Samhain
Introduction
Purpose
Host based intrusion detection systems(IDS) allow tracking of critical systems files, making unauthorized changes obvious.
Justification
Samhain is the most featureful open source IDS currently under development.
Setup
Installation
Generate gpg key used in signing config file and checksum database.
gpg --gen-key
gpg (GnuPG) 1.2.4; Copyright (C) 2003 Free Software Foundation, Inc.
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions. See the file COPYING for details.
Please select what kind of key you want:
(1) DSA and ElGamal (default)
(2) DSA (sign only)
(4) RSA (sign only)
Your selection? 1
DSA keypair will have 1024 bits.
About to generate a new ELG-E keypair.
minimum keysize is 768 bits
default keysize is 1024 bits
highest suggested keysize is 2048 bits
What keysize do you want? (1024) 2048
Requested keysize is 2048 bits
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct (y/n)? y
You need a User-ID to identify your key; the software constructs the user id
from Real Name, Comment and Email Address in this form:
"Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"
Real name: Neuroinformatics Center
Email address: systems@nic.uoregon.edu
Comment: NIC
You selected this USER-ID:
"Neuroinformatics Center (NIC) <systems@nic.uoregon.edu>"
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
You need a Passphrase to protect your secret key.
gpg: gpg-agent is not available in this session
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
+++++.+++++...+++++.+++++++++++++++++++++++++++++++++++++++++++++.+++++++++++++++.+++++.+++++.+++++.++++++++++.++++++++++.+++++..+++++..++++++++++>+++++.+++++.....................>.+++++.+++++
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
+++++.+++++.++++++++++++++++++++++++++++++.+++++++++++++++..++++++++++.++++++++++++++++++++++++++++++..++++++++++.+++++..++++++++++.++++++++++++++++++++..+++++>+++++.+++++>+++++>+++++...............>+++++......................+++++^^^^^^^^^
public and secret key created and signed.
key marked as ultimately trusted.
pub 1024D/0E52D35E 2005-07-05 Neuroinformatics Center (NIC) <systems@nic.uoregon.edu>
Key fingerprint = 9813 EDAA 19BF CAC5 4697 CC17 1DD9 AA76 0E52 D35E
sub 2048g/077454E4 2005-07-05
Use fingerprint above in the configure command line below. {{{--with-fp=<fingerprint>}}}
mkdir source cd source
Download newest version of Samhain from http://la-samhna.de/samhain/.
tar -zxvf samhain-<version>.tar.gz cd samhain-<version>
Need the next two steps because TIGER192 checksum support isn't compiled in gpg by default so we have to use samhain itself.
./configure make
{{{--enable-micro-stealth=177}}} XORs all strings in the binary and log file by 177.BR {{{--enable-static}}} Statically binds all libraries at compile time.BR {{{--enable-install-name=nicmon}}} Installs all samhain files with "samhain" replaced by "nicmon".BR {{{--with-gpg=/usr/bin/gpg}}} Compiles the location of gpg into the binary.BR {{{--with-checksum}}} Compiles the checksum of the gpg binary into the samhain binary.BR {{{--with-fp=<fingerprint>}}} Includes the fingerprint of the gpg key used to sign the config file and checksum database in the binary.BR {{{--enable-base=1353031580,1621368721}}} All messages send by samhain include this base.BR
./configure --enable-micro-stealth=177 --enable-static \
--enable-install-name=nicmon --with-gpg=/usr/bin/gpg \
--with-checksum \
--with-fp="<fingerprint from output of gpg --gen-key>" \
--enable-base=1353031580,1621368721
make
mv samhainrc.linux samhainrc.linux.stock
scp root@neuronic.nic.uoregon.edu:/etc/nicmonrc ./samhainrc.linux
Edit samhainrc.linux and remove gpg header and footer in preparation for signing.
make install make install-boot rm /usr/local/man/man8/nicmon.8 rm /usr/local/man/man5/nicmonrc.5 /usr/local/sbin/nicmon -t init gpg -a --clearsign --not-dash-escaped /var/lib/nicmon/nicmon_file mv /var/lib/nicmon/nicmon_file.asc /var/lib/nicmon/nicmon_file /usr/local/sbin/nicmon -t check
Configuration
Samhainrc setup. See comments in rc file for explanation of settings.
[Misc] [Attributes] file=/etc/mtab file=/etc/resolv.conf file=/etc/localtime file=/etc/ioctl.save file=/etc [LogFiles] file=/var/run/utmp file=/etc/motd [GrowingLogFiles] file=/var/log/messages file=/var/log/wtmp [IgnoreAll] [IgnoreNone] [Prelink] [ReadOnly] dir=/usr/bin dir=/usr/local/bin dir=/bin dir=/boot dir=3/sbin dir=/usr/sbin dir=2/lib dir=2/usr/lib dir=2/usr/local/lib dir=3/etc dir=/usr/X11R6/bin [User0] [User1] [EventSeverity] SeverityIgnoreAll=info [Log] MailSeverity=crit LogSeverity=mark [Misc] Daemon = yes ChecksumTest=check UseCaps = yes SetLoopTime = 60 SetFileCheckTime = 600 SetMailTime = 60 SetMailNum = 100 SetMailAddress=systems@nic.uoregon.edu SetPrelinkPath = /usr/local/sbin/nicmon SyslogFacility=LOG_LOCAL2 [EOF]
Maintenance
Start
/etc/init.d/nicmon start
or
/usr/local/sbin/nicmon -t check
Stop
/etc/init.d/nicmon stop
or
ps auxw|grep nicmon kill <pid>
or
killall nicmon
Update Database
Stop samhain.
rm /var/lib/nicmon/nicmon_file /usr/local/sbin/nicmon -t init gpg -a --clearsign --not-dash-escaped /var/lib/nicmon/nicmon_file mv /var/lib/nicmon/nicmon_file.asc /var/lib/nicmon/nicmon_file
Start samhain.
