14. Loadable Module: Open Files (IDM_open_files.pm)

The IDM_open_files modules monitors all open files in specified directories (and their subdirectories):

• it is expected that particular directories will be selected, e.g., those in which intruder-related software is commonly hidden;
• regular-expressions can be used.

14.1. Signature Configuration

Files:

    /etc/IDM_open_files/expected.local.lsof
    /etc/IDM_open_files/expected.<platform>.lsof

14.1.1. Example Signature Files

This example file configures IDM_open_files to monitor two directories, /dev, where intruder-related software if often hidden, and /lib,

    #
    # -- reg-exps are fine (encouraged) :
    #

    DIR: "/dev"

      initctl
      null
      ptmx
      xconsole
      zero
      pts\/\d
      ttyS\d
      tty\d

    DIR: "/lib64"
    
      ld-2.3.4.so
      lib.*so.*
      security\/pam_[a-z0-9]+.so

14.1.2. Signature Processing

The configurations given for a particular directory are converted into a regular expression match, for example, for /lib64, as specified above:

    $of =~ m/ld-2.3.4.so
        |lib.*so.*
        |security\/pam_[a-z0-9]+.so/x