diff options
Diffstat (limited to 'security/ossec-hids-local-config/pkg-help-local')
| -rw-r--r-- | security/ossec-hids-local-config/pkg-help-local | 31 |
1 files changed, 31 insertions, 0 deletions
diff --git a/security/ossec-hids-local-config/pkg-help-local b/security/ossec-hids-local-config/pkg-help-local new file mode 100644 index 0000000..6962307 --- /dev/null +++ b/security/ossec-hids-local-config/pkg-help-local @@ -0,0 +1,31 @@ +Unless stated otherwise, every option here corresponds to certain configuration +block which would be placed in one of the configuration files in "ossec.conf.d" +directory. Disabled options will do the same, but for "ossec.conf.d/disabled" +directory. All "*.conf" files from the "ossec.conf.d" directory will be merged +into "ossec.conf" in alphabetic order. If you are not satisfied with the +generated configuration, you can disable the corresponding option and use files +from "ossec.conf.d/disabled" directory as samples. + +Files generated by the port will be overwritten during port upgrades so any +additional configuration should be put in separate files. + +File Integrity Checking: + + NOAUTO_SC: + OSSEC by default will ignore files that change too often (after the third + change). This option disables this feature. Files that change too often + as a result of correct system operation should better be added to ignore + list manually. + +Command Output Monitoring: + + Adds additional commands, the output of which can be monitored. To actually + send alerts about the changing output, the proper rules need to be configured + as well (see CMDOUT_R option). + These commands can be tweaked in "command.conf". + +Active Response Firewall: + + Creates "firewall-drop.sh" hardlink to one of the scripts shipped with OSSEC. + This option is only meaningful if "firewall-drop" active response will be + enabled in the configuration. |