TAILIEUCHUNG - Open Source Security Tools : Practical Guide to Security Applications part 26

Open Source Security Tools : Practical Guide to Security Applications part 26. Few frontline system administrators can afford to spend all day worrying about security. But in this age of widespread virus infections, worms, and digital attacks, no one can afford to neglect network defenses. Written with the harried IT manager in mind, Open Source Security Tools is a practical, hands-on introduction to open source security tools. | Page 229 Thursday June 24 2004 12 17 PM Host-Based Intrusion Detection 229 Tripwire policies operate on the concept of ignore flags. You can configure Tripwire to keep track of or ignore different file properties. You use a plus sign to track properties and a - minus sign to ignore them. The format for the policy file statement is as follows file directory name - property mask For example this line in the policy file etc - amcpstu would cause Tripwire to notify you any time the last access time creation or modification time permissions ownership or file size and type changed on the file in etc. There are also several predefined property masks. Table lists these template property masks and their effects. These predefined variables fit the behavior of different sets of files. For instance you may want to use Readonly for your key configuration files since their access dates will be changing when programs use them but you don t want the size or content to change. You could use Growing for your log files since they will be constantly growing or should be anyways . The policy configuration file also defines some variables that are combinations of the above presets with a few additions or subtractions. These give you a way to quickly set policies for various different classes of files. You can change them slightly if you want to ignore or examine more things. Listing shows these variables from the policy file. Table Template Property Masks Property Masks Effects Readonly pinugtsdbmCM-rlasSH Dynamic pinugtd- srlbamcCM SH Growing pinugtdl-srbamcCMSH Device pugsdr-intlbamcCMSH IgnoreAll -pinugtsdrlbamcCM SH IgnoreNone pinugtsdrlbamcCMSH Page 230 Thursday June 24 2004 12 17 PM 230 Chapter 7 Intrusion Detection Systems Listing Property Mask Variables SEC_CRIT IgnoreNone -SHa Critical files that cannot change SEC_SUID IgnoreNone -SHa Binaries with the SUID or SGID flags set SEC_BIN Readonly Binaries

TỪ KHÓA LIÊN QUAN
TAILIEUCHUNG - Chia sẻ tài liệu không giới hạn
Địa chỉ : 444 Hoang Hoa Tham, Hanoi, Viet Nam
Website : tailieuchung.com
Email : tailieuchung20@gmail.com
Tailieuchung.com là thư viện tài liệu trực tuyến, nơi chia sẽ trao đổi hàng triệu tài liệu như luận văn đồ án, sách, giáo trình, đề thi.
Chúng tôi không chịu trách nhiệm liên quan đến các vấn đề bản quyền nội dung tài liệu được thành viên tự nguyện đăng tải lên, nếu phát hiện thấy tài liệu xấu hoặc tài liệu có bản quyền xin hãy email cho chúng tôi.
Đã phát hiện trình chặn quảng cáo AdBlock
Trang web này phụ thuộc vào doanh thu từ số lần hiển thị quảng cáo để tồn tại. Vui lòng tắt trình chặn quảng cáo của bạn hoặc tạm dừng tính năng chặn quảng cáo cho trang web này.