails (because there is no data <i>yet</i>). You may want to
745 let your program wait for the terminating &quot;[EOF]&quot; line.<br><br></dd>
746<dt><b><a name="Misc15">6.16. SIGILL on AIX</a></b></dt>
747<dd>For each scanned file, samhain needs to
748 store some information in memory (e.g. to recognize changes that have
749 already been reported, and avoid duplicate reports). On AIX, if you are
750 checking a <i>really huge</i> number of files,
751 memory usage may exceed the default limit of 256 MB, and the process may
752 terminate with SIGILL.
753 <p>
754 The problem can be solved by linking with the flag
755 <code>-bmaxdata:0x80000000</code>. This allows the application to
756 access up to 8 segments (where each segment is 256MB).
757 <p>
758 If you are using gcc, you need to use instead
759 the flag <code>-Wl,bmaxdata:0x80000000</code>, which tells
760 gcc to pass on the
761 <i>bmaxdata</i>
762 flag to the AIX linker. You can use the LDFLAGS environment variable to
763 pass linker flags to the configure script:
764<div class="block"><pre>
765 export LDFLAGS="-Wl,bmaxdata:0x80000000"
766</pre></div><br><br></dd>
767</dl>
768<hr><h2>7. Database</h2>
769<dl>
770<dt><b><a name="Database0">7.1. Why are client messages corrupted / incompletely stored in the DB ?</a></b></dt>
771<dd>Because the messages are not in XML format, and therefore incorrectly
772 parsed. The most frequent reasons are:
773<div class="block"><pre>
774 1.) Your server is compiled with --enable-xml-log, but your client(s)
775 is/are not.
776
777 2.) In your client or server configuration file, you are using
778 the option for a custom message header, but without paying attention
779 to preserving the XML format.
780</pre></div><br><br></dd>
781<dt><b><a name="Database1">7.2. I want / don't want the server timestamps (for client messages) in the SQL database</a></b></dt>
782<dd><div class="block"><pre>
783[Database]
784SetDBServerTstamp = true/false
785</pre></div>
786
787 This will enable/disable logging of the server timestamp for client
788 messages. The server timestamp will be written to a seperate record,
789 with <i>log_ref</i> set to the value of
790 <i>log_index</i> of the corresponding client message.<br><br></dd>
791<dt><b><a name="Database2">7.3. I don't want the client TIMESTAMP messages in the SQL database</a></b></dt>
792<dd><div class="block"><pre>
793 Sending timestamps from the client allows the server to detect if
794 a client is not running anymore (use SetClientTimeLimit=NNN in the
795 [Misc] section of the server config file to set the number of seconds
796 after which the server will issue an error message if no timestamp has
797 been received).
798</pre></div>
799
800 However, you might not want to log these timestamps to the database
801 (or other log facilities). To filter them, you can use two methods
802 (examples are for the SQL database).
803 The first
804 one has the disadvantage that only messages of
805 severity <i>err</i> or higher will be logged:
806<div class="block"><pre>
807 [Misc]
808 UseClientSeverity=yes
809
810 [Log]
811 DatabaseSeverity=err
812</pre></div>
813
814 The second method is more specific &mdash; log everything not
815 belonging to the STAMP class of messages:
816<div class="block"><pre>
817 [Misc]
818 UseClientClass=yes
819
820 [Log]
821 DatabaseClass=PANIC RUN FIL TCP ERR ENET EINPUT
822</pre></div><br><br></dd>
823<dt><b><a name="Database3">7.4. What does the log_ref field mean ?</a></b></dt>
824<dd>NULL are client messages. Nonzero integer is a server timestamp
825 for a client message (where log_ref indicates the log_index entry
826 number of the corresponding client message). Zero indicates a message
827 by the server itself (e.g. the server's start message).<br><br></dd>
828<dt><b><a name="Database4">7.5. How can I check what is in the database ?</a></b></dt>
829<dd>Use a command line client to login to the database and query it:
830<div class="block"><pre>
831 sh$ mysql -u &lt;user_name&gt; -p &lt;database_name&gt;
832 Enter password: ****
833 mysql&gt; SELECT log_index,log_ref,log_host,log_sev,log_msg,path FROM &lt;table_name&gt; WHERE entry_status = 'NEW' ORDER BY log_index;
834 ....
835 mysql&gt; \q
836</pre></div><br><br></dd>
837</dl>
838<hr>
839
840<p>Copyright (c) 2004 Rainer Wichmann</p>
841
842<p><i>This list of questions and answers was generated by
843<a href="http://www.makefaq.org/">makefaq</a>.</i>
844
845</div>
846</body>
847</html>
Note: See TracBrowser for help on using the repository browser.