forked from 0xwindows/tiger
/
tigerrc-dist
294 lines (293 loc) · 10.7 KB
/
tigerrc-dist
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
#
# 'rc' file for tiger. This file is preprocessed, and thus
# can *only* contain variable assignments and comments.
#
#------------------------------------------------------------------------
#
# Select checks to perform. Specify 'N' (uppercase) for checks
# you don't want performed.
#
TigerNoBuild=Y # C files are corrupted (ouch.)
Tiger_Check_PASSWD=Y # Fast
Tiger_Check_PASSWD_FORMAT=N # Fast - not needed if on systems with pwck
Tiger_Check_PASSWD_SHADOW=Y # Time varies on # of users
Tiger_Check_PASSWD_NIS=N # Time varies on # of users
Tiger_Check_GROUP=Y # Fast
Tiger_Check_ACCOUNTS=Y # Time varies on # of users
Tiger_Check_RHOSTS=Y # Time varies on # of users
Tiger_Check_NETRC=Y # Time varies on # of users
Tiger_Check_ALIASES=Y # Fast
Tiger_Check_CRON=Y # Fast
Tiger_Check_ANONFTP=Y # Fast
Tiger_Check_EXPORTS=Y # Fast
Tiger_Check_INETD=Y # Fast
Tiger_Check_SERVICES=Y # Could be faster, not bad though
Tiger_Check_KNOWN=Y # Fast
Tiger_Check_PERMS=Y # Could be faster, not bad though
Tiger_Check_SIGNATURES=Y # Several minutes
Tiger_Check_FILESYSTEM=Y # Time varies on disk space... can be hours
Tiger_Check_ROOTDIR=Y # Fast, only 2 checks
Tiger_Check_ROOT_ACCESS=Y # Fast
Tiger_Check_PATH=Y # Fast for just root... varies for all
Tiger_Check_EMBEDDED=Y # Several minutes
Tiger_Check_OS=Y # Fast
Tiger_Check_SINGLE=Y # Fast
Tiger_Check_BACKUPS=Y # Fast
Tiger_Check_BOOT=Y # Fast
Tiger_Check_PATCH=N # Depends on your network connection
# (if no timeout is fixed it might stall)
Tiger_Check_LOGFILES=Y # Fast
Tiger_Check_USERUMASK=Y # Fast
Tiger_Check_ETCISSUE=N # Fast, needs to be customised
Tiger_Check_STRICTNW=Y # Fast - stringent N/W server checks
Tiger_Check_LISTENING=Y # Fast
Tiger_Check_SYSTEM=Y # Depends on the specific system checks
Tiger_Check_RUNPROC=N # Fast, needs to be customized per system
Tiger_Check_DELETED=Y # Depends on the number of processes on the
# system
Tiger_Check_APACHE=N # Fast
Tiger_Check_SENDMAIL=N # Fast
Tiger_Check_PRINTCAP=Y # Fast
Tiger_Check_EXRC=N # Depends on the size of the filesystem
#
# Should reports with no info be sent on cron?
#
Tiger_Cron_SendOKReports=N
#
# How many reports should be kept for each check when run from the
# crontab?
#
TigerCron_Log_Keep_Max=10
#
# Should reports be compared with a template? (if available)
# (Note: takes precedence over previous run check)
#
Tiger_Cron_Template=N
#
# Should reports be compared with previous runs? (if available)
#
Tiger_Cron_CheckPrev=Y
#
# Should messages tagged with INFO be shown?
#
Tiger_Show_INFO_Msgs=N
#
# In order for this to be effective, you should define 'CRACK' in
# a 'site' file.
#
# Note: Disabled for Debian since it (currently) does not work and
# the 'john' package can be configured to crack the passwords periodicly
Tiger_Run_CRACK=N # First time, ages; subsequent fairly quick
#
# Should we use canonical fully qualified domain names
# in the reports?
#
Tiger_Output_FQDN=Y
#
# Run Tripwire file integrity checker
#
# Disabled in Debian since this check is provided by itself when
# installing either Tripwire or other integrity-checking packages
# (aide, samhain...)
Tiger_Run_TRIPW=N # Slow
#
# Line size (for formatting of output)... default is 79...
# Specifying '0' means unlimited
#
Tiger_Output_Width=79
