Samhain | ||
---|---|---|
<<< Previous | Next >>> |
![]() | TIP |
---|---|
The most frequent problems are:
|
An untrusted user (might be an untrusted group member for group writeable files/directories) owns or can write to an element in the path listed in the error message. This concerns the configuration file, the log file, and the database file.
The offending element in the path is identified as obj=/xxx in the error message.
To fix the problem, determine relevant users and/or group members, and use the configure option --with-trusted=LIST_OF_TRUSTED_UIDS (not GIDS !)
./configure [more options] --with-trusted=0,...
See above
See above
If you have compiled for stealth, you won't see much, because if obfuscated, then both a 'normal' and an XML logfile look, well ... obfuscated. Use 'samhain -jL /path/to/logfile' to view the logfile.
Fix your DNS (reverse lookup: numerical IP address to FQDN, to verify FQDN to numerical IP address). If this problem happens for client/server connections: also see the section called Server>.
First, nslookup does not use the system resolver library — it has its own resolving routines, and does things differently than the resolver library (see the book DNS and bind). Therefore, it is not exactly the best tool for debugging name resolving problems. Second, did you check reverse lookup as well as forward lookup ?
Because /dev/random can block for a long time if there is no entropy, samhain will fall back on /dev/urandom after some timeout, and issue this message (it will try /dev/random again next time).
Set SeverityNames to a low value (see the section called Severity levels in the chapter called Configuration — Basic>).
<<< Previous | Home | Next >>> |
Design | Standalone/Client |