On 11/04/2016 09:35 AM, Zrubi wrote:
On 11/03/2016 11:42 PM, [email protected] wrote:
Coming out of a discussion in
https://groups.google.com/forum/#!topic/qubes-users/hs2yapPlUVA
I am interested, does anyone run intrusion detection tools within their VMs?
Intrusion/virus detection inside the affected VM not really makes sense.
Please consider a mail client/VM. Something could get into the user
space extensions and simply monitor mail while gathering account
information - working temporarily while hoping that the infection would
be saved and re-used in future sessions (an argument for never using
mail client internal browsers, and for always running WAN-apps in DispVMs)
However newer Xen versions has a nice feature:
https://wiki.xenproject.org/wiki/Virtual_Machine_Introspection
And already a real project using this feature:
https://drakvuf.com/
That feature wound really make sense and would fit in Qubes philosophy
pretty nicely.
Another - currently implementable - way to use a proxy VM (as it is
currently used as a dnf/yum proxy) and install your desired intrusion
detection software there.
Suricata is a good candidate for such thing:
https://suricata-ids.org/
(I would just need more time and more RAM to play with such things ;)
Yet another possibility is using Grsecurity RBAC. "Train" your VM RBAC
rules for normal operation for a day, then turn on enforcing mode and
block/flag any system or user actions that are exceptional. (RBAC can
easily be programmed to allow access only to specific, authorized net
addresses - perhaps easier than devising an iptables-adjusting script)
This RBAC protection is an optional part of the standard kernel
hardening patch.
IIRC other kernel hardening software have something similar to RBAC.
--
You received this message because you are subscribed to the Google Groups
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/qubes-users/87c1dc02-5d24-537c-4d5c-5e916f7e223e%40gmail.com.
For more options, visit https://groups.google.com/d/optout.
