Samhain

TableOfContents

Introduction

Purpose

Host based intrusion detection systems(IDS) allow tracking of critical systems files, making unauthorized changes obvious.

Justification

Samhain is the most featureful open source IDS currently under development.

Setup

Installation

Generate gpg key used in signing config file and checksum database.

gpg --gen-key
gpg (GnuPG) 1.2.4; Copyright (C) 2003 Free Software Foundation, Inc.
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions. See the file COPYING for details.

Please select what kind of key you want:
   (1) DSA and ElGamal (default)
   (2) DSA (sign only)
   (4) RSA (sign only)
Your selection? 1
DSA keypair will have 1024 bits.
About to generate a new ELG-E keypair.
              minimum keysize is  768 bits
              default keysize is 1024 bits
    highest suggested keysize is 2048 bits
What keysize do you want? (1024) 2048
Requested keysize is 2048 bits       
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct (y/n)? y
                        
You need a User-ID to identify your key; the software constructs the user id
from Real Name, Comment and Email Address in this form:
    "Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"

Real name: Neuroinformatics Center
Email address: systems@nic.uoregon.edu
Comment: NIC                          
You selected this USER-ID:
    "Neuroinformatics Center (NIC) <systems@nic.uoregon.edu>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
You need a Passphrase to protect your secret key.    

gpg: gpg-agent is not available in this session
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
+++++.+++++...+++++.+++++++++++++++++++++++++++++++++++++++++++++.+++++++++++++++.+++++.+++++.+++++.++++++++++.++++++++++.+++++..+++++..++++++++++>+++++.+++++.....................>.+++++.+++++
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
+++++.+++++.++++++++++++++++++++++++++++++.+++++++++++++++..++++++++++.++++++++++++++++++++++++++++++..++++++++++.+++++..++++++++++.++++++++++++++++++++..+++++>+++++.+++++>+++++>+++++...............>+++++......................+++++^^^^^^^^^
public and secret key created and signed.
key marked as ultimately trusted.

pub  1024D/0E52D35E 2005-07-05 Neuroinformatics Center (NIC) <systems@nic.uoregon.edu>
     Key fingerprint = 9813 EDAA 19BF CAC5 4697  CC17 1DD9 AA76 0E52 D35E
sub  2048g/077454E4 2005-07-05

Use fingerprint above in the configure command line below.

 --with-fp=<fingerprint>

mkdir source
cd source

Download newest version of Samhain from http://la-samhna.de/samhain/.

tar -zxvf samhain-<version>.tar.gz
cd samhain-<version>

Need the next two steps because TIGER192 checksum support isn't compiled in gpg by default so we have to use samhain itself.

./configure
make

--enable-micro-stealth=177	XORs all strings in the binary and log file by 177.
--enable-static	Statically binds all libraries at compile time
--enable-install-name=nicmon	Installs all samhain files with "samhain" replaced by "nicmon".
--with-gpg=/usr/bin/gpg	Compiles the location of gpg into the binary.
--with-checksum	Compiles the checksum of the gpg binary into the samhain binary.
--with-fp=<fingerprint>	Includes the fingerprint of the gpg key used to sign the config file and checksum database in the binary.
--enable-base=1353031580,1621368721	All messages send by samhain include this base.

./configure --enable-micro-stealth=177 --enable-static \
            --enable-install-name=nicmon --with-gpg=/usr/bin/gpg \
            --with-checksum \
            --with-fp="<fingerprint from output of gpg --gen-key>" \
            --enable-base=1353031580,1621368721
make
mv samhainrc.linux samhainrc.linux.stock
scp root@neuronic.nic.uoregon.edu:/etc/nicmonrc ./samhainrc.linux

Edit samhainrc.linux and remove gpg header and footer in preparation for signing.

make install
make install-boot
rm /usr/local/man/man8/nicmon.8
rm /usr/local/man/man5/nicmonrc.5
/usr/local/sbin/nicmon -t init
gpg -a --clearsign --not-dash-escaped /var/lib/nicmon/nicmon_file
mv /var/lib/nicmon/nicmon_file.asc /var/lib/nicmon/nicmon_file
/usr/local/sbin/nicmon -t check

Configuration

Samhainrc setup. See comments in rc file for explanation of settings.

[Misc]

[Attributes]
file=/etc/mtab
file=/etc/resolv.conf
file=/etc/localtime
file=/etc/ioctl.save
file=/etc

[LogFiles]
file=/var/run/utmp
file=/etc/motd

[GrowingLogFiles]
file=/var/log/messages
file=/var/log/wtmp

[IgnoreAll]

[IgnoreNone]

[Prelink]

[ReadOnly]
dir=/usr/bin
dir=/usr/local/bin
dir=/bin
dir=/boot
dir=3/sbin
dir=/usr/sbin
dir=2/lib
dir=2/usr/lib
dir=2/usr/local/lib
dir=3/etc
dir=/usr/X11R6/bin

[User0]
[User1]

[EventSeverity]
SeverityIgnoreAll=info

[Log]
MailSeverity=crit
LogSeverity=mark

[Misc]
Daemon = yes
ChecksumTest=check
UseCaps = yes
SetLoopTime = 60
SetFileCheckTime = 600
SetMailTime = 60
SetMailNum = 100
SetMailAddress=systems@nic.uoregon.edu
SetPrelinkPath = /usr/local/sbin/nicmon
SyslogFacility=LOG_LOCAL2

[EOF]

Maintenance

Start

/etc/init.d/nicmon start

or

/usr/local/sbin/nicmon -t check

Stop

/etc/init.d/nicmon stop

or

ps auxw|grep nicmon
kill <pid>

or

killall nicmon

Update Database

Stop samhain.

rm /var/lib/nicmon/nicmon_file
/usr/local/sbin/nicmon -t init
gpg -a --clearsign --not-dash-escaped /var/lib/nicmon/nicmon_file
mv /var/lib/nicmon/nicmon_file.asc /var/lib/nicmon/nicmon_file

Start samhain.

