Samhain
Introduction
Purpose
Host based intrusion detection systems(IDS) allow tracking of critical systems files, making unauthorized changes obvious.
Justification
Samhain is the most featureful open source IDS currently under development.
Setup
Installation
Generate gpg key used in signing config file and checksum database. {{{ gpg --gen-key gpg (GnuPG) 1.2.4; Copyright (C) 2003 Free Software Foundation, Inc. This program comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under certain conditions. See the file COPYING for details.
Please select what kind of key you want:
(1) DSA and ElGamal (default) (2) DSA (sign only) (4) RSA (sign only)
Your selection? 1 DSA keypair will have 1024 bits. About to generate a new ELG-E keypair.
minimum keysize is 768 bits
default keysize is 1024 bits
highest suggested keysize is 2048 bits
What keysize do you want? (1024) 2048 Requested keysize is 2048 bits Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0) 0 Key does not expire at all Is this correct (y/n)? y
You need a User-ID to identify your key; the software constructs the user id from Real Name, Comment and Email Address in this form:
"Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"
Real name: Neuroinformatics Center Email address: systems@nic.uoregon.edu Comment: NIC You selected this USER-ID:
"Neuroinformatics Center (NIC) <systems@nic.uoregon.edu>"
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o You need a Passphrase to protect your secret key.
gpg: gpg-agent is not available in this session We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy. +++++.+++++...+++++.+++++++++++++++++++++++++++++++++++++++++++++.+++++++++++++++.+++++.+++++.+++++.++++++++++.++++++++++.+++++..+++++..++++++++++>+++++.+++++.....................>.+++++.+++++ We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy. +++++.+++++.++++++++++++++++++++++++++++++.+++++++++++++++..++++++++++.++++++++++++++++++++++++++++++..++++++++++.+++++..++++++++++.++++++++++++++++++++..+++++>+++++.+++++>+++++>+++++...............>+++++......................+++++^^^^^^^^^ public and secret key created and signed. key marked as ultimately trusted.
pub 1024D/0E52D35E 2005-07-05 Neuroinformatics Center (NIC) <systems@nic.uoregon.edu>
Key fingerprint = 9813 EDAA 19BF CAC5 4697 CC17 1DD9 AA76 0E52 D35E
sub 2048g/077454E4 2005-07-05 }}}
Use fingerprint above in the configure command line below. {{{--with-fp=<fingerprint>}}}
{{{ mkdir source cd source }}}
Download newest version of Samhain from http://la-samhna.de/samhain/.
{{{ tar -zxvf samhain-<version>.tar.gz cd samhain-<version> }}}
Need the next two steps because TIGER192 checksum support isn't compiled in gpg by default so we have to use samhain itself.
{{{ ./configure make }}}
{{{--enable-micro-stealth=177}}} XORs all strings in the binary and log file by 177.BR {{{--enable-static}}} Statically binds all libraries at compile time.BR {{{--enable-install-name=nicmon}}} Installs all samhain files with "samhain" replaced by "nicmon".BR {{{--with-gpg=/usr/bin/gpg}}} Compiles the location of gpg into the binary.BR {{{--with-checksum}}} Compiles the checksum of the gpg binary into the samhain binary.BR {{{--with-fp=<fingerprint>}}} Includes the fingerprint of the gpg key used to sign the config file and checksum database in the binary.BR {{{--enable-base=1353031580,1621368721}}} All messages send by samhain include this base.BR
{{{ ./configure --enable-micro-stealth=177 --enable-static \
--enable-install-name=nicmon --with-gpg=/usr/bin/gpg \
--with-checksum \
--with-fp="<fingerprint from output of gpg --gen-key>" \
--enable-base=1353031580,1621368721
make mv samhainrc.linux samhainrc.linux.stock scp root@neuronic.nic.uoregon.edu:/etc/nicmonrc ./samhainrc.linux }}}
Edit samhainrc.linux and remove gpg header and footer in preparation for signing.
