1:38 p.m.
Hey gang,
I was talking to Mike McGrath the other day on IRC and inquired about
the projects use of an IDS. Mike mentioned that project currently
employs only hosts.deny type stuff. I recently setup aide for use on a
personal server but it looked flexible enough for use in a more robust
type environment. The idea behind this write up is to see what others
think about employing something like this to give an idea of what aide
in particular is capable of.
The Name: AIDE (Advanced Intrusion Detection Environment)
What it Does: Constructs a database of files as specified in the
configuration file (aide.conf). The database stores file attributes
including permissions, inode number, user, group, file size, mtime,
ctime, atime, growing size, number of links and link name. Based on
options specified at compile time, acl, xattr and selinux attributes can
be stored as well. When initialized and when checks are run, aide
creates a crypto checksum/hash of each file watched using any number of
algorithms (e.g. sha1, sha256, etc.).
The Config File: This is where the directories/files to be watched (and
what in particular is watched on the files) and the directories/files to
be excluded, reporting options (default goes to /var/log/aide/aide.log)
Misc. Notes:
* Postgres can be used to store databases
* For usage in multiple machine environments, the database can be stored
in a central location and aide ran with --compare to limit resource
hogging.
* The database and config file can be signed, this makes it so that if a
change is manually made to either file, aide will refuse to use it, as
the signature will have been voided.
* Aide can be run with --update which will create a new database,
however it doesn't take effect until manually copied to the check
database. This allows updates to be frequently tracked but not put into
the check database.
The main weakness I noted was in the reporting capabilities. According
to the config file notes, reporting can be done via stdout, stdin,
stderr, file://, fd: (file descriptor).
I only have the one machine and it runs a pretty vanilla config as I
don't do anything too fancy with it. With the config I have it seems to
work as advertised. So there it is, thoughts?
Regards,
Jason
1:40 p.m.
On Wed, 02 Jan 2008 14:38:45 -0500
Jason <jmtaylor90(a)gmail.com> wrote:
I only have the one machine and it runs a pretty vanilla config as I
don't do anything too fancy with it. With the config I have it seems
to work as advertised. So there it is, thoughts?
Has it actually detected any intrusions?
--
Jesse Keating
Fedora -- All my bits are free, are yours?
2:11 p.m.
Hey Jason, just a couple of ideas that may help you improve your proposal...
On Jan 2, 2008 11:38 AM, Jason <jmtaylor90(a)gmail.com> wrote:
What it Does: Constructs a database of files as specified in the
configuration file (aide.conf). The database stores file attributes
including permissions, inode number, user, group, file size, mtime,
ctime, atime, growing size, number of links and link name. Based on
options specified at compile time, acl, xattr and selinux attributes can
be stored as well. When initialized and when checks are run, aide
creates a crypto checksum/hash of each file watched using any number of
algorithms (e.g. sha1, sha256, etc.).
Not that this type of functionality isn't a good part of intrusion
detection, but I think these days intrusion detection really has to
focus on more than just watching for changes on files... In addition,
RPM already has a database that checks for all these things and knows
how to do verification. A quick & dirty solution for file integrity
checking could be to just run rpm -Va every night, and then keep good
records of the rpm database md5sum and any package
installations/upgrades/removals.
I think in the Fedora environment, intrusion detection might mean also
being able to detect that host X has repeatedly tried to login to
these three machines and failed, or that Mike McGrath has logged in
from a domain or IP range that he has never connected from before, or
that the resource utilization of a particular service has changed
drastically in the past few days because someone set up a warez site
on the Fedora boxes, or that there's a lot of traffic going over
network ports that we didn't know were supposed to have traffic on
them... And so on and so forth. None of this stuff is covered by file
integrity checking (which is still an important thing).
The main weakness I noted was in the reporting capabilities.
According
to the config file notes, reporting can be done via stdout, stdin,
stderr, file://, fd: (file descriptor).
Sounds like AIDE already does some postgres stuff - it might be fairly
easy to have it dump more info into the DB so that one can create a
simple web reporting interface using standard tools.
I remember a long time ago when I had Tripwire installed on a system,
the biggest problem was that it generated a lot of false positives. A
file integrity checker is only good if it generates useful low-noise
results, so this makes intelligent reporting tools very important.
Best,
-- Elliot
2:32 p.m.
On Wed, 2008-01-02 at 12:11 -0800, Elliot Lee wrote:
Hey Jason, just a couple of ideas that may help you improve your
proposal...
On Jan 2, 2008 11:38 AM, Jason <jmtaylor90(a)gmail.com> wrote:
<snip>
Not that this type of functionality isn't a good part of intrusion
detection, but I think these days intrusion detection really has to
focus on more than just watching for changes on files... In addition,
RPM already has a database that checks for all these things and knows
how to do verification. A quick & dirty solution for file integrity
checking could be to just run rpm -Va every night, and then keep good
records of the rpm database md5sum and any package
installations/upgrades/removals.
I think in the Fedora environment, intrusion detection might mean also
being able to detect that host X has repeatedly tried to login to
these three machines and failed, or that Mike McGrath has logged in
from a domain or IP range that he has never connected from before, or
that the resource utilization of a particular service has changed
drastically in the past few days because someone set up a warez site
on the Fedora boxes, or that there's a lot of traffic going over
network ports that we didn't know were supposed to have traffic on
them... And so on and so forth. None of this stuff is covered by file
integrity checking (which is still an important thing).
Correct, there is more to intrusion detection than just keeping an eye
on file changes. Like you mentioned, looking at logs for repeated login
attempts (e.g. brute force nonsense), malformed requests to HTTP
services, traffic analysis/benchmarking, keeping installed applications
to required apps only, and then properly configuring those apps, keeping
up to date with security patches, etc. I just wanted to throw this out
there to see if folks thought it was something worth adding to the
toolbox or we are good as is. :D
> The main weakness I noted was in the reporting capabilities.
According
> to the config file notes, reporting can be done via stdout, stdin,
> stderr, file://, fd: (file descriptor).
Sounds like AIDE already does some postgres stuff - it might be fairly
easy to have it dump more info into the DB so that one can create a
simple web reporting interface using standard tools.
I remember a long time ago when I had Tripwire installed on a system,
the biggest problem was that it generated a lot of false positives. A
file integrity checker is only good if it generates useful low-noise
results, so this makes intelligent reporting tools very important.
Indeed, lest we fall into the GIGO trap :D
Best,
-- Elliot
-Jason
6:02 a.m.
HI All,
I sit on this list looking for tips n tricks, but thought I would
comment on this thread.
I personally use Osiris for monitoring about 100 hosts.
http://osiris.shmoo.com/handbook.html#part1_chap1
It does file system integrity checks but also reports on open/closed
ports & user account changes.
I receive daily emails reporting only the changes from each host.
The scan rules can be easily tweaked using regexs to filter out cruft
resulting in a very low noise system.
It helps immensely with detection of machines that have been compromised.
--
Paul De Audney
5976
days inactive
5980
days old
infrastructure@lists.fedoraproject.org
4 comments
4 participants
participants (4)
-
Elliot Lee -
Jason -
Jesse Keating -
Paul DeAudney