Configuration

Every setting is in /etc/drra/drra.ini. The agent reads it again before every report, so changes need no restart; systemctl reload drra starts the next report now.

The settings file

A setting left out uses its default. drra config prints the settings in use. The file is root only (mode 0600) because it can hold the enrollment token.

[delivery]

Setting	Default	What it does
`methods`	https	One or more of `https`, `cifs`, `scp`, separated by commas. Every listed method runs each cycle.

[https]

Setting	Default	What it does
`host`	reports.example.com	Report server
`port`	443	443 for HTTPS, 80 for HTTP
`upload_path`	/linux/upload/upload.php	Upload page
`register_path`	/linux/upload/register.php	Registration page
`hook_path`	empty	Hook upload page; empty uses `hook.php` next to `upload_path`
`enrollment_token`	empty	The `enrollment_token` from `server.ini`; empty to have an admin approve the host
`use_https`	1	0 = plain HTTP, only for a test server
`verify_peer`	1	Check the server certificate and host name. 0 only for a test server; use `ca_file` for a private CA.
`ca_file`	empty	CA bundle (PEM) for a private CA; empty uses the system trust store
`timeout_seconds`	60	Seconds before an upload is given up

[cifs]

Copies the report to a Windows (SMB/CIFS) file share with smbclient (package samba-client).

Setting	Default	What it does
`share`	empty	Share, for example `//fileserver/reports`
`directory`	empty	Folder inside the share
`credentials_file`	/etc/drra/cifs_credentials	Share login in `smbclient -A` format (`username =`, `password =`, `domain =`), mode 0600; empty for a guest share
`smbclient_path`	/usr/bin/smbclient
`timeout_seconds`	120

[scp]

Setting	Default	What it does
`host, port, user`	empty, 22, empty	SSH server and account that receive the report
`key_file`	/etc/drra/id_ed25519	Private key with no passphrase, mode 0600
`remote_dir`	empty	Folder on the server, for example the report server's `reports_dir`
`known_hosts_file`	/var/lib/drra/known_hosts	Host key of the server
`strict_host_key_checking`	yes	`yes` (only a key already in known_hosts) or `accept-new` (save it on the first connection)
`scp_path`	/usr/bin/scp
`timeout_seconds`	120	Seconds before a hung transfer is stopped

[agent]

Setting	Default	What it does
`report_interval_minutes`	15	Minutes between reports. 15 matches the DRSM check interval.
`cpu_sample_seconds`	5	Seconds the CPU use is sampled for
`report_dir`	/var/lib/drra	Where the report is written before it is sent
`log_file`	/var/log/drra/drra.log	Log of every report and upload
`data_dir`	/var/lib/drra	Agent key, certificate, registration and scan results
`check_updates`	1	List pending package updates (from the dnf metadata cache)
`updates_refresh_hours`	24	Hours between `dnf makecache` runs; 0 leaves it to `dnf-makecache.timer`
`command_timeout_seconds`	300	Seconds before a command the agent runs (rpm, dnf, systemctl) is stopped

[scan]

See Vulnerability scans for how the sources work.

Setting	Default	What it does
`enabled`	0	1 turns the vulnerability scan on
`interval_hours`	24	Hours between scans
`source`	auto	`auto`, `oval`, `csaf` or `dnf`
`oval_feed_url`	empty	OVAL feed (https URL or local file, .xml or .xml.bz2); empty picks Red Hat's feed for the release
`csaf_index_url`	empty	CSAF/VEX index (https URL or local file, `{major}` is replaced with the release); empty uses `vex_index.php` next to `upload_path`
`unfixed_list_severity`	Important	CVEs with no fix yet are counted, and listed at or above this severity (Critical, Important, Moderate, Low or none)
`oscap_path`	/usr/bin/oscap
`upload_html`	1	Send the OpenSCAP HTML reports to the server
`compliance_profile`	empty	SCAP Security Guide profile for a compliance scan, for example `cis_server_l1` or `stig`; empty = none
`compliance_datastream`	empty	SCAP data stream; empty picks `ssg-rhel<release>-ds.xml`
`timeout_minutes`	60	Minutes before a scan is stopped

[hooks] and [uploads]

Setting	Default	What it does
`[hooks] enabled`	1	Run the report hooks
`[hooks] dir`	/etc/drra/report.d	Folder of hook programs
`[hooks] timeout_seconds`	60	Seconds before a hook is stopped
`[hooks] max_output_kb`	256	Output kept from each hook
`[hooks] user`	empty	Run the hooks as this user instead of root (then set `dir` to a folder that user can reach)
`[uploads] enabled`	1	Send hook uploads
`[uploads] dir`	/etc/drra/uploads.d	Upload hook files (`<id>.ini`)
`[uploads] spool_dir`	/var/spool/drra/uploads	Files waiting to be sent, one folder per hook
`[uploads] max_bytes`	20000000	Largest file an upload hook may send

See Hooks.