128.223.202.180: Redirecting to Service:Samhain

2006-08-02T01:42:22Z

128.223.202.180: /* Installation */

2006-08-01T18:07:33Z

Installation

← Older revision		Revision as of 18:07, 1 August 2006
Line 98:		Line 98:
	make		make
	</pre>		</pre>
	{\|		{\| border="1" cellspacing="0" cellpadding="5" align="center"
	\|<pre>--enable-micro-stealth=177</pre>		\|<pre>--enable-micro-stealth=177</pre>
	\|XORs all strings in the binary and log file by 177.		\|XORs all strings in the binary and log file by 177.

128.223.202.180: /* Installation */

2006-08-01T18:05:49Z

Installation

← Older revision		Revision as of 18:05, 1 August 2006
Line 99:		Line 99:
	</pre>		</pre>
	{\|		{\|
	\| --enable-micro-stealth=177		\|<pre>--enable-micro-stealth=177</pre>
	\|XORs all strings in the binary and log file by 177.		\|XORs all strings in the binary and log file by 177.
	\|-		\|-
	\| --enable-static		\|<pre>--enable-static</pre>
	\|Statically binds all libraries at compile time		\|Statically binds all libraries at compile time
	\|-		\|-
	\| --enable-install-name=nicmon		\|<pre>--enable-install-name=nicmon</pre>
	\|Installs all samhain files with "samhain" replaced by "nicmon".		\|Installs all samhain files with "samhain" replaced by "nicmon".
	\|-		\|-
	\| --with-gpg=/usr/bin/gpg		\|<pre>--with-gpg=/usr/bin/gpg</pre>
	\|Compiles the location of gpg into the binary.		\|Compiles the location of gpg into the binary.
	\|-		\|-
	\| --with-checksum		\|<pre>--with-checksum</pre>
	\|Compiles the checksum of the gpg binary into the samhain binary.		\|Compiles the checksum of the gpg binary into the samhain binary.
	\|-		\|-
	\| --with-fp=<fingerprint>\|		\|<pre>--with-fp=<fingerprint></pre>
	\|Includes the fingerprint of the gpg key used to sign the config file and checksum database in the binary.		\|Includes the fingerprint of the gpg key used to sign the config file and checksum database in the binary.
	\|-		\|-
	\| --enable-base=1353031580,1621368721		\|<pre>--enable-base=1353031580,1621368721</pre>
	\|All messages send by samhain include this base.		\|All messages send by samhain include this base.
	\|}		\|}

128.223.202.180 at 18:04, 1 August 2006

2006-08-01T18:04:23Z

← Older revision		Revision as of 18:04, 1 August 2006
Line 98:		Line 98:
	make		make
	</pre>		</pre>
			{\|
	~~{{{~~--enable-micro-stealth=177~~}}}~~ XORs all strings in the binary and log file by 177.~~[[BR]]~~		\| --enable-micro-stealth=177
	~~{{{~~--enable-static~~}}}~~ Statically binds all libraries at compile time~~.[[BR]]~~		\|XORs all strings in the binary and log file by 177.
	~~{{{~~--enable-install-name=nicmon~~}}}~~ Installs all samhain files with "samhain" replaced by "nicmon".~~[[BR]]~~		\|-
	~~{{{~~--with-gpg=/usr/bin/gpg~~}}}~~ Compiles the location of gpg into the binary.~~[[BR]]~~		\| --enable-static
	~~{{{~~--with-checksum~~}}}~~ Compiles the checksum of the gpg binary into the samhain binary.~~[[BR]]~~		\|Statically binds all libraries at compile time
	~~{{{~~--with-fp=<fingerprint>~~}}}~~ Includes the fingerprint of the gpg key used to sign the config file and checksum database in the binary.~~[[BR]]~~		\|-
	~~{{{~~--enable-base=1353031580,1621368721~~}}}~~ All messages send by samhain include this base.~~[[BR]]~~		\| --enable-install-name=nicmon
			\|Installs all samhain files with "samhain" replaced by "nicmon".
			\|-
			\| --with-gpg=/usr/bin/gpg
			\|Compiles the location of gpg into the binary.
			\|-
			\| --with-checksum
			\|Compiles the checksum of the gpg binary into the samhain binary.
			\|-
			\| --with-fp=<fingerprint>\|
			\|Includes the fingerprint of the gpg key used to sign the config file and checksum database in the binary.
			\|-
			\| --enable-base=1353031580,1621368721
			\|All messages send by samhain include this base.
			\|}