#
# Same as above, except used when run via 'tigercron'...
# You should set this once and never change it, 'cause if you
# change it, you'll get lots and lots of new stuff according
# to the scripts (the diff's against previous reports will find
# lots of changes due to the formatting changes).
#
Tiger_CRON_Output_Width=0
#
# Global places to confirm some type of default PATH setting.
# A simple space delimited list
#
Tiger_Global_PATH="/etc/profile /etc/csh.login"
#
# What password aging/constraints to check for.
# A simple space delimited list.
Tiger_Passwd_Constraints="PASS_MIN_DAYS PASS_MAX_DAYS PASS_WARN_AGE PASS_MIN_LEN"
#
# Number of days of non-modified files in the home directory for a user
# to be considered dormant (setting = 0 disables this check)
Tiger_Dormant_Limit=60
#
# What accounts are considered administrative (beyond root)
# (likely to not be used by humans, and therefore have impossible passwords)
# List of usernames separated by '|'... no whitespaces
Tiger_Admin_Accounts='adm|bin|daemon|games|lp|mail|news|operator|sync|sys|uucp|man|proxy|majordom|postgres|www-data|operator|irc|gnats'
#
# If an embedded pathname refers to an executable file, this executable
# will in turn be checked. This will continue "recursively" until
# either no new executables are found, or a maximum reference depth
# is reached. Setting this variable to 0 is equivalent to infinity.
# On a Sun 4/490, SunOS 4.1.2, 6GB disk, an infinite depth check
# took about 30 minutes. Your milage will vary.
#
# On small memory systems, a large search depth can result in out
# of memory situations for 'sort'... :-(...
#
Tiger_Embed_Max_Depth=3
#
# Only search executables for embedded pathnames. If this is
# set to 'N', then all regular files will be searched. Otherwise
# only executable files will be searched.
#
Tiger_Embed_Check_Exec_Only=Y
#
# Check all setuid executables found. This will cause 'tiger'
# to run longer on many systems, as it will have to wait for the
# file system scans to complete before it can begin checking the
# embedded pathnames.
#
Tiger_Embed_Check_SUID=Y
#
# Only report executables which are writable or not owned by root. If set
# to 'Y' only the executables will be reported. Any other value will result
# in regular files and directories being reported as well.
#
# Note that currently, device files are never reported.
#
Tiger_Embed_Report_Exec_Only=Y
#
# Who do you allow to own system files.
# List of usernames separated by '|'... no whitespace
#
Tiger_Embedded_OK_Owners='root|bin|uucp|sys|daemon'
#Tiger_Embedded_OK_Owners=root
#
# What groups can have write access to system files?
# List of group names separated by '|'... no whitespace.
# No value means no groups should have write access.
#
Tiger_Embedded_OK_Group_Write='root|bin|uucp|sys|daemon'
#
# Should all users' PATH variables be checked. This has the potential
# of being dangerous because of the way it is done. You might want to
# take a look at check_path and decide for yourself whether the precautions
# are sufficient before enabling this.
#
Tiger_Check_PATHALL=N # Check all user PATHs in startup files.
#
# Who can own executables in 'root's PATH?
# List of usernames separated by '|'... no whitespace
#
Tiger_ROOT_PATH_OK_Owners='root|uucp|bin|news|sys|daemon'
#Tiger_ROOT_PATH_OK_Owners='root'
#
# What groups can have write access to executables in 'root's PATH?
# List of group names separated by '|'... no whitespace.
# No value means no groups should have write access.
#
Tiger_ROOT_PATH_OK_Group_Write='root|uucp|bin|sys|daemon'
#
# Who can own things in other users PATH?
# List of usernames separated by '|'... no whitespace
#
Tiger_PATH_OK_Owners='root|bin|daemon|uucp|sys|adm'
