/usr/share/doc/integrit/examples/root.conf is in integrit 4.1-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 | # integrit-foohost.conf -*- fundamental -*-
# Ed Cashin, 20001212
#
# This example configuration file is based on one for a 6.x RedHat
# Linux web server. Be sure to tune it to your own machine!
#
# The known database and the production config file should be
# read-only from the machine being checked.
#
root=/
known=/mnt/secdb/integrit-foohost.cdb
current=/root/databases/integrit-foohost.cdb.new
# from the integrit README file:
#
# Here's a table of letters and the corresponding checks / options:
#
# s checksum
# i inode
# p permissions
# t file type
# d device type (if file is blk or chr special)
# l number of links
# u uid
# g gid
# z file size (redundant if checksums are on)
# a access time
# m modification time
# c ctime (time UN*X file info last changed)
# r reset access time (use with care)
# Files whose contents are expected to change only get checks on
# permissions, user owner and group owner of the file.
/root/.ssh/random_seed SIMC
/root/.bash_history SIMC
/root/.Xauthority SIMC
/root/databases/integrit-foohost.conf SIMC
=/root/.netscape
=/root/.cpan
/etc/mtab SIMC
#--------this one gets over-written at boot, so only report changes
# in its contents
/etc/motd sIMC
/etc/ssh/ssh_random_seed SIMC
/etc/ntp/drift SIMC
/dev S
=/usr/src
=/usr/local/src
# to cut down on runtime and db size:
=/usr/doc
=/usr/info
=/usr/share/zoneinfo
=/usr/share/gnome/help
=/usr/share/gimp
=/home
=/var/spool
/var/log SIMC
=/var/lock
=/var/tmp SILMC
/var/run/utmp SIMC
=/var/catman
#---------------------- user-generated fonts
=/var/lib/texmf/pk
/var/run/sshd.pid SIMC
=/var/lib/mysql
=/var/lib/pgsql
/var/run SIMC
#---------------------- files that change a lot
/usr/local/man/whatis SIMC
/usr/X11R6/man/whatis SIMC
/usr/lib/perl5/man/whatis SIMC
/usr/man/whatis SIMC
/etc/ssh_random_seed SIMC
/var/lib/slocate SIMC
/var/lib/logrotate.status SIMC
# unusual directories
=/proc L
=/tmp SILMC
!/mnt
#---------------the web stuff deserves special attention
# we're not checking content files, just system
# files.
=/web/BIOMED
=/web/DEVEL
=/web/INTRA
=/web/IT
=/web/LOCAL
=/web/SSL
=/web/TEST
# do check /web/apache
=/web/apache/conf.30Jun99
!/web/apache/logs
# do check /web/bin
=/web/cache
# do check /web/cgi-bin
=/web/src
#--------------nfs directories
!/mnt/secdb
!/barhost-home
!/adm/barhost-cgi
|