	<pre>		<pre>

128.223.202.180 at 18:01, 1 August 2006

2006-08-01T18:01:21Z

← Older revision		Revision as of 18:01, 1 August 2006
Line 77:		Line 77:
	</pre>		</pre>

	Use fingerprint above in the configure command line below. ~~{{{~~--with-fp=<fingerprint>~~}}}~~		Use fingerprint above in the configure command line below.
			<pre> --with-fp=<fingerprint></pre>

	<pre>		<pre>

128.223.202.180 at 18:00, 1 August 2006

2006-08-01T18:00:18Z

Show changes

128.223.202.180 at 17:48, 1 August 2006

2006-08-01T17:48:59Z

New page

[[TableOfContents]]

= Introduction =

== Purpose ==

Host based intrusion detection systems(IDS) allow tracking of critical systems files, making unauthorized changes obvious.

== Justification ==

Samhain is the most featureful open source IDS currently under development.

= Setup =

== Installation ==

Generate gpg key used in signing config file and checksum database.
{{{
gpg --gen-key
gpg (GnuPG) 1.2.4; Copyright (C) 2003 Free Software Foundation, Inc.
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions. See the file COPYING for details.

Please select what kind of key you want:
(1) DSA and ElGamal (default)
(2) DSA (sign only)
(4) RSA (sign only)
Your selection? 1
DSA keypair will have 1024 bits.
About to generate a new ELG-E keypair.
minimum keysize is 768 bits
default keysize is 1024 bits
highest suggested keysize is 2048 bits
What keysize do you want? (1024) 2048
Requested keysize is 2048 bits
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct (y/n)? y

You need a User-ID to identify your key; the software constructs the user id
from Real Name, Comment and Email Address in this form:
"Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"

Real name: Neuroinformatics Center
Email address: systems@nic.uoregon.edu
Comment: NIC
You selected this USER-ID:
"Neuroinformatics Center (NIC) <systems@nic.uoregon.edu>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
You need a Passphrase to protect your secret key.

gpg: gpg-agent is not available in this session
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
+++++.+++++...+++++.+++++++++++++++++++++++++++++++++++++++++++++.+++++++++++++++.+++++.+++++.+++++.++++++++++.++++++++++.+++++..+++++..++++++++++>+++++.+++++.....................>.+++++.+++++
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
+++++.+++++.++++++++++++++++++++++++++++++.+++++++++++++++..++++++++++.++++++++++++++++++++++++++++++..++++++++++.+++++..++++++++++.++++++++++++++++++++..+++++>+++++.+++++>+++++>+++++...............>+++++......................+++++^^^^^^^^^
public and secret key created and signed.
key marked as ultimately trusted.

pub 1024D/0E52D35E 2005-07-05 Neuroinformatics Center (NIC) <systems@nic.uoregon.edu>
Key fingerprint = 9813 EDAA 19BF CAC5 4697 CC17 1DD9 AA76 0E52 D35E
sub 2048g/077454E4 2005-07-05
}}}

Use fingerprint above in the configure command line below. {{{--with-fp=<fingerprint>}}}

{{{
mkdir source
cd source
}}}

Download newest version of Samhain from http://la-samhna.de/samhain/.

{{{
tar -zxvf samhain-<version>.tar.gz
cd samhain-<version>
}}}

Need the next two steps because TIGER192 checksum support isn't compiled in gpg by default so we have to use samhain itself.

{{{
./configure
make
}}}

{{{--enable-micro-stealth=177}}} XORs all strings in the binary and log file by 177.[[BR]]
{{{--enable-static}}} Statically binds all libraries at compile time.[[BR]]
{{{--enable-install-name=nicmon}}} Installs all samhain files with "samhain" replaced by "nicmon".[[BR]]
{{{--with-gpg=/usr/bin/gpg}}} Compiles the location of gpg into the binary.[[BR]]
{{{--with-checksum}}} Compiles the checksum of the gpg binary into the samhain binary.[[BR]]
{{{--with-fp=<fingerprint>}}} Includes the fingerprint of the gpg key used to sign the config file and checksum database in the binary.[[BR]]
{{{--enable-base=1353031580,1621368721}}} All messages send by samhain include this base.[[BR]]

{{{
./configure --enable-micro-stealth=177 --enable-static \
--enable-install-name=nicmon --with-gpg=/usr/bin/gpg \
--with-checksum \
--with-fp="<fingerprint from output of gpg --gen-key>" \
--enable-base=1353031580,1621368721
make
mv samhainrc.linux samhainrc.linux.stock
scp root@neuronic.nic.uoregon.edu:/etc/nicmonrc ./samhainrc.linux
}}}

Edit samhainrc.linux and remove gpg header and footer in preparation for signing.

