2.4.4 Checksum Alerts
cfengine has a checksum alert feature. To monitor changes to a file’s checksum, do the following:
•Add the following stanza to /var/opt/dsau/cfengine_master/inputs/ cfagent.conf:
ChecksumUpdates = ( “on” )
•In cfagent.conf’s "files" actionsequence, add checksum = md5 or checksum = sha options for the files to monitor. For example,
files:
class::
/etc/example mode = 644 checksum = md5
Note that this checksum option is different from the checksum = true option used in the copy actionsequence. That option tells cfengine to use checksums instead of timestamps when deciding if files need to be copied.
cfagent creates the checksum database on the client if it does not already exist. When ChecksumUpdates is set to "on" or "true", then the current checksum for the monitored files is added to or updated in the checksum database. After this initial run to populate the checksum database, change ChecksumUpdates to "off". At this point, any changes to a checksum of a monitored file causes a security warning. For example:
host1: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
host1: SECURITY ALERT: Checksum for /etc/example changed!
host1: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2.5 Disabling Use of cfengine
The csync_wizard does not have an unconfigure option to stop a system from being a master server. To disable a master server, simply stop cfservd:
#/sbin/init.d/cfservd stop
To prevent cfservd from starting at system startup, edit /etc/rc.config.d/cfservd and change CSYNC_CONFIGURED to "0".
If the csync_wizard was used to create the cfengine configuration and add managed clients, it can be used to remove managed clients. Run the wizard on the master server and select the "Remove a client" option. The wizard requires that
2.6 Logging Options
cfengine is intentionally silent about most configuration changes but there are several configuration options to increase the verbosity of cfengine output, as follows:
•Most cfagent.conf actions such as "copy," "editfiles," and "processes," support a syslog = true option to cause the specific action to be logged to syslog.
•Similarly, most actions support an "inform = true" option to cause cfagent to report any changes.
•cfagent.conf’s control section supports global "inform = (true)" and "syslog = true" options.
•cfagent (see cfagent(8)) supports the