Update Configuration File

Stop samhain.

Remove gpg header and footer from /etc/nicmonrc.

Modify /etc/nicmonrc.

Re-sign /etc/nicmonrc.

gpg -a --clearsign --not-dash-escaped /etc/nicmonrc
mv /etc/nicmonrc.asc /etc/nicmonrc

Remove and recreate file database.

rm /var/lib/nicmon/nicmon_file
/usr/local/sbin/nicmon -t init
gpg -a --clearsign --not-dash-escaped /var/lib/nicmon/nicmon_file
mv /var/lib/nicmon/nicmon_file.asc /var/lib/nicmon/nicmon_file

Start samhain.

Debugging

To debug a problem, run samhain using the following option. It will print all messages with info or greater priority to standard out.

/usr/local/sbin/nicmon -t <init or check> -p info

Log Files

View log using

/usr/local/sbin/nicmon -jL /var/log/nicmon_log

Rehashing the checksum database

Here's a useful script to rebuild the samhain checksum database.

Samhain's "growing log files" policy will verify selected files' checksums only if their size is below what it was when the database was built. If the database is hashed while the files are large (ie, near the end of the month), you may be deluged with messages after the first of the month when the files are rotated and returned to 0 size. The best way to get around this is to rotate them before hashing the database. This does make the check next to useless, a hacker's wiping of the log files would not trigger this alert.

So I guess the policy is pretty much useless for files that are rotated - you're either spammed after rotation, or not warned when they're nuked.

Anyways, here's the script.

#!/bin/bash

echo "Shutting down Nicmon..."
/etc/init.d/nicmon stop
killall -9 nicmon

echo "Removing old checksum database..."
rm -f /var/lib/nicmon/nicmon_file

echo "Would you like to rotate the logfiles before re-initializing the database?"
echo "This may help prevent bogus warnings when files checked by GROWINGLOGFILES are"
echo "rotated later on. y or yes to rotate, anything else to skip rotation."
echo -n "Rotate log files: "
ROTATE=''
read ROTATE

if [[ "${ROTATE}" == y* ]] || [[ "${ROTATE}" == Y* ]] ; then
  echo "Rotating log files..."
  logrotate -vf /etc/logrotate.conf
else
  echo "Skipping log rotation"
fi

echo "Initializing database..."
/usr/local/sbin/nicmon --foreground -t init

echo "Signing database..."
gpg -a --clearsign --not-dash-escaped /var/lib/nicmon/nicmon_file
mv -f /var/lib/nicmon/nicmon_file.asc /var/lib/nicmon/nicmon_file

echo "Restarting Nicmon..."
/etc/init.d/nicmon start

echo "Done!"

Rebuilding an existing install

Samhain hard-codes some important checksums at build time. After upgrading system libraries or binaries (such as gpg), samhain may instruct you to recompile it to incorporate the new checksums.

Here's a shell script that will do just that:

#!/bin/bash

echo "Shutting down Nicmon..."
/etc/init.d/nicmon stop

echo "Removing old checksum database..."
rm -f /var/lib/nicmon/nicmon_file

echo "Downloading current Samhain source..."
cd /usr/src
mkdir samhain-current
svn checkout http://svn.la-samhna.de/samhain/trunk/ samhain-current

if [[ -f /usr/src/samhain-current/LICENSE ]] ; then
  echo "SVN Checkout OK"
  cd samhain-current
else
  echo "SVN Checkout of Samhain source failed, falling back to download..."
  rm -rf samhain-current
  wget http://la-samhna.de/samhain/samhain-current.tar.gz

  echo "Unpacking source..."
  tar -zxf samhain-current.tar.gz
  tar -zxf samhain-2.2.0.tar.gz
  cd samhain-2.2.0
  if [[ -f /usr/src/samhain-2.2.0 ]] ; then
    echo "Download failed too!"
    exit 0
  fi
fi


echo "Configuring Stage 1..."
./configure
make

echo "Selecting GPG fingerprint..."
FINGERPRINT=`gpg --fingerprint |grep fingerprint |awk -F' = ' '{print $2}'`

echo "Fingerprint is: ${FINGERPRINT} - if this does not look correct, please enter the correct fingerprint now:"
NEW_FP=`read`
if [[ -z "${NEW_FP}" ]]
then
  echo "No fingerprint entered, using preselected value."
else
  echo "Using manually entered fingerprint ${NEW_FP}"
  FINGERPRINT="${NEW_FP}"
fi

echo "Configuring final stage..."
./configure --enable-micro-stealth=177 --enable-static \
            --enable-install-name=nicmon --with-gpg=/usr/bin/gpg \
            --with-checksum \
            --with-fp="${FINGERPRINT}" \
            --enable-base=1353031580,1621368721

echo "Building..."
make

echo "Installing..."
make install
make install-boot

echo "Cleaning up..."
cd ~
rm -rf /usr/src/samhain*
rm -f /usr/local/man/man8/nicmon.8
rm -f /usr/local/man/man5/nicmonrc.5

echo "Initializing database..."
/usr/local/sbin/nicmon --foreground -t init

echo "Signing database..."
gpg -a --clearsign --not-dash-escaped /var/lib/nicmon/nicmon_file
mv -f /var/lib/nicmon/nicmon_file.asc /var/lib/nicmon/nicmon_file

echo "Starting rebuilt Nicmon..."
/etc/init.d/nicmon start

echo "Done!"