{{{
make install
make install-boot
rm /usr/local/man/man8/nicmon.8
rm /usr/local/man/man5/nicmonrc.5
/usr/local/sbin/nicmon -t init
gpg -a --clearsign --not-dash-escaped /var/lib/nicmon/nicmon_file
mv /var/lib/nicmon/nicmon_file.asc /var/lib/nicmon/nicmon_file
/usr/local/sbin/nicmon -t check
}}}

== Configuration ==

Samhainrc setup. See comments in rc file for explanation of settings.

{{{
[Misc]

[Attributes]
file=/etc/mtab
file=/etc/resolv.conf
file=/etc/localtime
file=/etc/ioctl.save
file=/etc

[LogFiles]
file=/var/run/utmp
file=/etc/motd

[GrowingLogFiles]
file=/var/log/messages
file=/var/log/wtmp

[IgnoreAll]

[IgnoreNone]

[Prelink]

[ReadOnly]
dir=/usr/bin
dir=/usr/local/bin
dir=/bin
dir=/boot
dir=3/sbin
dir=/usr/sbin
dir=2/lib
dir=2/usr/lib
dir=2/usr/local/lib
dir=3/etc
dir=/usr/X11R6/bin

[User0]
[User1]

[EventSeverity]
SeverityIgnoreAll=info

[Log]
MailSeverity=crit
LogSeverity=mark

[Misc]
Daemon = yes
ChecksumTest=check
UseCaps = yes
SetLoopTime = 60
SetFileCheckTime = 600
SetMailTime = 60
SetMailNum = 100
SetMailAddress=systems@nic.uoregon.edu
SetPrelinkPath = /usr/local/sbin/nicmon
SyslogFacility=LOG_LOCAL2

[EOF]
}}}

= Maintenance =

== Start ==

{{{
/etc/init.d/nicmon start
}}}

or

{{{
/usr/local/sbin/nicmon -t check
}}}

== Stop ==

{{{
/etc/init.d/nicmon stop
}}}

or

{{{
ps auxw|grep nicmon
kill <pid>
}}}

or

{{{
killall nicmon
}}}

== Update Database ==

Stop samhain.

{{{
rm /var/lib/nicmon/nicmon_file
/usr/local/sbin/nicmon -t init
gpg -a --clearsign --not-dash-escaped /var/lib/nicmon/nicmon_file
mv /var/lib/nicmon/nicmon_file.asc /var/lib/nicmon/nicmon_file
}}}

Start samhain.

== Update Configuration File ==

Stop samhain.

Remove gpg header and footer from /etc/nicmonrc.

Modify /etc/nicmonrc.

Re-sign /etc/nicmonrc.

{{{
gpg -a --clearsign --not-dash-escaped /etc/nicmonrc
mv /etc/nicmonrc.asc /etc/nicmonrc
}}}

Remove and recreate file database.

{{{
rm /var/lib/nicmon/nicmon_file
/usr/local/sbin/nicmon -t init
gpg -a --clearsign --not-dash-escaped /var/lib/nicmon/nicmon_file
mv /var/lib/nicmon/nicmon_file.asc /var/lib/nicmon/nicmon_file
}}}

Start samhain.

== Debugging ==

To debug a problem, run samhain using the following option. It will print all messages with ''info'' or greater priority to standard out.

{{{
/usr/local/sbin/nicmon -t <init or check> -p info
}}}

== Log Files ==

View log using

{{{
/usr/local/sbin/nicmon -jL /var/log/nicmon_log
}}}

== Rehashing the checksum database ==

Here's a useful script to rebuild the samhain checksum database.

Samhain's "growing log files" policy will verify selected files' checksums only if their size is below what it was when the database was built. If the database is hashed while the files are large (ie, near the end of the month), you may be deluged with messages after the first of the month when the files are rotated and returned to 0 size. The best way to get around this is to rotate them before hashing the database. This does make the check next to useless, a hacker's wiping of the log files would not trigger this alert.

