Hi :]
I started a new project and wanted to know Your opinion on the base
ideas I have about it.
As You read in the title, I called it HLIPS.
(The HLFS is there, as that's where I develope and test it at and
because it's my favourite distro (if You can call it a distro of course) :)
The whole thing is a big script composed with the AIDE, ChkRootKit and
ChkExploit.
I tweaked the ChkRootKit a little bit (It tended to find a few rootkits
on fresh HLFS binaries, a compiled netstat as an example - I know it's
not in HLFS, but ChkRootKit relays on it)
Thus making a check and notification system.
Currently it's still under development (duh), but I want to release an
alpha someday maybe in the next 2 weeks :]
So what it does?
It checks and makes archives (when changes occur) of the systems
configuration (/etc and everywhere else where You keep Your configs that
You would not want too lose)
It checks the system for exploits and rootkits using ChkRootKit and
ChkExploit.
It uses AIDE to make sure that there were no changes where they
shouldn't be.
It depends on only a few binaries (grep, cat, echo, aide, chkrootkit bins)
It parses the SYSLOG and outputs desired data, right now I got it set up
to filter out all info on malicious packets, group it into 'per IP',
count it (how many packets, how many different IPs) and if there was any
info retrieved by netfilters OSF module, display it too.
For example, a typical output looks like this:
SRC=220.248.201.210 [7] () TTL=103 SPT=4625 DPT=1025 [7]
SRC=218.64.66.169 [3] () TTL=95 SPT=4795 DPT=1025 [2] TTL=95 SPT=4794
DPT=1025 [1]
SRC=221.12.40.144 [1] () TTL=34 PROTO=UDP SPT=35315 DPT=1026 [1]
SRC=218.64.77.180 [2] () TTL=94 SPT=1953 DPT=1025 [2]
SRC=202.111.173.82 [1] () TTL=32 PROTO=UDP SPT=39261 DPT=1026 [1]
SRC=212.176.49.56 [1] (Redline [::Redline_T|X_2200] : hops=141) TTL=114
SPT=30386 DPT=1080 [1]
the first brackets after the IP tell how many connection's have been
logged into syslog (I use somewhat more complicated firewall, so it
doesn't mean that there were only this many connection attempts, but
many of the others were tarpitted and dropped without logging)
the second () contain info on the system from which the packet
originated, it's OSF (fingerprint) based and usually works well.
Then there are a few informations I want it to tell me like
TTL,PROTO,SPT,DPT, if PROTO is unspecified it's assumed to be TCP (it
keeps the output even more readable) the last brackets tell how many
such connections were logged (with the same TTL,PROTO,SPT and DPT)
Finally it outputs everything else from the syslog, if there were any
other errors or such.
Every hour the scripts is run and I get a stat on everything into my
email box.
Currently when something is detected, depending on the severity, I
either get it by email with a marker in the subject to look at it more
closely, or when it's something really weird, I get info by SMS :]
I also have a little script allowing the remote shutdown of the entire
server, using just the mobile and a specialy crafted message, that when
delivered to a specified account, from a specified adress causes the
shutdown :] (if things would go very bad and I couldn't access the
server directly)
So the order in which it works is:
- check the config archives for modifications (if I update, I also
update the aide database, so this should ALWAYS return NO MODIFICATIONS,
else sms me right now and tell me who's logged, what's he executing and
such info)
- check the config and do an archive if something changed
- run chkrootkit and filter the output from things like 'not found' or
'not infected' etc. to let only the important ones stay
- run chexploit and parse the output in the same way
- run aide to generally check most of the system
- run the syslog analiser script
mail all the output info to my email account with apropriate subject
(depending on whether there were changes found or not)
The entire process on my Celeron 600mhz with 192MbRAM takes around 8 to
10 minutes.
When doing the installable package of it, I'd like to use as many
randomness as possible. To do that I'd have to make it even more
position independent then it is now but it's possible.
And another thing would be to hide it as well as possible (why any
intruder would need to know that it's target is using the HLIPS? :)
Then on compilation, the location would be choosen based on existing
system structures (some random existing location, of course after
telling the user where and if he/she agries to it) and so would be the
file names, to make finding of the system even harder.
Another thing I'd like it to do is to hide from ps aux
For example to pretend it's another running program (say httpd or
anything else or to just vanish)
Another thing is to make it start we need the position dependency, when
tracing the /etc/rc.d/init.d and /etc/inittab we can find everything
that gets started up (I assume the intruder gets root privilliges)
but let's say it would get started from inside another program, some
specialy crafted `echo` (or anything else) command option that would
look as normal as it is :] Then that would be the only place to put the
position of the system into, and even We could go ahead and forget about
it :]
So what do You think? Is it paranoic enough?
And maybe You already know something similar to this?
I wish to make the program as customizable as it gets, and also easy to
use and install. Make some English and Polish docs on it (maybe someone
will help with other languages).
You know, everything that a good program should have :]
If anybody is interested, I can post later info on the subject when I'll
be close enough to the alpha to let it run somewhere outside my server
for the first time :]
--
Best wishes
Łukasz Hejnak
szift at szift.org
--
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page
