file_change.cf (b3fcd1a1b634d1cac26a23774a325f35128b53d29ac2281caffeb909757c2a70)

2.4 kB, 61 lines, CFEngine policy:

#########################################################################
#
#   file_change.cf - Change Management
#
#   NOTE: Be careful with the amount of data that CFEngine is to watch.
#         Large amounts can cause resource hogs and long-running agents.
#
#########################################################################

bundle agent change_management
{
  vars:

    linux::

      "watch_files_report_diffs"
        slist =>  {
                   "/etc/passwd",
                   "/etc/group",
                   "/etc/services",
                   "$(sys.statedir)/pg/data/postgresql.conf",
                  },
        comment => "These files will be watched for change, and diffs will be
                    reported back to mission portal if you are running CFEngine
                    Enterprise.";

      "watch_files_report_change"
        slist => { "/etc/shadow" },
        comment => "These files will be watched for change. No diffs will be
                    reported back to mission portal, only that the file did
                    change.";

  files:

    linux::

      "$(watch_files_report_diffs)" -> { "InfoSec" }
        changes => diff,
        handle => "change_management_files_watch_files_report_diffs",
        if => fileexists( $(watch_files_report_diffs) ),
        comment => "Unplanned changes of these files may indicate a security
                    breach.";

      "$(watch_files_report_change)" -> { "InfoSec" }
        changes => detect_content_using("sha256"),
        if => fileexists( $(watch_files_report_change) ),
        comment => "Unplanned changes of these files may indicate a security
                    breach. (Diffs are not reported in case those with access
                    to this report should not have access to shadow entries.)";

      #######################################################################
      # Redundant cross monitoring for strong `tripwire' ...............
      #######################################################################

      #  "$(sys.workdir)/nw/$(neighbours)_checksum_digests.db"

      #     comment => "Watching our peers remote hash tables for changes - cross check",
      #   copy_from => remote_cp("$(sys.workdir)/checksum_digests.db","$(neighbours)"),
      #      action => neighbourwatch("File hash changes observed on $(neighbours) (neighbourhood watch)");

}