linux18-jfs.txt

sarnold Javier Fernández-Sanguino is a debian developer, authors the Securing Debian manual, contributes to many open source security projects including nessus and bastille, and is currently the main developer of the tiger security tool sarnold he currently works for Germinus, a spanish professional IT services company sarnold while jfs is putting some slides online, I'd like to remind you that the program can be found here: http://umeet.uninet.edu/umeet2002/english/prog.eng.html sarnold and that questions and comments should be directed to #qc ; hopefully someone will be translating to spanish in #Redes sarnold so please welcome jfs :) sarnold (oh yeah, this is his third year presenting for umeet! :) MJesus probably jfs are busy ... a moment, please! jfs I wished my DSL line was faster .... jfs :o sarnold (there is never enough bandwidth.. :) jfs Ok. jfs Let's start jfs First of all welcome everybody. jfs I'm setting up the slides at http://www.dat.etsit.upm.es/~jfs/debian/doc/tiger-hids/ jfs (don't try it just yet, it will give you a 404) jfs I'm going to give a presentation on Tiger jfs There might be some of you who know about Tiger already jfs Alas, it's an old tool. jfs :) jfs The presentation available at http://www.dat.etsit.upm.es/~jfs/debian/doc/tiger-hids/html/ jfs covers much more than I will probably have time to go through. jfs I will try to use it as a guideline but I will not follow it completely. jfs BTW, the PDF version is _much_ better. So go ahead and download it at http://www.dat.etsit.upm.es/~jfs/debian/doc/tiger-hids/tiger-hids.pdf jfs First of all. Why do I want to talk about Tiger? jfs Some people might say that Tiger is an old tool, it's obsolete and doesn't do much anymore. jfs (I've heard this myself) jfs The point in talking about Tiger is to present the new version of the tool to a broader audience. jfs Why? Because it's one of the few multiplatform, modular, and _free_ security audit tools jfs And because it's one of the few multiplatform, modular and _free_ intrusion detecion tools jfs Let's first talk about Intrusion Detection, which I'll call ID for short jfs (BTW I moved the spanish presentation, out-dated to html-es and the english slides are now at http://www.dat.etsit.upm.es/~jfs/debian/doc/tiger-hids/html/) jfs (sorry) jfs Intrusion detection is described as the art of detecting inappropriate, incorrect, or anomalous activity. (from the SANS FAQ) jfs There are many issues surrounding intrusion detection. Mainly, that it's not really that easy to determine precisely what is "inappropriate, incorrect, or anomalous activity" jfs Why? jfs Because what is inappropiate to a given organisation might not be to a different one. jfs Thus, there is no sense in having an intrusion detection system (whatever it is) jfs if you do not have a security policy. jfs I will not talk about security policies, that's a rather lengthy subject and not the subject of the presentation. jfs But everyone must understand that without a security policy, even if you have the greatest security tool ono earth, you won't do anything useful. jfs _However_ jfs Some people might say: "hey, I don't have a security policy but I do have an ID tool and it works!" jfs Yes, that's correct. But only because there are some common things that most will interpret as a security policy violation. jfs For example, a DoS attack against a server, an attempt to brute-force passwords in a server, whatever.. jfs Now ID detection can be done in many ways, depending on _where_ it is done jfs I guess that many people are aware that you can do ID by analysing the packets that are exchanged in a network. jfs If you "see" a suspicious packet you might think it's an attack and report it. jfs That's network-based intrusion, and that's Snort does (to cite the best known free software tool in this area) jfs However, network-based intrusion has many issues: it's not able to analyse encrypted packets (IPsec, SSL, or similar), it it's basicly pattern/signature-based (there are some attempts at developing new types however), and network ID sensors can simply be overloaded in very high speed networks. jfs It can also only detect suspicious activity which involves network comunication. It cannot attack attempts from an operator in the console. jfs And that's where host intrusion detection steps in: intrusion done _in_ the host jfs BTW, for all of those that want to ask questions, feel free to do any of them along the presentation using the #qc channel. jfs (please start the questions with 'jfs:' so I can catch them up easily) jfs So tiger tries to help doing HID, it tries to analyse the host and determine what can be suspicious there jfs But, that's wasn't what Tiger was developed for really. jfs Tiger was developed as a set of security scripts that would test the system to determine security issues. jfs And that's the primary thing that Tiger does: a security audit of any given host jfs (it doesn't necessarily have to be the one you are running it in) jfs So, what's a security audit really? jfs From the RFC2828: jfs (I) An independent review and examination of a system's records and activities to determine the adequacy of system controls, ensure