<?xml version="1.0" encoding='UTF-8'?>
<Rules>
    <PosixFileRule id="ID0" oid="-1y2p0ij32e84y:-1y2p0ij2m8va8" class="rule" name="UCD-basic-linux-v1.0">
        <Description>UCB basic ruleset for linux v1.0.

Redhat/Fedora basis but applies to
many Linux distributions.</Description>
        <Severity>100</Severity>
        <Actions />
        <StartPoints>
            <Start>
                <Target>/etc/xinetd.conf</Target>
                <Severity>10000</Severity>
                <RecurseLevel>0</RecurseLevel>
                <StoreContent>false</StoreContent>
                <Filters>
                    <Filter>
                        <TypeId>1</TypeId>
                    </Filter>
                </Filters>
                <Criteria>ID1</Criteria>
            </Start>
            <Start>
                <Target>/bin/login</Target>
                <Severity>10000</Severity>
                <RecurseLevel>0</RecurseLevel>
                <StoreContent>false</StoreContent>
                <Filters>
                    <Filter>
                        <TypeId>1</TypeId>
                    </Filter>
                </Filters>
                <Criteria>ID1</Criteria>
            </Start>
            <Start>
                <Target>/etc/xinetd.d</Target>
                <Severity>10000</Severity>
                <RecurseLevel>2</RecurseLevel>
                <StoreContent>false</StoreContent>
                <Filters>
                    <Filter>
                        <TypeId>1</TypeId>
                    </Filter>
                </Filters>
                <Criteria>ID1</Criteria>
            </Start>
            <Start>
                <Target>/etc/inittab</Target>
                <Severity>10000</Severity>
                <RecurseLevel>0</RecurseLevel>
                <StoreContent>false</StoreContent>
                <Filters>
                    <Filter>
                        <TypeId>1</TypeId>
                    </Filter>
                </Filters>
                <Criteria>ID1</Criteria>
            </Start>
            <Start>
                <Target>/etc/mail/sendmail.cf</Target>
                <Severity>10000</Severity>
                <RecurseLevel>0</RecurseLevel>
                <StoreContent>false</StoreContent>
                <Filters>
                    <Filter>
                        <TypeId>1</TypeId>
                    </Filter>
                </Filters>
                <Criteria>ID1</Criteria>
            </Start>
            <Start>
                <Target>/etc/passwd</Target>
                <Severity>10000</Severity>
                <RecurseLevel>0</RecurseLevel>
                <StoreContent>false</StoreContent>
                <Filters>
                    <Filter>
                        <TypeId>1</TypeId>
                    </Filter>
                </Filters>
                <Criteria>ID1</Criteria>
            </Start>
            <Start>
                <Target>/etc/shadow</Target>
                <Severity>10000</Severity>
                <RecurseLevel>0</RecurseLevel>
                <StoreContent>false</StoreContent>
                <Filters>
                    <Filter>
                        <TypeId>1</TypeId>
                    </Filter>
                </Filters>
                <Criteria>ID1</Criteria>
            </Start>
            <Start>
                <Target>/etc/shells</Target>
                <Severity>10000</Severity>
                <RecurseLevel>0</RecurseLevel>
                <StoreContent>false</StoreContent>
                <Filters>
                    <Filter>
                        <TypeId>1</TypeId>
                    </Filter>
                </Filters>
                <Criteria>ID1</Criteria>
            </Start>
            <Start>
                <Target>/etc/fstab</Target>
                <Severity>10000</Severity>
                <RecurseLevel>0</RecurseLevel>
                <StoreContent>false</StoreContent>
                <Filters>
                    <Filter>
                        <TypeId>1</TypeId>
                    </Filter>
                </Filters>
                <Criteria>ID1</Criteria>
            </Start>
            <Start>
                <Target>/sbin</Target>
                <Severity>10000</Severity>
                <RecurseLevel>50</RecurseLevel>
                <StoreContent>false</StoreContent>
                <Filters>
                    <Filter>
                        <TypeId>1</TypeId>
