Security Plugin: Operations

Bacula Enterprise Only

This solution is only available for Bacula Enterprise. For subscription inquiries, please reach out to sales@baculasystems.com.

Forcing a New Check

It is possible to force a new check by deleting the file /opt/bacula/working/security.ts.

Hook Protocol Definition

Security hooks can be written in any language. Some environment variables are passed to all hooks.

Environment variables
Option	Default	Description
BACULA_WORKINGDIR BACULA_SYSCONFDIR BACULA_BINDIR	/opt/bacula/working /opt/bacula/etc /opt/bacula/bin	Bacula Working directory Bacula Configuration directory Bacula Binary directory

The output provided by the hook is a JSON object with the following information:

   {
   "source": "chkrootkit",
   "version": "0.52",
   "error": 1,
   "events": [
       {
        "level": 'f',
        "message": "INFECTED: Possible Malicious Linux.Xor.DDoS installed"
       },
       {
        "level": 'f',
        "message": "INFECTED: Possible Malicious Linux.XXX installed"
       }
   ]
},

JSON fields
Option	Description
source \| (String) Name of the hook version \| (String) Version of the hook program error \| (Int) different from zero to raise an error events \| (Array) list of different events

All events have the following information:

JSON Events fields
Option	Description
level message	(char) Status of the test (f: fatal, T: ok, W: warning) (String) Error to be displayed. (contains simple characters)