Samhain: Difference between revisions

From OACISS Systems Wiki
Jump to navigation Jump to search
No edit summary
(Redirecting to Service:Samhain)
 
(4 intermediate revisions by the same user not shown)
Line 1: Line 1:
[[TableOfContents]]
#REDIRECT [[Service:Samhain]]
 
= Introduction =
 
== Purpose ==
 
Host based intrusion detection systems(IDS) allow tracking of critical systems files, making unauthorized changes obvious.
 
== Justification ==
 
Samhain is the most featureful open source IDS currently under development.
 
= Setup =
 
== Installation ==
 
Generate gpg key used in signing config file and checksum database.
<pre>
gpg --gen-key
gpg (GnuPG) 1.2.4; Copyright (C) 2003 Free Software Foundation, Inc.
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions. See the file COPYING for details.
 
Please select what kind of key you want:
  (1) DSA and ElGamal (default)
  (2) DSA (sign only)
  (4) RSA (sign only)
Your selection? 1
DSA keypair will have 1024 bits.
About to generate a new ELG-E keypair.
              minimum keysize is  768 bits
              default keysize is 1024 bits
    highest suggested keysize is 2048 bits
What keysize do you want? (1024) 2048
Requested keysize is 2048 bits     
Please specify how long the key should be valid.
        0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct (y/n)? y
                       
You need a User-ID to identify your key; the software constructs the user id
from Real Name, Comment and Email Address in this form:
    "Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"
 
Real name: Neuroinformatics Center
Email address: systems@nic.uoregon.edu
Comment: NIC                         
You selected this USER-ID:
    "Neuroinformatics Center (NIC) <systems@nic.uoregon.edu>"
 
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
You need a Passphrase to protect your secret key.   
 
gpg: gpg-agent is not available in this session
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
+++++.+++++...+++++.+++++++++++++++++++++++++++++++++++++++++++++.+++++++++++++++.+++++.+++++.+++++.++++++++++.++++++++++.+++++..+++++..++++++++++>+++++.+++++.....................>.+++++.+++++
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
+++++.+++++.++++++++++++++++++++++++++++++.+++++++++++++++..++++++++++.++++++++++++++++++++++++++++++..++++++++++.+++++..++++++++++.++++++++++++++++++++..+++++>+++++.+++++>+++++>+++++...............>+++++......................+++++^^^^^^^^^
public and secret key created and signed.
key marked as ultimately trusted.
 
pub  1024D/0E52D35E 2005-07-05 Neuroinformatics Center (NIC) <systems@nic.uoregon.edu>
    Key fingerprint = 9813 EDAA 19BF CAC5 4697  CC17 1DD9 AA76 0E52 D35E
sub  2048g/077454E4 2005-07-05
</pre>
 
Use fingerprint above in the configure command line below.  {{{--with-fp=<fingerprint>}}}
 
<pre>
mkdir source
cd source
</pre>
 
Download newest version of Samhain from http://la-samhna.de/samhain/.
 
<pre>
tar -zxvf samhain-<version>.tar.gz
cd samhain-<version>
</pre>
 
Need the next two steps because TIGER192 checksum support isn't compiled in gpg by default so we have to use samhain itself.
 
<pre>
./configure
make
</pre>
 
{{{--enable-micro-stealth=177}}} XORs all strings in the binary and log file by 177.[[BR]]
{{{--enable-static}}} Statically binds all libraries at compile time.[[BR]]
{{{--enable-install-name=nicmon}}} Installs all samhain files with "samhain" replaced by "nicmon".[[BR]]
{{{--with-gpg=/usr/bin/gpg}}} Compiles the location of gpg into the binary.[[BR]]
{{{--with-checksum}}} Compiles the checksum of the gpg binary into the samhain binary.[[BR]]
{{{--with-fp=<fingerprint>}}} Includes the fingerprint of the gpg key used to sign the config file and checksum database in the binary.[[BR]]
{{{--enable-base=1353031580,1621368721}}} All messages send by samhain include this base.[[BR]]
 
<pre>
./configure --enable-micro-stealth=177 --enable-static \
            --enable-install-name=nicmon --with-gpg=/usr/bin/gpg \
            --with-checksum \
            --with-fp="<fingerprint from output of gpg --gen-key>" \
            --enable-base=1353031580,1621368721
make
mv samhainrc.linux samhainrc.linux.stock
scp root@neuronic.nic.uoregon.edu:/etc/nicmonrc ./samhainrc.linux
</pre>
 
Edit samhainrc.linux and remove gpg header and footer in preparation for signing.
 