#
# What groups can have write access to executables in non-root user PATH?
# List of group names separated by '|'... no whitespace.
# No value means no groups should have write access.
#
Tiger_PATH_OK_Group_Write=
#
# Should 'tiger' wait for Crack to finish? If set to 'Y' it will wait
# until it finishes. If set to 'N', it will collect the output if
# Crack finishes before the rest of the checks. If it isn't finished
# 'tiger' will simply report where the output will be stored.
#
Tiger_Collect_CRACK=Y
#
# Run Crack on local password sources only? If set to Y, no network
# sources will be used. If set to 'N', NIS, NIS+, NetInfo, etc
# sources will also be used.
#
Tiger_Crack_Local=Y
#
# Who sends output from 'tigercron'?
# Default is "root@$HOSTNAME" (gets expanded by tigercron)
#
# Tiger_Mail_FROM="root@`uname -n`"
#
# Who gets output from 'tigercron'?
#
Tiger_Mail_RCPT=root
#
# List of '/' separated filename globs (NOT pathnames) to look for
# on the filesystems.
#
Tiger_Files_of_Note="..[!.]*/.* */.* */.[!.]/.log/.FSP*"
#
# File system scan - things to look for
#
Tiger_FSScan_Setuid=Y # Setuid executables
Tiger_FSScan_Setgid=Y # Setgid executables
Tiger_FSScan_Devs=Y # device files
Tiger_FSScan_SymLinks=Y # strange symbolic links
Tiger_FSScan_ofNote=Y # weird filenames
Tiger_FSScan_WDIR=Y # world writable directories
Tiger_FSScan_Unowned=Y # files with undefined owners/groups
#
# Should we scan read-only filesystems
#
Tiger_FSScan_ReadOnly=N
#
# List of dot files commonly found in user home directories. These
# will be checked by check_accounts for proper access permissions.
#
# Note that .rhosts and .netrc need not appear here, as they will
# be checked by scan_rhosts or scan_netrc.
#
USERDOTFILES=".alias .kshrc .cshrc .profile .login .mailrc .exrc .emacs .forward .tcshrc .zshenv .zshrc .zlogin .zprofile .rcrc .bashrc .bash_profile .inputrc .xinitrc .fvwm2rc .Xsession .Xclients .less"
#
# Rhost sites which are expected to be in the .rhosts files.
# Anything that doesn't match will be reported. The patterns
# are simple patterns as used in Bourne Shell 'case' statement.
#
#RHOST_SITES='*.tamu.edu|jupiter'
# What uid's should not give warnings about valid shells
# (trusted or default users)
# Debian GNU/Linux: default is 999, users are generated over 1000
# Solaris: default should be 99, users are generated over 100
# HP-UX (?): default should be 499, users are generated over 500
Tiger_Accounts_Trust=999
# Should we give warnings on services that listen on all interfaces?
# (i.e. those that have not been configured to listen only on one)
# This is useful in servers which might add new interfaces (and thus
# services will be unexpectedly be offered in them too) or to catch
# "rogue" services
Tiger_Listening_Every=Y
#
# Which *user* do you allow to have processes listening for incoming connections
# on the system?
# List of usernames separated by '|'... no whitespaces allowed (but wildcards are)
#
Tiger_Listening_ValidUsers='root'
#
# Which processes are always considered valid, regardless of how are they
# listening for incoming connections on the system?
# This allows administrators to disable warnings on processes that might change
# the listening port dynamically (and thus cannot be removed through the
# template definitions)
# List of processes separated by '|'... no whitespaces allowed (but wildcards are)
#
Tiger_Listening_ValidProcs=''
#
# Which processess should be checked for by Tiger?
# Processes in this list (separated by whitespaces) which are not
# seen in the process table will generate a FAIL:
#
# The process list below is just an example, change it to suit your
# needs
#Tiger_Running_Procs='syslogd testing'
#
# Should we optimize DPKG checks? (by not using dpkg but looking on
# the file database at /var/lib/dpkg?)
#
Tiger_DPKG_Optimize=Y