So I guess the policy is pretty much useless for files that are rotated - you're either spammed after rotation, or not warned when they're nuked.

Anyways, here's the script.

{{{
#!/bin/bash

echo "Shutting down Nicmon..."
/etc/init.d/nicmon stop
killall -9 nicmon

echo "Removing old checksum database..."
rm -f /var/lib/nicmon/nicmon_file

echo "Would you like to rotate the logfiles before re-initializing the database?"
echo "This may help prevent bogus warnings when files checked by GROWINGLOGFILES are"
echo "rotated later on. y or yes to rotate, anything else to skip rotation."
echo -n "Rotate log files: "
ROTATE=''
read ROTATE

if [[ "${ROTATE}" == y* ]] || [[ "${ROTATE}" == Y* ]] ; then
echo "Rotating log files..."
logrotate -vf /etc/logrotate.conf
else
echo "Skipping log rotation"
fi

echo "Initializing database..."
/usr/local/sbin/nicmon --foreground -t init

echo "Signing database..."
gpg -a --clearsign --not-dash-escaped /var/lib/nicmon/nicmon_file
mv -f /var/lib/nicmon/nicmon_file.asc /var/lib/nicmon/nicmon_file

echo "Restarting Nicmon..."
/etc/init.d/nicmon start

echo "Done!"
}}}

== Rebuilding an existing install ==

Samhain hard-codes some important checksums at build time. After upgrading system libraries or binaries (such as gpg), samhain may instruct you to recompile it to incorporate the new checksums.

Here's a shell script that will do just that:
{{{
#!/bin/bash

echo "Shutting down Nicmon..."
/etc/init.d/nicmon stop

echo "Removing old checksum database..."
rm -f /var/lib/nicmon/nicmon_file

echo "Downloading current Samhain source..."
cd /usr/src
mkdir samhain-current
svn checkout http://svn.la-samhna.de/samhain/trunk/ samhain-current

if [[ -f /usr/src/samhain-current/LICENSE ]] ; then
echo "SVN Checkout OK"
cd samhain-current
else
echo "SVN Checkout of Samhain source failed, falling back to download..."
rm -rf samhain-current
wget http://la-samhna.de/samhain/samhain-current.tar.gz

echo "Unpacking source..."
tar -zxf samhain-current.tar.gz
tar -zxf samhain-2.2.0.tar.gz
cd samhain-2.2.0
if [[ -f /usr/src/samhain-2.2.0 ]] ; then
echo "Download failed too!"
exit 0
fi
fi

echo "Configuring Stage 1..."
./configure
make

echo "Selecting GPG fingerprint..."
FINGERPRINT=`gpg --fingerprint |grep fingerprint |awk -F' = ' '{print $2}'`

echo "Fingerprint is: ${FINGERPRINT} - if this does not look correct, please enter the correct fingerprint now:"
NEW_FP=`read`
if [[ -z "${NEW_FP}" ]]
then
echo "No fingerprint entered, using preselected value."
else
echo "Using manually entered fingerprint ${NEW_FP}"
FINGERPRINT="${NEW_FP}"
fi

echo "Configuring final stage..."
./configure --enable-micro-stealth=177 --enable-static \
--enable-install-name=nicmon --with-gpg=/usr/bin/gpg \
--with-checksum \
--with-fp="${FINGERPRINT}" \
--enable-base=1353031580,1621368721

echo "Building..."
make

echo "Installing..."
make install
make install-boot

echo "Cleaning up..."
cd ~
rm -rf /usr/src/samhain*
rm -f /usr/local/man/man8/nicmon.8
rm -f /usr/local/man/man5/nicmonrc.5

echo "Initializing database..."
/usr/local/sbin/nicmon --foreground -t init

echo "Signing database..."
gpg -a --clearsign --not-dash-escaped /var/lib/nicmon/nicmon_file
mv -f /var/lib/nicmon/nicmon_file.asc /var/lib/nicmon/nicmon_file

echo "Starting rebuilt Nicmon..."
/etc/init.d/nicmon start

echo "Done!"

}}}

Samhain - Revision history

128.223.202.180: Redirecting to Service:Samhain

128.223.202.180: /* Installation */

128.223.202.180: /* Installation */

128.223.202.180 at 18:04, 1 August 2006

128.223.202.180 at 18:01, 1 August 2006

128.223.202.180 at 18:00, 1 August 2006

128.223.202.180 at 17:48, 1 August 2006