Monitor only hostname in /var/lib/tor/services

PR #2963 introduced monitoring of /var/lib/tor folder, however these folders contain private key material. It would be more prudent (and at no cost integrity monitoring capabilities) to exclusively monitor the hostname. Fixes #3090
freedomofpress · Mar 1, 2018 · 54ebfcf · 54ebfcf
1 parent 259da58
commit 54ebfcf
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/install_files/securedrop-ossec-agent/var/ossec/etc/ossec.conf b/install_files/securedrop-ossec-agent/var/ossec/etc/ossec.conf
@@ -13,7 +13,9 @@
     <directories realtime="yes" check_all="yes" report_changes="yes">/var/securedrop</directories>
     <directories realtime="yes" check_all="yes" report_changes="yes">/var/www</directories>
     <directories realtime="yes" check_all="yes" report_changes="yes">/var/lib/securedrop</directories>
-    <directories realtime="yes" check_all="yes" report_changes="yes">/var/lib/tor/services</directories>
+    <directories realtime="yes" check_all="yes" report_changes="yes">/var/lib/tor/services/source/hostname</directories>
+    <directories realtime="yes" check_all="yes" report_changes="yes">/var/lib/tor/services/journalist/hostname</directories>
+    <directories realtime="yes" check_all="yes" report_changes="yes">/var/lib/tor/services/ssh/hostname</directories>
     <directories realtime="yes" check_all="yes" report_changes="yes">/var/lib/tor/lock</directories>
     <directories realtime="yes" check_all="yes" report_changes="yes">/boot</directories>