Samhain | ||
---|---|---|
<<< Previous | Configuration — yule, the log server | Next >>> |
![]() | TIP |
---|---|
Obviously, retrieving the configuration file from the log server requires that the IP address of the log server is compiled in, using the option ./configure --with-logserver=HOST. |
On the client side, transferred data are written to a temporary file that is created in the home directory of the effective user. The filename is chosen at random, the file is opened for writing after checking that it does not exist already, and immediately thereafter unlinked. Thus the name of the file will be deleted from the filesystem, but the file itself will remain in existence until the file descriptor referring it is closed (see man unlink), or the process exits (on exit, all open file descriptors belonging to the process are closed).
If the compiled-in path to the configuration file begins with the special value ``REQ_FROM_SERVER'', the client will request to download the configuration file from yule (i.e. from the server).
If ``REQ_FROM_SERVER'' is followed by a path, the server will use that path as the path to its configuration file (basically, this feature allows to use the same configuration options for client and server).
The client will use the path following ``REQ_FROM_SERVER'' as a fallback if (and only if) it is initializing the database.
Example: ./configure --with-config-file=REQ_FROM_SERVER/etc/conf.samhain In this case, the client will request to download the configuration file from the server, while the server would use /etc/conf.samhain as its configuration file.
The server will search for the configuration file to send in the following order of priority (paths are explained in the Section called Paths in the appendix called List of compilation options>). clientname is the hostname of the client's host, as listed in the server's config file in the Clients section:
localstatedir/lib/yule/rc.clientname
localstatedir/lib/yule/rc
If the compiled-in path to the database file begins with the special value ``REQ_FROM_SERVER'', the client will request to download the database file from yule (i.e. from the server).
![]() | CAVEAT |
---|---|
``REQ_FROM_SERVER'' must be followed by a path that will be used for writing the database file when initializing (the client cannot upload the database file to the server, as this would open a security hole). |
Example: --with-data-file=REQ_FROM_SERVER/var/lib/samhain/data.samhain In this case, the client will request to download the database file from the server if checking, and will create a local database file /var/lib/samhain/data.samhain if initializing. You have to use scp to copy the file signature database to the server then.
The server will search for the database file to send in the following order of priority (see the Section called Paths in the appendix called List of compilation options>). clientname is the hostname of the client's host, as listed in the server's config file in the Clients section:
localstatedir/lib/yule/file.clientname
localstatedir/lib/yule/file
<<< Previous | Home | Next >>> |
Enabling logging to the server | Up | Server status information |