Update Configuration File
Stop samhain.
Remove gpg header and footer from /etc/nicmonrc.
Modify /etc/nicmonrc.
Re-sign /etc/nicmonrc.
gpg -a --clearsign --not-dash-escaped /etc/nicmonrc mv /etc/nicmonrc.asc /etc/nicmonrc
Remove and recreate file database.
rm /var/lib/nicmon/nicmon_file /usr/local/sbin/nicmon -t init gpg -a --clearsign --not-dash-escaped /var/lib/nicmon/nicmon_file mv /var/lib/nicmon/nicmon_file.asc /var/lib/nicmon/nicmon_file
Start samhain.
Debugging
To debug a problem, run samhain using the following option. It will print all messages with info or greater priority to standard out.
/usr/local/sbin/nicmon -t <init or check> -p info
Log Files
View log using
/usr/local/sbin/nicmon -jL /var/log/nicmon_log
Rehashing the checksum database
Here's a useful script to rebuild the samhain checksum database.
Samhain's "growing log files" policy will verify selected files' checksums only if their size is below what it was when the database was built. If the database is hashed while the files are large (ie, near the end of the month), you may be deluged with messages after the first of the month when the files are rotated and returned to 0 size. The best way to get around this is to rotate them before hashing the database. This does make the check next to useless, a hacker's wiping of the log files would not trigger this alert.
So I guess the policy is pretty much useless for files that are rotated - you're either spammed after rotation, or not warned when they're nuked.
Anyways, here's the script.
#!/bin/bash
echo "Shutting down Nicmon..."
/etc/init.d/nicmon stop
killall -9 nicmon
echo "Removing old checksum database..."
rm -f /var/lib/nicmon/nicmon_file
echo "Would you like to rotate the logfiles before re-initializing the database?"
echo "This may help prevent bogus warnings when files checked by GROWINGLOGFILES are"
echo "rotated later on. y or yes to rotate, anything else to skip rotation."
echo -n "Rotate log files: "
ROTATE=''
read ROTATE
if [[ "${ROTATE}" == y* ]] || [[ "${ROTATE}" == Y* ]] ; then
echo "Rotating log files..."
logrotate -vf /etc/logrotate.conf
else
echo "Skipping log rotation"
fi
echo "Initializing database..."
/usr/local/sbin/nicmon --foreground -t init
echo "Signing database..."
gpg -a --clearsign --not-dash-escaped /var/lib/nicmon/nicmon_file
mv -f /var/lib/nicmon/nicmon_file.asc /var/lib/nicmon/nicmon_file
echo "Restarting Nicmon..."
/etc/init.d/nicmon start
echo "Done!"
Rebuilding an existing install
Samhain hard-codes some important checksums at build time. After upgrading system libraries or binaries (such as gpg), samhain may instruct you to recompile it to incorporate the new checksums.
Here's a shell script that will do just that:
#!/bin/bash
echo "Shutting down Nicmon..."
/etc/init.d/nicmon stop
echo "Removing old checksum database..."
rm -f /var/lib/nicmon/nicmon_file
echo "Downloading current Samhain source..."
cd /usr/src
mkdir samhain-current
svn checkout http://svn.la-samhna.de/samhain/trunk/ samhain-current
if [[ -f /usr/src/samhain-current/LICENSE ]] ; then
echo "SVN Checkout OK"
cd samhain-current
else
echo "SVN Checkout of Samhain source failed, falling back to download..."
rm -rf samhain-current
wget http://la-samhna.de/samhain/samhain-current.tar.gz
echo "Unpacking source..."
tar -zxf samhain-current.tar.gz
tar -zxf samhain-2.2.0.tar.gz
cd samhain-2.2.0
if [[ -f /usr/src/samhain-2.2.0 ]] ; then
echo "Download failed too!"
exit 0
fi
fi
echo "Configuring Stage 1..."
./configure
make
echo "Selecting GPG fingerprint..."
FINGERPRINT=`gpg --fingerprint |grep fingerprint |awk -F' = ' '{print $2}'`
echo "Fingerprint is: ${FINGERPRINT} - if this does not look correct, please enter the correct fingerprint now:"
NEW_FP=`read`
if [[ -z "${NEW_FP}" ]]
then
echo "No fingerprint entered, using preselected value."
else
echo "Using manually entered fingerprint ${NEW_FP}"
FINGERPRINT="${NEW_FP}"
fi
echo "Configuring final stage..."
./configure --enable-micro-stealth=177 --enable-static \
--enable-install-name=nicmon --with-gpg=/usr/bin/gpg \
--with-checksum \
--with-fp="${FINGERPRINT}" \
--enable-base=1353031580,1621368721
echo "Building..."
make
echo "Installing..."
make install
make install-boot
echo "Cleaning up..."
cd ~
rm -rf /usr/src/samhain*
rm -f /usr/local/man/man8/nicmon.8
rm -f /usr/local/man/man5/nicmonrc.5
echo "Initializing database..."
/usr/local/sbin/nicmon --foreground -t init
echo "Signing database..."
gpg -a --clearsign --not-dash-escaped /var/lib/nicmon/nicmon_file
mv -f /var/lib/nicmon/nicmon_file.asc /var/lib/nicmon/nicmon_file
echo "Starting rebuilt Nicmon..."
/etc/init.d/nicmon start
echo "Done!"