<pre>
make install
make install-boot
rm /usr/local/man/man8/nicmon.8
rm /usr/local/man/man5/nicmonrc.5
/usr/local/sbin/nicmon -t init
gpg -a --clearsign --not-dash-escaped /var/lib/nicmon/nicmon_file
mv /var/lib/nicmon/nicmon_file.asc /var/lib/nicmon/nicmon_file
/usr/local/sbin/nicmon -t check
</pre>
 
== Configuration ==
 
Samhainrc setup.  See comments in rc file for explanation of settings.
 
<pre>
[Misc]
 
[Attributes]
file=/etc/mtab
file=/etc/resolv.conf
file=/etc/localtime
file=/etc/ioctl.save
file=/etc
 
[LogFiles]
file=/var/run/utmp
file=/etc/motd
 
[GrowingLogFiles]
file=/var/log/messages
file=/var/log/wtmp
 
[IgnoreAll]
 
[IgnoreNone]
 
[Prelink]
 
[ReadOnly]
dir=/usr/bin
dir=/usr/local/bin
dir=/bin
dir=/boot
dir=3/sbin
dir=/usr/sbin
dir=2/lib
dir=2/usr/lib
dir=2/usr/local/lib
dir=3/etc
dir=/usr/X11R6/bin
 
[User0]
[User1]
 
[EventSeverity]
SeverityIgnoreAll=info
 
[Log]
MailSeverity=crit
LogSeverity=mark
 
[Misc]
Daemon = yes
ChecksumTest=check
UseCaps = yes
SetLoopTime = 60
SetFileCheckTime = 600
SetMailTime = 60
SetMailNum = 100
SetMailAddress=systems@nic.uoregon.edu
SetPrelinkPath = /usr/local/sbin/nicmon
SyslogFacility=LOG_LOCAL2
 
[EOF]
</pre>
 
 
= Maintenance =
 
== Start ==
 
/etc/init.d/nicmon start
 
or
 
/usr/local/sbin/nicmon -t check
 
== Stop ==
 
/etc/init.d/nicmon stop
 
or
 
ps auxw|grep nicmon
kill <pid>
 
or
 
killall nicmon
 
== Update Database ==
 
Stop samhain.
 
<pre>
rm /var/lib/nicmon/nicmon_file
/usr/local/sbin/nicmon -t init
gpg -a --clearsign --not-dash-escaped /var/lib/nicmon/nicmon_file
mv /var/lib/nicmon/nicmon_file.asc /var/lib/nicmon/nicmon_file
</pre>
 
Start samhain.
 
== Update Configuration File ==
 
Stop samhain.
 
Remove gpg header and footer from /etc/nicmonrc.
 
Modify /etc/nicmonrc.
 
Re-sign /etc/nicmonrc.
 
gpg -a --clearsign --not-dash-escaped /etc/nicmonrc
mv /etc/nicmonrc.asc /etc/nicmonrc
 
Remove and recreate file database.
 
rm /var/lib/nicmon/nicmon_file
/usr/local/sbin/nicmon -t init
gpg -a --clearsign --not-dash-escaped /var/lib/nicmon/nicmon_file
mv /var/lib/nicmon/nicmon_file.asc /var/lib/nicmon/nicmon_file
 
 
Start samhain.
 
== Debugging ==
 
To debug a problem, run samhain using the following option.  It will print all messages with ''info'' or greater priority to standard out.
 
/usr/local/sbin/nicmon -t <init or check> -p info
 
== Log Files ==
 
View log using
 
/usr/local/sbin/nicmon -jL /var/log/nicmon_log
 
== Rehashing the checksum database ==
 
Here's a useful script to rebuild the samhain checksum database.
 
Samhain's "growing log files" policy will verify selected files' checksums only if their size is below what it was when the database was built. If the database is hashed while the files are large (ie, near the end of the month), you may be deluged with messages after the first of the month when the files are rotated and returned to 0 size. The best way to get around this is to rotate them before hashing the database. This does make the check next to useless, a hacker's wiping of the log files would not trigger this alert.
 
So I guess the policy is pretty much useless for files that are rotated - you're either spammed after rotation, or not warned when they're nuked.
 
