-
Notifications
You must be signed in to change notification settings - Fork 133
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fixes #227 : Add system_audit subsection in rootcheck #228
Changes from 1 commit
0b92465
96e2e89
624daa7
057f54e
f8614d0
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -73,6 +73,9 @@ | |
|
||
$active_response_ca_verification = 'yes' | ||
|
||
## system audit | ||
$ossec_rootcheck_system_audit = $::wazuh::params_agent::default_rootcheck_system_audit | ||
|
||
# OS specific configurations | ||
case $::kernel { | ||
'Linux': { | ||
|
@@ -233,6 +236,11 @@ | |
|
||
$manage_repo = true | ||
|
||
$default_rootcheck_system_audit = [ | ||
"./shared/system_audit_rcl.txt", | ||
"./shared/system_audit_ssh.txt", | ||
] | ||
|
||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. |
||
case $::osfamily { | ||
'Debian': { | ||
$service_has_status = false | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -35,6 +35,11 @@ | |
<% if @ossec_rootcheck_rootkit_trojans-%> | ||
<rootkit_trojans><%= @ossec_rootcheck_rootkit_trojans %></rootkit_trojans> | ||
<%- end -%> | ||
<%- if @ossec_rootcheck_system_audit -%> | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I would check if the list is empty or not, rather than checking if it's defined. Changed in 96e2e89 Thanks, There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. @rshad ah! my bad, thanks for pointing it out and fixing it :) |
||
<%- @ossec_rootcheck_system_audit.each do |audit_file| -%> | ||
<system_audit><%= audit_file %></system_audit> | ||
<%- end -%> | ||
<%- end -%> | ||
<% if @ossec_rootcheck_skip_nfs-%> | ||
<skip_nfs><%= @ossec_rootcheck_skip_nfs%></skip_nfs> | ||
<%- end -%> | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
No need to use an auxiliary variable
default_rootcheck_system_audit
.Changed in 624daa7 & 057f54e.
Thanks,