                    </Filter>
                </Filters>
                <Criteria>ID1</Criteria>
            </Start>
            <Start>
                <Target>/usr/bin</Target>
                <Severity>10000</Severity>
                <RecurseLevel>50</RecurseLevel>
                <StoreContent>false</StoreContent>
                <Filters>
                    <Filter>
                        <TypeId>1</TypeId>
                    </Filter>
                </Filters>
                <Criteria>ID1</Criteria>
            </Start>
            <Start>
                <Target>/usr/lib</Target>
                <Severity>10000</Severity>
                <RecurseLevel>50</RecurseLevel>
                <StoreContent>false</StoreContent>
                <Filters>
                    <Filter>
                        <TypeId>1</TypeId>
                    </Filter>
                </Filters>
                <Criteria>ID1</Criteria>
            </Start>
            <Start>
                <Target>/usr/sbin</Target>
                <Severity>10000</Severity>
                <RecurseLevel>50</RecurseLevel>
                <StoreContent>false</StoreContent>
                <Filters>
                    <Filter>
                        <TypeId>1</TypeId>
                    </Filter>
                </Filters>
                <Criteria>ID1</Criteria>
            </Start>
            <Start>
                <Target>/var/log</Target>
                <Severity>10000</Severity>
                <RecurseLevel>10</RecurseLevel>
                <StoreContent>false</StoreContent>
                <Filters>
                    <Filter>
                        <TypeId>1</TypeId>
                    </Filter>
                </Filters>
                <Criteria>ID2</Criteria>
            </Start>
            <Start>
                <Target>/var/spool/cron/root</Target>
                <Severity>10000</Severity>
                <RecurseLevel>0</RecurseLevel>
                <StoreContent>false</StoreContent>
                <Filters>
                    <Filter>
                        <TypeId>1</TypeId>
                    </Filter>
                </Filters>
                <Criteria>ID1</Criteria>
            </Start>
            <Start>
                <Target>/etc/sysconfig/iptables</Target>
                <Severity>10000</Severity>
                <RecurseLevel>0</RecurseLevel>
                <StoreContent>false</StoreContent>
                <Filters>
                    <Filter>
                        <TypeId>1</TypeId>
                    </Filter>
                </Filters>
                <Criteria>ID1</Criteria>
            </Start>
        </StartPoints>
        <StopPoints>
            <Stop>
                <Target>/usr/lib/powerchute</Target>
                <StopRecursion>true</StopRecursion>
            </Stop>
        </StopPoints>
        <Traverse>true</Traverse>
    </PosixFileRule>
    <Criteria id="ID1" oid="-1y2p0ij32e85e:-1y2p0ij32e7zk" class="Criteria" name="$(FILE_STATIC) -im" Genre="com.tripwire.si.core.fs.posix.PosixFileSystemRule">
        <Description>TFS - pugsMA</Description>
        <Attributes>
            <ElementType>2</ElementType>
            <Attribute>ACL</Attribute>
            <Attribute>Permissions</Attribute>
            <Attribute>User</Attribute>
            <Attribute>Group</Attribute>
        </Attributes>
        <Attributes>
            <ElementType>1</ElementType>
            <Attribute>ACL</Attribute>
            <Attribute>Permissions</Attribute>
            <Attribute>Size</Attribute>
            <Attribute>User</Attribute>
            <Attribute>MD5</Attribute>
            <Attribute>Group</Attribute>
        </Attributes>
    </Criteria>
    <Criteria id="ID2" oid="-1y2p0ij32e85e:-1y2p0ij32e7zj" class="Criteria" name="$(FILE_DYNAMIC) -id" Genre="com.tripwire.si.core.fs.posix.PosixFileSystemRule">
        <Description>TFS - pugA</Description>
        <Attributes>
            <ElementType>2</ElementType>
            <Attribute>ACL</Attribute>
            <Attribute>Permissions</Attribute>
            <Attribute>User</Attribute>
            <Attribute>Group</Attribute>
        </Attributes>
        <Attributes>
            <ElementType>1</ElementType>
            <Attribute>ACL</Attribute>
            <Attribute>Permissions</Attribute>
            <Attribute>User</Attribute>
            <Attribute>Group</Attribute>
        </Attributes>
    </Criteria>
</Rules>