Anyways, here's the script.
 
<pre>
#!/bin/bash
 
echo "Shutting down Nicmon..."
/etc/init.d/nicmon stop
killall -9 nicmon
 
echo "Removing old checksum database..."
rm -f /var/lib/nicmon/nicmon_file
 
echo "Would you like to rotate the logfiles before re-initializing the database?"
echo "This may help prevent bogus warnings when files checked by GROWINGLOGFILES are"
echo "rotated later on. y or yes to rotate, anything else to skip rotation."
echo -n "Rotate log files: "
ROTATE=''
read ROTATE
 
if [[ "${ROTATE}" == y* ]] || [[ "${ROTATE}" == Y* ]] ; then
  echo "Rotating log files..."
  logrotate -vf /etc/logrotate.conf
else
  echo "Skipping log rotation"
fi
 
echo "Initializing database..."
/usr/local/sbin/nicmon --foreground -t init
 
echo "Signing database..."
gpg -a --clearsign --not-dash-escaped /var/lib/nicmon/nicmon_file
mv -f /var/lib/nicmon/nicmon_file.asc /var/lib/nicmon/nicmon_file
 
echo "Restarting Nicmon..."
/etc/init.d/nicmon start
 
echo "Done!"
</pre>
 
== Rebuilding an existing install ==
 
Samhain hard-codes some important checksums at build time. After upgrading system libraries or binaries (such as gpg), samhain may instruct you to recompile it to incorporate the new checksums.
 
Here's a shell script that will do just that:
<pre>
#!/bin/bash
 
echo "Shutting down Nicmon..."
/etc/init.d/nicmon stop
 
echo "Removing old checksum database..."
rm -f /var/lib/nicmon/nicmon_file
 
echo "Downloading current Samhain source..."
cd /usr/src
mkdir samhain-current
svn checkout http://svn.la-samhna.de/samhain/trunk/ samhain-current
 
if [[ -f /usr/src/samhain-current/LICENSE ]] ; then
  echo "SVN Checkout OK"
  cd samhain-current
else
  echo "SVN Checkout of Samhain source failed, falling back to download..."
  rm -rf samhain-current
  wget http://la-samhna.de/samhain/samhain-current.tar.gz
 
  echo "Unpacking source..."
  tar -zxf samhain-current.tar.gz
  tar -zxf samhain-2.2.0.tar.gz
  cd samhain-2.2.0
  if [[ -f /usr/src/samhain-2.2.0 ]] ; then
    echo "Download failed too!"
    exit 0
  fi
fi
 
 
echo "Configuring Stage 1..."
./configure
make
 
echo "Selecting GPG fingerprint..."
FINGERPRINT=`gpg --fingerprint |grep fingerprint |awk -F' = ' '{print $2}'`
 
echo "Fingerprint is: ${FINGERPRINT} - if this does not look correct, please enter the correct fingerprint now:"
NEW_FP=`read`
if [[ -z "${NEW_FP}" ]]
then
  echo "No fingerprint entered, using preselected value."
else
  echo "Using manually entered fingerprint ${NEW_FP}"
  FINGERPRINT="${NEW_FP}"
fi
 
echo "Configuring final stage..."
./configure --enable-micro-stealth=177 --enable-static \
            --enable-install-name=nicmon --with-gpg=/usr/bin/gpg \
            --with-checksum \
            --with-fp="${FINGERPRINT}" \
            --enable-base=1353031580,1621368721
 
echo "Building..."
make
 
echo "Installing..."
make install
make install-boot
 
echo "Cleaning up..."
cd ~
rm -rf /usr/src/samhain*
rm -f /usr/local/man/man8/nicmon.8
rm -f /usr/local/man/man5/nicmonrc.5
 
echo "Initializing database..."
/usr/local/sbin/nicmon --foreground -t init
 
echo "Signing database..."
gpg -a --clearsign --not-dash-escaped /var/lib/nicmon/nicmon_file
mv -f /var/lib/nicmon/nicmon_file.asc /var/lib/nicmon/nicmon_file
 
echo "Starting rebuilt Nicmon..."
/etc/init.d/nicmon start
 
echo "Done!"
 
</pre>

Latest revision as of 01:42, 2 August 2006

Redirect to:

Retrieved from "https://systems.nic.uoregon.edu/internal-wiki/index.php?title=Samhain&oldid=1508"