surfnetids-log.conf

#####################################
# Logging Server configuration file #
#####################################

####################
# SURFids Options  #
####################
# The installation directory (no trailing forward slash).
$c_surfidsdir = "/opt/surfnetids";

# The language for the SURFids system
# Current available options:
# 
#    en = English
$c_language = "en";

# Maintenance mode
$c_maintenance = 0;

#######################
# Database connection #
#######################

# User info for the logging user in the postgresql database
$c_pgsql_pass = "enter_database_password_here";
$c_pgsql_user = "idslog";

# Postgresql database info
$c_pgsql_host = "localhost";
$c_pgsql_dbname = "idsserver";

# The port number where the postgresql database is running on.
$c_pgsql_port = "5432";

# Connection string used by the perl scripts.
$c_dsn = "DBI:Pg:dbname=$c_pgsql_dbname;host=$c_pgsql_host;port=$c_pgsql_port";

#######################
# Time options        #
#######################

# Default time period to show
# Possible values:
#   Today = 1
#   Last Hour = 2
#   Last 2 Hours = 3
#   Last 3 Hours = 4
$c_default_period = 1;

# The time difference between UTC and local time.
# UTC - local time = $c_utc_time
# For example, if CET is the local time, then the difference would be -1.
$c_utc_time = -1;

# The format of the dates displayed in the webinterface
# See http://www.php.net/manual/en/function.date.php
# for the syntax.

# Full date format
$c_date_format = "d-m-Y H:i:s";

# Date format without seconds
$c_date_format_short = "d-m-Y H:i";

# Date format without time
$c_date_format_notime = "d-m-Y";

# Date format without time or year (used in the graphs)
$c_date_format_noyear = "d-m";

################
# Webinterface #
################
# The version of the webinterface.
$c_version = "3.10";

# The port number where apache is running the webinterface on.
$c_web_port = "80";

# Location of the phplot.php library
$c_phplot = "$c_surfidsdir/include/phplot.php";

# Enable or disable the help popups in the webinterface
$c_showhelp = 1;

# The URL pointing to the SURFids FAQ page for this version
$c_faq_url = "http://ids.surfnet.nl/wiki/doku.php?id=latest_docs:faq";

# Enable or disable the download option of binaries in the webinterface
$c_download_binaries = 0;

# Binaries directory
$c_bindir = "$c_surfidsdir/binaries";

# Hide/show SURFnet specific functions (SOAP stuff).
$c_surfnet_funcs = 0;

# The starting day of the week modifier.    
# If this is 0, Sunday is the first day of the week
# If this is 1, Monday is the first day of the week
# Etc
$c_startdayofweek = 1;

# Load minified javascript libraries (speeds up webinterface)
# Turn this off if you encounter javascript problems
$c_minified_enable = 0;

# jQuery version
# This setting is good per default, 
# only change it if you want to manually upgrade jQuery yourself
$c_jquery_version = "1.4.1";

###################
# Cookie settings #
###################
# The name of the cookie. Default value will suffice.
$c_cookie_name = "SURFids";

# Domain that is valid for this cookie. The cookie can only be used by pages in this domain
$c_cookie_domain = "subdomain.domain.com";

# Path of the cookie. Cookie can only be used in this path, including subdirectories.
$c_cookie_path = "/";

# Expiry time of the cookie, set to 0 to let it expire with the session
$c_cookie_expiry = 0;

# This setting makes the cookie only available over HTTPS.
# 0 = FALSE
# 1 = TRUE
$c_cookie_https = 0;

#####################################
# Login method and session handling #
#####################################
# Login method.
# 1 = Less secure, more user friendly. Simple login.
# 2 = More secure, less user friendly. 2-step login.
$c_login_method = 1;

# Bind session ID to client IP addresses
$c_chksession_ip = 1;

# Bind session ID to User-Agent header information
$c_chksession_ua = 1;

# Session timeout in seconds (preferably should be the same as session.gc_maxlifetime in 
# the php.ini configuration file).
$c_session_timeout = 1440;

##########################
# Webinterface debugging #
##########################
# Enable SQL debugging for the webinterface
$c_debug_sql = 0;

# Enable SQL analysis (EXPLAIN ANALYZE postgresql stuff)
$c_debug_sql_analyze = 0;

# Enable user input debugging for the webinterface
$c_debug_input = 0;

# Allow/disallow all users to debug by giving a &int_debug=1 to the querystring.
# For example: https://server/surfnetids/sensorstatus.php?int_selview=1&int_debug=1
# would enable debugging for the sensorstatus page.
# NOTE: Any user can do this when enabled.
$c_allow_global_debug = 0;

# Default view for the sensorstatus page.
# 0 = View All sensors
# 1 = View all offline sensors
# 2 = View all online sensors
$c_selview = 2;

###############
# Search page #
###############
# Censor destination IP addresses.
# 0 = Don't censor anything.
# 1 = Censor only destination addresses not belonging to organisation ranges.
# 2 = Censor all destination addresses.
$c_censor_ip = 1;

# The censor replacement. This is the string that will replace the destination IP if censored.
$c_censor_word = "<censored>";

# Show the search time for each query in the search engine.
$c_searchtime = 0;

# Enable some query caching in the search engine. This will increase performance while browsing through the 
# search results, but may result in an inaccurate view of the total records found.
$c_search_cache = 1;

######################
# TCP Fingerprinting #
######################
# Enable p0f TCP fingerprinting results to be shown in the webpage. Also requires p0f to be enabled at the tunnel server.
$c_enable_pof = 0;

#######################
# GeoIP Location Info #
#######################
# Enable GeoIP location database to enable source IP country identification.
$c_geoip_enable = 0;

# The name of the GeoIP module to include. Expected to be in the $c_surfnetidsdir/includes/ directory.
$c_geoip_module = "geoipcity.inc";

# The name of the GeoIP data file. Expected to be in the $c_surfnetidsdir/includes/ directory.
$c_geoip_data = "GeoLiteCity.dat";

# The key used for the Googlemap API
$c_googlemap_key = "enter_googlemap_key_here";

################
# Rank page    #
################
# Variables used in the ranking page.

