/usr/share/doc/samhain/manual.html/database-configuration-file-download.html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN""http://www.w3.org/TR/html4/loose.dtd">
<HTML
><HEAD
><TITLE
>Enabling baseline database / configuration file download from the server</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.79"><LINK
REL="HOME"
TITLE="The Samhain Host Integrity Monitoring System"
HREF="index.html"><LINK
REL="UP"
TITLE="Configuring yule, the log server"
HREF="yule.html"><LINK
REL="PREVIOUS"
TITLE="Enabling logging to the server"
HREF="enabling-logging-to-the-server.html"><LINK
REL="NEXT"
TITLE="Rules for logging of client messages"
HREF="server-logging.html"><LINK
REL="STYLESHEET"
TYPE="text/css"
HREF="./docbook.css"></HEAD
><BODY
CLASS="SECT1"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/header.html"--><!--#endif --><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>The Samhain Host Integrity Monitoring System</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="enabling-logging-to-the-server.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
>Chapter 6. Configuring <SPAN
CLASS="APPLICATION"
>yule</SPAN
>, the log server</TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="server-logging.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="DATABASE-CONFIGURATION-FILE-DOWNLOAD"
>6.5. Enabling baseline database / configuration file download from the server</A
></H1
><P
>A significant advantage of <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> is the
option to store baseline databases and configuration files on the
central log server (<SPAN
CLASS="APPLICATION"
>yule</SPAN
>), from where they
can be downloaded by clients upons startup. In order to use this option,
clients must be configured to retrieve these files from the server rather
than from the local filesystem.</P
><DIV
CLASS="TIP"
><P
></P
><TABLE
CLASS="TIP"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/tip.gif"
HSPACE="5"
ALT="Tip"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Tip</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  Obviously, retrieving the configuration file from
  the log server requires that the IP address of the log server is
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>compiled in</I
></SPAN
>, using the option
  <B
CLASS="COMMAND"
>./configure --with-logserver=HOST</B
>.</P
></TD
></TR
></TABLE
></DIV
><P
>Downloaded files are written to a temporary file that is created
in the home directory of the effective user (usually <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>root</I
></SPAN
>.
The filename is chosen at random, the file is opened for writing 
after checking that it does not exist already, and immediately 
thereafter unlinked.
Thus the name of the file will be deleted from the filesystem, 
but the file itself will remain in existence until the file descriptor
referring it is closed (see <B
CLASS="COMMAND"
>man unlink</B
>), 
or the process exits
(on exit, all open file descriptors belonging to the process are closed).</P
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="CONFIGURATION-FILE-DOWNLOAD"
>6.5.1. Configuration file</A
></H2
><P
>If the compiled-in path to the configuration file begins with the
special value ``REQ_FROM_SERVER'', the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>client</I
></SPAN
> 
will request to download 
the configuration file from <SPAN
CLASS="APPLICATION"
>yule</SPAN
> 
(i.e. from the server).</P
><P
>If ``REQ_FROM_SERVER'' is followed by a path, 
the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>client</I
></SPAN
> will use the path 
following ``REQ_FROM_SERVER'' as a
fallback if (<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>and only if</I
></SPAN
>) it is initializing 
the database. This is a convenience feature to allow initializing
the database(s) before the client is registered with the server.</P
><P
>Example: 
<B
CLASS="COMMAND"
>./configure --with-config-file=REQ_FROM_SERVER/etc/conf.samhain</B
>
In this case, the client will request to download 
the configuration file from the server. If the connection to the server
fails, it will exit on error if run in 'check' mode, but
fallback to 
<TT
CLASS="FILENAME"
>/etc/conf.samhain</TT
> as its configuration file, if
run in 'init' mode.</P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Note</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
> For obvious security reasons, the client cannot specify the path
 to the configuration file on the server side. The server will lookup
 the configuration file using only the hostname of the client and
 the compiled-in path for the 'localstatedir' (see below).
