Host Intrusion Detection System Administrator's Guide Release 3.1

Templates and Alerts
UNIX Regular Expressions
Appendix A
128
UNIX Regular Expressions
UNIX regular expressions are supported to specify template directory and file
properties.
Template properties that specify path names (for example, pathnames_to_watch,
pathnames_to_not_watch, pathnames_X, programs_X, etc.) are interpreted as UNIX
regular expressions. Refer to regexp(5) manpage for a description of regular
expressions and pattern matching notations. To match a specific file, you must use the
anchor characters ^ and $ (for example, ^/etc/passwd$). To match any file in a
particular directory, you must use the ^ anchor character and a trailing backslash (for
example, ^/stand/).
NOTE Be sure to correctly specify path names using regular expressions. For instance, if the
regular expression /var/t.* is changed to /var/t*, then the new regular expression
will match any path name that contains the substring /var/ because the * operator
matches 0 or more occurrences of the t character. Likewise, if the regular expression
^/opt/ is changed to /opt, the new regular expression will be significantly different and
much more encompassing. The regular expression /opt will match any path name that
contains the /opt substring, including those path names that do not start with /opt,
such as /dir1/opt2/file1.
The following examples illustrate the nuances of regular expressions:
Examples • The regular expression /home matches any file that contains /home in its path name,
such as /dir1/home, /dir1/hometown, /dir1/home2, and /home2/file1.
• The regular expression ^/home matches any file whose path name starts with
/home, such as /hometown, /home/file1, and /home2/file2.
• The regular expression ^/home/ matches any file under the /home directory, such as
/home/file1 and /home/dir1/file2.
• The regular expression ^/home$ exactly matches the /home directory or file.
• The regular expression /.rhosts matches any file on the system that contains a
slash followed by any character that is then followed by rhosts, such as
/dir1/arhosts, /1rhosts, /.rhosts, and /home/<user>/.rhosts.
• The regular expression /\.rhosts$ matches any .rhosts file on the system, such
as /.rhosts and /home/<user>/.rhosts. Notice the use of the backslash
character to escape the special dot (.) character.
• The regular expression ^/\.rhosts$ exactly matches the .rhosts file in the root
directory.
• The regular expression ^/home/[^/]*/\.rhosts$ matches all /.rhosts files in
home directories.
NOTE The special pattern-matching scheme in previous versions of HIDS (that is, V1.0 and
V2.x) is no longer supported.