# Amount of exploits shown in the top exploits ranking.
$c_topexploits = 5;

# Amount of sensors shown in the top sensors ranking.
$c_topsensors = 10;

# Amount of organisations shown in the top organisations ranking.
$c_toporgs = 5;

# Amount of ports shown in the top ports ranking.
$c_topports = 10;

# Amount of filenames shown in the top filenames ranking.
$c_topfilenames = 10;

# Amount of source IP's shown in the top source IP's ranking.
$c_topsourceips = 10;

# Amount of protocols shown in the top protocols ranking.
$c_topprotocols = 5;

# Amount of attacker OS's shown in the top OS's ranking.
$c_topos = 5;

################
# Footer       #
################

# Address in footer 
$c_footer_address = "enter_footer_info_here";

################
# Contact      #
################

# Email address for the contact button 
$c_contact_mail = "enter_mail_address_here";

###########
# Logging #
###########
# Method of logging
# 0 - Don't log anything
# 1 - Log to /var/log/surfids.log
# 2 - Log to the database
# 3 - Both option 1 and 2
$c_log_method = 3;

# Level of logging
# LOG_DEBUG => 0
# LOG_INFO => 1
# LOG_WARN => 2
# LOG_ERROR => 3
# LOG_CRITICAL => 4
# Defines a number and logs all events with that number and higher
# Advised is to keep this level on LOG_INFO (1) 
$c_log_level = 0;

# Enable FlexiGrid on the System Logs page in the webinterface.
# Disabled this if you are experiencing problems with FlexiGrid.
# Disabling this will give you a lightweight grid.
$c_logsys_flexi = 1;

# The amount of records to show on the syslog page
$c_logsys_max = 40;

################
# Virus Scan   #
################

# Show the UPX scan results in the web interface
# Only works if you have enabled this on the tunnel server
$c_scan_upx = 0;

################
# Mail logging #
################

# Maillog From: address. This is the email adres that appears in the From header.
$c_from_address = 'enter_from_email_address_here';

# Maillog GNUPG passphrase.
$c_passphrase = "enter_GNU_passphrase_here";

# GNUPG home dir (the dir which contains the gpg keyring/database)
$c_gpg_homedir = "/root/.gnupg/";

# Hello command. This should be your localhost.localdomain (FQDN).
#$c_hello = "";

# Webinterface prefix (no trailing slash)
# Example: http://servername.domain.nl:$c_web_port/surfnetids
$c_webinterface_prefix = "enter_webinterface_prefix_here";

# Prefix for the subject of email reports
$c_subject_prefix = "[SURFids] ";

# Enable/disable Cymru mails
# If this option is enabled you can create reports in the 
# Cymru markup format: 
#   <ASN>  | <IP>  | <time> <info> | <ASN description>
#
# Enabling this option requires you to install the following perl package:
#   Net::Abuse::Utils
# See the FAQ L13 for more info.
$c_enable_cymru = 0;

#################
# Sandbox Email
#################
# These are the settings needed to retrieve the Norman reports from the mailbox they were sent to
# login credentials
$c_mail_username = 'email_username';
$c_mail_password = 'email_pass';

# mailhost and port
#$c_mail_mailhost = 'pop.gmail.com';
#$c_mail_port     = '995';
$c_mail_mailhost = 'mailhost';
$c_mail_port = '995';

# use SSL when connecting to the mailhost
$c_mail_usessl = 'true';

#################
# CWSandbox
#################
# These are additional settings needed to retrieve and process CWSandbox reports
# need a temp directory that we can write to
$c_cwtemp = "/var/tmp";

# This is where the mime attachements get exploded to
$c_cwmime = "$c_cwtemp/mimetemp";

# Enable or disable the view and download option of CWS Sandbox results in the webinterface
$c_cws = 0;

# The location of the Xalan binary
$c_xalanbin = "/usr/bin/xalan";

######################
# Ethernet Detection #
######################
# Enable the Ethernet detection script. 0 = OFF, 1 = ON
$c_ethernet_module = 0;

#########
# Argos #
#########
# Enable Argos.  0 = OFF, 1 = ON
$c_enable_argos = 0;

##################################################################
##################################################################
#   Options below are only used when you are not installing
#   the tunnel server package of the SURFids system
##################################################################
##################################################################

#################
# ARP Detection #
#################
# The time in seconds that the script will ignore alerts if it is a known alert
$c_arp_alert_expiry = 180;

# The refresh time in seconds of the static ARP list from the ARP module
$c_arp_static_refresh = 300;

# The refresh time of the dhcp static list
$c_dhcp_static_refresh = 300;

# The refresh time in seconds of the ARP cache from the ARP module
$c_arp_cache_refresh = 300;

# The refresh time in seconds of the sniff protos list
$c_sniff_protos_refresh = 300;

# The refresh time in seconds of the email reports
$c_mail_refresh = 300;