;
;
; Blue Malware Detection Module Dependency File
;
;

;
; Wich modules this module depends on
;

;
; Core settings
;
[core]
; do not check files over scan_max_file_size bytes
;scan_max_file_size = 786432 ; 768 KB 1048576 ; 1 MB
; scan process CPU scheduling priority
;scan_cpunice = 19
; scan process IO scheduling priority
;scan_ionice = 6
; move malicious file to quarantine; enabled|disabled
;This option will enable or disable both the cleaning, and quarantining of malicious files.
;quarantine = 'enabled'
; replace malware to honeypot; enabled|disabled
;honeypotify = 'disabled'
; if replace is enabled, this file will be copied insted of malware
;honeypot_file = '/opt/bitninja/modules/SenseWebHoneypot/examples/example_honeypot_file.php'
; memory limit in MB
;memory_limit = 600
; Change where to store quarantined files
;quarantine_directory= '/var/lib/bitninja/quarantine'
; Enable malware source upload to Cloud.
; This feature helps you with the malware validation process.
; Uploaded source files only visable for the server owner.
;upload_malware_source=0
; How many scans can be run at once
;maxConcurrentScans=10
; If the value is 0, than the phase 2 will be not executed
;enable_deep_scan = 1
; The higher this value is, the less resources scans will consume (while also being slower).
; Ranges from 0 to 1
;scan_niceness = 0.002
; Enable/Disable active scan - Disable = 0, Enable = 1, default value 1
;enable_active_scan = 1
;enable_ai_scan = 1
;full_scan_paths[] = '/home'
;full_scan_paths[] = '/var/www'
;full_scan_paths[] = '/tmp'

[analyzer]
; Number of maximum amount of files pulled from the filesystem at once during analysis
; If it is set to 0 then it will be calculated based on the file_path_pull_limit.
;analyzer_pull_count = 0
; This config option disables the automatic extended analysis
; 0 is disabled, 1 is enabled.
;automatic_extended_analysis = 1

;
; File whitelist settings
;
; Note: Do not scan these files even, if the file marked as scanable by someone.
;
[whitelist]
; do not scan files match these extensions
;extensions[] =
; do not scan files match these path definition expressions
; Glob pattern can be used Eg.: '/home*/virtfs'
;
;paths[] = '/var/lib/bitninja'
;paths[] = '/var/log/bitninja'
;paths[] = '/var/cache/awstats'
;paths[] = '/opt/bitninja'
;paths[] = '/bin'
;paths[] = '/sbin'
;paths[] = '/lib'
;paths[] = '/lib32'
;paths[] = '/usr/bin'
;paths[] = '/usr/sbin'
;paths[] = '/usr/lib'
;paths[] = '/usr/lib32'
;paths[] = '/home*/accesslog/*'
;paths[] = '/home*/virtfs/*'
;paths[] = '/home*/cagefs-skeleton/*'
;paths[] = '/usr/share/cagefs-skeleton'
;paths[] = '/home*/cpeasyapache/src/*'
;paths[] = '/proc'
;paths[] = '/dev'
;paths[] = '/sys'
; do not scan files match these types based on file command
;types[] =

;
; Inotify settings
;
[inotify]
; ignore files match these path definition expresssions ; e.g: .log
; Glob and regex pattern can be used as a value
;exclude[] = '^/var/tmp/mysql.sock$'
;exclude[] = '^/tmp/mysql.sock$'
;exclude[] = '^/var/cache/buagent/md0.cache.data$'
;exclude[] = '^/var/tmp/#sql_.*\.MYD$'
;exclude[] = '^/tmp/#sql_.*\.MYD$'
;exclude[] = '^/tmp/#sql_.*\.MYI$'
;exclude[] = '^/tmp/#sql_.*\.MAD$'
;exclude[] = '^/tmp/#sql_.*\.MAI$'
;exclude[] = '^/tmp/lshttpd/*\.sock*'
;exclude[] = '^/tmp/lshttpd/\.rtreport\.*'
;exclude[] = '^/var/tmp/clamav-.*'
;exclude[] = '^/tmp/clamav-.*'
;exclude[] = '^/var/lib/bitninja'
;exclude[] = '^/var/log/bitninja'
;exclude[] = '^/var/cache/awstats'
;exclude[] = '^/usr/local/maldetect/quarantine'
;exclude[] = '\.sock$'
;exclude[] = '\.log$'
;exclude[] = '^.*_log$'
;exclude[] = '^.*_log\.processed$'
;exclude[] = '^.*_ssl_log\.webstat$'
;exclude[] = '^/home\d+/accesslog'
;exclude[] = '^/home\d+/virtfs'
;exclude[] = '^/home\d+/cagefs-skeleton/'
;exclude[] = '^/usr/share/cagefs-skeleton/'
;exclude[] = '\.sock$'
;exclude[] = '^/home\d+/.*?/mail/'
;exclude[] = '^/home\d+/cpeasyapache/src/'

; inotify monitoring array
; this is where you can define what to be monitored by the MalwareDetection module
; Glob pattern can be used as a value eg.: /home*/
;
;file_path[] = '/tmp'
;file_path[] = '/home*/'
;file_path[] = '/var/www'
[FileSystemMonitor]
;monitor_type = 'inotify'
;monitor_type = 'auditd'
;monitor_order[] = 'inotify'
;monitor_order[] = 'auditd'
;monitor_order[] = 'nullMonitor'

[Detectors]
; disabled[]='Md5WhiteGlobal'
; disabled[]='Md5WhiteUserOld'
; disabled[]='Md5BlackUser'
; disabled[]='Md5BlackGlobal'
; disabled[]='Hex'
; disabled[]='CronInjector'
; disabled[]='CronInjectorV2'
; disabled[]='FirstLine'
; disabled[]='FirstLineV2'
; disabled[]='HexaBotnet'
; disabled[]='WPVCD'
; disabled[]='SAWhiteGlobal'
; disabled[]='SABlackUser'
; disabled[]='SABlackGlobal'
; disabled[]='SASnippetUser'
; disabled[]='SASnippetGlobal'

[quick_cache]
;l1_chunks = 30
;l1_chunk_size = 400
;l1_to_l2_threshold = 3

[database]
;database_cache = 1
;build_php_structure_data = 1
; The maximum size of the filesystem cache, in megabytes. Default: 0, which means the cache size is not limited.
;filesystem_cache_size_limit = 0
; What to do if the size of the filesystem cache exceeds the limit. Possible values: 'readonly', 'delete'
;filesystem_cache_threshold_behavior = 'readonly'