 The default for 'localstatedir' is 
 <TT
CLASS="FILENAME"
>/var</TT
>. </P
></TD
></TR
></TABLE
></DIV
><P
>The server will search for the configuration file to send 
in the following 
order of priority 
(paths are explained in <A
HREF="paths.html"
>Section A.5</A
>&#62;). 
<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>CLIENTNAME</I
></SPAN
> is the hostname of the client's host,
as listed in the server's config file in the 
<B
CLASS="COMMAND"
>Clients</B
> section:</P
><P
><P
></P
><OL
TYPE="1"
><LI
><P
>     <TT
CLASS="FILENAME"
>localstatedir/lib/yule/rc.CLIENTNAME</TT
>
   </P
></LI
><LI
><P
>     <TT
CLASS="FILENAME"
>localstatedir/lib/yule/rc</TT
>
   </P
></LI
></OL
></P
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="DATABASE-FILE-DOWNLOAD"
>6.5.2. Database file</A
></H2
><P
>If the compiled-in path to the database file begins with the
special value ``REQ_FROM_SERVER'', the 
<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>client</I
></SPAN
> will request to download 
the database file from <SPAN
CLASS="APPLICATION"
>yule</SPAN
>  
(i.e. from the server).</P
><DIV
CLASS="WARNING"
><P
></P
><TABLE
CLASS="WARNING"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/warning.gif"
HSPACE="5"
ALT="Warning"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>CAVEAT</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>``REQ_FROM_SERVER'' <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>must</I
></SPAN
> be followed 
by a path that will be used for
writing the database file when <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>initializing</I
></SPAN
>.
Upon initialization, the database is always written to a local file, and
must be copied with <B
CLASS="COMMAND"
>scp</B
> to the server (the client 
cannot <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>upload</I
></SPAN
> the database file to the server, 
as this would open a security hole).</P
></TD
></TR
></TABLE
></DIV
><P
>Example: <B
CLASS="COMMAND"
>--with-data-file=REQ_FROM_SERVER/var/lib/samhain/data.samhain</B
>
In this case, the client will request to download 
the database file from the server if <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>checking</I
></SPAN
>, 
and will create a local
database file <TT
CLASS="FILENAME"
>/var/lib/samhain/data.samhain</TT
> 
if <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>initializing</I
></SPAN
>. You
have to use <B
CLASS="COMMAND"
>scp</B
> to copy the file signature database 
to the server then.</P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Note</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
> For obvious security reasons, the client cannot specify the path
 to the database file on the server side. The server will lookup
 the databse file using only the hostname of the client and
 the compiled-in path for the 'localstatedir' (see below).
 The default for 'localstatedir' is 
 <TT
CLASS="FILENAME"
>/var</TT
>. </P
></TD
></TR
></TABLE
></DIV
><P
>The server will search for the database file to send in the following 
order of priority (see <A
HREF="paths.html"
>Section A.5</A
>&#62;).
<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>CLIENTNAME</I
></SPAN
> is the hostname of the client's host,
as listed in the server's config file in the 
<B
CLASS="COMMAND"
>Clients</B
> section:</P
><P
><P
></P
><OL
TYPE="1"
><LI
><P
>     <TT
CLASS="FILENAME"
>localstatedir/lib/yule/file.CLIENTNAME</TT
>
   </P
></LI
><LI
><P
>     <TT
CLASS="FILENAME"
>localstatedir/lib/yule/file</TT
>
   </P
></LI
></OL
></P
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="enabling-logging-to-the-server.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="server-logging.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Enabling logging to the server</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="yule.html"
ACCESSKEY="U"
>Up</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Rules for logging of client messages</TD
></TR
></TABLE
></DIV
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/footer.html"--><!--#endif --></BODY
></HTML
>
samhain 3.1.0-7 / usr / share / doc / samhain / manual.html / database-configuration-file-download.html