{{{ make install make install-boot rm /usr/local/man/man8/nicmon.8 rm /usr/local/man/man5/nicmonrc.5 /usr/local/sbin/nicmon -t init gpg -a --clearsign --not-dash-escaped /var/lib/nicmon/nicmon_file mv /var/lib/nicmon/nicmon_file.asc /var/lib/nicmon/nicmon_file /usr/local/sbin/nicmon -t check }}}
Configuration
Samhainrc setup. See comments in rc file for explanation of settings.
{{{ [Misc]
[Attributes] file=/etc/mtab file=/etc/resolv.conf file=/etc/localtime file=/etc/ioctl.save file=/etc
[LogFiles] file=/var/run/utmp file=/etc/motd
[GrowingLogFiles] file=/var/log/messages file=/var/log/wtmp
[IgnoreAll]
[IgnoreNone]
[Prelink]
[ReadOnly] dir=/usr/bin dir=/usr/local/bin dir=/bin dir=/boot dir=3/sbin dir=/usr/sbin dir=2/lib dir=2/usr/lib dir=2/usr/local/lib dir=3/etc dir=/usr/X11R6/bin
[User0] [User1]
[EventSeverity] SeverityIgnoreAll=info
[Log] MailSeverity=crit LogSeverity=mark
[Misc] Daemon = yes ChecksumTest=check UseCaps = yes SetLoopTime = 60 SetFileCheckTime = 600 SetMailTime = 60 SetMailNum = 100 SetMailAddress=systems@nic.uoregon.edu SetPrelinkPath = /usr/local/sbin/nicmon SyslogFacility=LOG_LOCAL2
[EOF] }}}
Maintenance
Start
{{{ /etc/init.d/nicmon start }}}
or
{{{ /usr/local/sbin/nicmon -t check }}}
Stop
{{{ /etc/init.d/nicmon stop }}}
or
grep nicmon kill <pid>
or
{{{ killall nicmon }}}
Update Database
Stop samhain.
{{{ rm /var/lib/nicmon/nicmon_file /usr/local/sbin/nicmon -t init gpg -a --clearsign --not-dash-escaped /var/lib/nicmon/nicmon_file mv /var/lib/nicmon/nicmon_file.asc /var/lib/nicmon/nicmon_file }}}
Start samhain.
Update Configuration File
Stop samhain.
Remove gpg header and footer from /etc/nicmonrc.
Modify /etc/nicmonrc.
Re-sign /etc/nicmonrc.
{{{ gpg -a --clearsign --not-dash-escaped /etc/nicmonrc mv /etc/nicmonrc.asc /etc/nicmonrc }}}
Remove and recreate file database.
{{{ rm /var/lib/nicmon/nicmon_file /usr/local/sbin/nicmon -t init gpg -a --clearsign --not-dash-escaped /var/lib/nicmon/nicmon_file mv /var/lib/nicmon/nicmon_file.asc /var/lib/nicmon/nicmon_file }}}
Start samhain.
Debugging
To debug a problem, run samhain using the following option. It will print all messages with info or greater priority to standard out.
{{{ /usr/local/sbin/nicmon -t <init or check> -p info }}}
Log Files
View log using
{{{ /usr/local/sbin/nicmon -jL /var/log/nicmon_log }}}
Rehashing the checksum database
Here's a useful script to rebuild the samhain checksum database.
Samhain's "growing log files" policy will verify selected files' checksums only if their size is below what it was when the database was built. If the database is hashed while the files are large (ie, near the end of the month), you may be deluged with messages after the first of the month when the files are rotated and returned to 0 size. The best way to get around this is to rotate them before hashing the database. This does make the check next to useless, a hacker's wiping of the log files would not trigger this alert.
So I guess the policy is pretty much useless for files that are rotated - you're either spammed after rotation, or not warned when they're nuked.
Anyways, here's the script.
Rebuilding an existing install
Samhain hard-codes some important checksums at build time. After upgrading system libraries or binaries (such as gpg), samhain may instruct you to recompile it to incorporate the new checksums.
Here's a shell script that will do just that: grep fingerprint