Distributed Systems Administration Utilities User's Guide

2.4.4 Checksum Alerts
cfengine has a checksum alert feature. To monitor changes to a file’s checksum, do the following:
• Add the following stanza to /var/opt/dsau/cfengine_master/inputs/
cfagent.conf:
ChecksumUpdates = ( “on” )
• In cfagent.conf’s "files" actionsequence, add checksum = md5 or checksum =
sha options for the files to monitor. For example,
files:
class::
/etc/example
mode = 644
checksum = md5
Note that this checksum option is different from the checksum = true option used in the
copy actionsequence. That option tells cfengine to use checksums instead of timestamps
when deciding if files need to be copied.
cfagent creates the checksum database on the client if it does not already exist. When
ChecksumUpdates is set to "on" or "true", then the current checksum for the monitored files
is added to or updated in the checksum database. After this initial run to populate the checksum
database, change ChecksumUpdates to "off". At this point, any changes to a checksum of a
monitored file causes a security warning. For example:
host1: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
host1: SECURITY ALERT: Checksum for /etc/example changed!
host1: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2.5 Disabling Use of cfengine
The csync_wizard does not have an unconfigure option to stop a system from being a master
server. To disable a master server, simply stop cfservd:
# /sbin/init.d/cfservd stop
To prevent cfservd from starting at system startup, edit /etc/rc.config.d/cfservd and
change CSYNC_CONFIGURED to "0".
If the csync_wizard was used to create the cfengine configuration and add managed clients,
it can be used to remove managed clients. Run the wizard on the master server and select the
"Remove a client" option. The wizard requires that non-interactive ssh access to the managed
client has been configured as described in the section “Using the Wizard to Configure a
Synchronization Client” (page 25). The specified client will be deleted from cfrun.hosts, its
public key deleted from the master ppkeys directory, and the master’s key deleted from the
client’s ppkeys directory.
2.6 Logging Options
cfengine is intentionally silent about most configuration changes but there are several
configuration options to increase the verbosity of cfengine output, as follows:
• Most cfagent.conf actions such as "copy," "editfiles," and "processes," support
a syslog = true option to cause the specific action to be logged to syslog.
• Similarly, most actions support an "inform = true" option to cause cfagent to report
any changes.
• cfagent.conf’s control section supports global "inform = (true)" and "syslog =
true" options.
• cfagent (see cfagent(8)) supports the --inform switch on the command line. For more
information, refer to the cfengine reference manual in /opt/dsau/doc/cfengine or the
cfagentmanpage.
38 Configuration Synchronization