$ cat /usr/local/oinkmaster/oinkmaster.conf
# $Id: oinkmaster.conf,v 1.73 2003/09/02 19:40:29 andreaso Exp $ #
################################################
# General options you may want to change #
################################################
# URL to the rules archive to download (or copy).
# Must begin with http://, ftp:// or file:// and end with .tar.gz
# Use this one if you're running the latest release version of Snort
# (or following snort-STABLE):
url = http://www.snort.org/dl/rules/snortrules-stable.tar.gz
# Use this one *only* if you're following snort-CURRENT.
# This ruleset usually only works with recent develop versions of Snort!
# url = http://www.snort.org/dl/rules/snortrules-current.tar.gz
# Or if you prefer to download the rules archive from outside Oinkmaster,
# you can then point to the file on your local filesystem by using
# file://, for example:
# url = file:///tmp/snortrules.tar.gz
# The PATH to use during execution.
# 'tar' and 'gzip' must be found, and also 'wget' if fetching rules
# from a remote host (all with optional .exe suffix).
# Assume UNIX style by default:
path = /bin:/usr/bin:/usr/local/bin
# Example if running native Win32 or standalone Cygwin:
# path = c:\oinkmaster;c:\oinkmaster\bin
# Example if running standalone Cygwin and you prefer Cygwin style path:
# path = /cygdrive/c/oinkmaster:/cygdrive/c/oinkmaster/bin
# Temporary directory to use. This directory must exist when starting
# (Oinkmaster will then create a temporary sub directory in here).
# Keep it as a #comment if you want to use the default.
# The default will be checked for in the environment variables TMP,
# TMPDIR or TEMPDIR, or otherwise "/tmp" if none of them was set.
# Example for UNIX:
# tmpdir = /home/oinkmaster/tmp/
# Example if running native Win32 or Cygwin:
# tmpdir = c:\tmp
# Example if running Cygwin and you prefer Cygwin style path:
# tmpdir = /cygdrive/c/tmp
# The umask to use during execution if want it to be something else
# than the current value when starting Oinkmaster
# (keep it commented out to use the current value).
# For example:
# umask = 0027
# Files in the archive matching this regexp will be checked
# for changes, and then updated or added if needed.
# (You can then choose to skip individual files by specifying
# the "skipfile" keyword below".)
# Normally you shouldn't need to change this one.
# (But if you do, make sure it's still a valid regexp.)
update_files = \.rules$|\.config$|\.conf$|\.txt$|\.map$
# If the number of rules files in the downloaded archive matching the
# 'update_files' regexp is below min_files, or if the total number
# of rules in it is below min_rules, the archive is regarded as
# broken and the update is aborted with an error message.
# Both are set to 1 by default (i.e. the archive is only regarded as
# broken if it's totally empty).
# min_files = 1
# min_rules = 1
#######################################################################
# Files to totally skip (i.e. never update them or check for changes) #
# #
# Syntax: skipfile filename #
# or: skipfile filename1, filename2, filename3, ... #
#######################################################################
# Ignore (skip) "local.rules" from the rules archive by default, since we might
# have put some local rules in our own "local.rules", and we don't want
# it to get overwritten by the empty one from the archive after each update.
skipfile local.rules
# Also skip snort.conf from the rules archive by default since we don't
# want to overwrite our own snort.conf if we have it in the same directory as
# the rules. (If you have your own ("real") snort.conf in another directory, it
# may be really nice to check for changes in this file though, especially since
# new variables are sometimes added!)
skipfile snort.conf
# The file deleted.rules contains rules that have been deleted from other files.
# There is usually no point in watching it, but it may sometimes contain useful
# comments about *why* certain rules are deleted.
# Remove the comment to skip this file.
# skipfile deleted.rules
##########################################################################
# SIDs to modify after each update (only for the skilled/stupid/brave). #
# Don't use it unless you have to. There is nothing that stops you from #
# modifying rules in such ways that they become invalid. #
# If you just want to disable SIDs, please skip this section and have a #
# look at the "disablesid" keyword below. #
# #
# You may specify several modifysid directives for the same SID, and #
# you may also specify a list of SIDs on which the substitution should #
# be applied. Note that #comments are NOT allowed on "modifysid" lines. #
# #
# Syntax: modifysid SID "replacethis" | "withthis" #
# or: #
# Syntax: modifysid SID1, SID2, SID3, ... "replacethis" | "withthis" #
# #
# The strings within the quotes will simply be passed to a #
# s/replacethis/withthis/ statement in Perl, so they must be valid #
# regular expressions. #
# #
##########################################################################
# Example to enable a rule (in this case SID 1325) that is disabled by
# default, by simply replacing "#alert" with "alert".
# modifysid 1325 "#alert" | "alert"
# But since it's actually regexps, it's better to make sure we only replace
# the "#alert" if it's at the beginning of the line and also don't care about
# possible whitespaces.
# modifysid 1325 "^\s*#\s*alert" | "alert"
# Example to add "tag" stuff to SID 1325.
# modifysid 1325 "sid:1325;" | "sid:1325; tag: host, src, 300, seconds;"
# Example to make SID 1378 a 'drop' rule (valid if you're running Snort_inline).
# modifysid 1378 "^\s*alert" | "drop"
# Example to replace first occurrence of $EXTERNAL_NET with $HOME_NET in SID 302.
# Remember that the strings are regular expressions, so you must
# escape special characters like $.
# modifysid 302 "\$EXTERNAL_NET" | "\$HOME_NET"
# You can also specify that a substitution should apply on several SIDs.
# modifysid 302,429,1821 "\$EXTERNAL_NET" | "\$HOME_NET"
# You can take advantage of the fact that it's regular expressions and
# do more complex stuff. This example (for Snort_inline) adds a 'replace'
# statement to SID 1324.
# modifysid 1324 "(content\s*:\s*"\/bin\/sh"\s*;)" | "$1 replace:"\/foo\/sh";"
#############################################
# SIDs to comment out after each update #
# #
# Syntax: disablesid SID #
# or: disablesid SID1, SID2, SID3, ... #
#############################################
# You can specify one SID per line:
# disablesid 1
# disablesid 2
# disablesid 3
# And also as comma-separated lists:
# disablesid 4,5,6
|