compliance with established security policy and procedures, detect breaches in security services, and recommend any changes that are indicated for countermeasures. jfs If you run Tiger it will try to analyse the system and determine deviations for the security policy. jfs Of course, you all have a security policy by now, don't you? :) jfs If you don't Tiger is still useful jfs since, like any other ID, it will attempt to detect issues that are indication of a security issue regardless of your policy jfs Any questions up to here? jfs <tarzeau> jfs: can you give examples jfs Sure I can! jfs A real word example: jfs Security policy: "users are not allowed to run daemons providing services in the department machines" jfs (that is, no game servers, no rogue apache servers, etc...) jfs You could of course remove the tools that user's can use to do this jfs Even implement access control/capabilities that would prevent this from being possible jfs but if you can't (for whatever reason) then you have to _trust_ your users will do what you ask them to jfs and you have no reason to distrust your users right? ;) jfs Well, a user X might be running program Y and is providing a game server for all the Internet to use jfs A security audit should detect this as a deviation from the security policy jfs (this in fact is not that uncommon, specially in some university environments) jfs Any more questions? jfs Ok.. (I hope the audience is not all asleep :) jfs back to tiger MJesus hummm no !! jfs The approach taken in Tiger is useful to provide both a security audit tool _and_ an intrusion detection tool jfs another question: <amd> what if user runs malicious programs with the help of cron? jfs that can be also detected in two ways: jfs 1.- the user needs to make a cron entry and it can be looked for jfs 2.- the user needs to be granted permission to run cronjobs (which might not be what the policy says) jfs The security issue is not wether or not the program is run, but wether or not the system has been changed to run it jfs so you can detect it when it's being run or before/after being run because the sytem has been configured to do so jfs Back to the presentation jfs The point is, intrusion detection and security audits don't differ that much. You can do ID just by constantly monitoring what happens in the system and checking against your policy, you do an audit when you just do it once jfs Now you get to decide which way you want the presentation to head to jfs (I warned that I didn't have a strict guideline) jfs I can talk about Tiger's history, and how I've become upstream maintainer and how the project (overall) should evolve jfs Or I can talk about Tiger's (current) design and architecture, how to write modules, drawbacks, etc.. jfs Please (those not asleep): let's make a quick poll at #qc (answers can be 'evolution' or 'design') jfs (I'm going to give a minute for all to answer the poll, also for the translators) jfs (it's tied for the moment :) jfs ok jfs poll ended jfs let me count the votes :) jfs ok, evolution 7, design 9 (if I counted correctly). That means there are over 120 people sleeping :) jfs I'm going to go for the desing stuff first, and then go and talk about Tiger's evolution jfs (just so everybody is happy) jfs Ok. I said Tiger is multip-plaform, modular and _free_ jfs Of course the free is because it is provided under a GPL license jfs So anyone can use it (for whatever purpose) as long as source is provided, patches are contributed, etc. You know the drill. jfs It's multiplatform because Tiger is not dependant on any special tool. jfs It's coded in plain shell (surprise!) using other POSIX tools jfs so it should run in pretty much every flavor of UNIX available jfs (and even in Windows, if you install the POSIX utilities, but haven't tested it) jfs So, it's plain SH + AWK + SED + other UNIX tools jfs You can browse the CVS sources to confirm this: http://savannah.nongnu.org/cgi-bin/viewcvs/tiger/tiger/ jfs There are just a few tools that need to be compiled in the system that is going to be run jfs (those are written in C) jfs http://savannah.nongnu.org/cgi-bin/viewcvs/tiger/tiger/c/ jfs That's what makes it multiplatform jfs Belive me, even installing perl on some platforms might be a pain. jfs and it's modular because every security test is written in it's own module jfs There are two ways to run any given module, either run it through 'tiger' (which will run all the configured modules), or run it independently jfs The intrusion detection function is, in fact, obtained by running some of the modules at specified time intervals and comparing the results between runs jfs The nice thing about this modularity is that it's pretty simple to take a given module you want and run it without needing all the other Tiger stuff jfs You just need to have the configuration files that make Tiger aware of what tools (or configuration files) are available in your system and how they need to be called jfs That's why you will see in the Tiger sources the following structure: jfs systems/ jfs |-- AIX jfs | |-- 3 jfs | |-- 4 jfs |-- HPUX jfs |-- IRIX jfs | |-- 4 jfs | |-- 5 jfs | |-- 6 jfs |-- Linux jfs | |-- 0 jfs | |-- 1 jfs | |-- 2 jfs |-- SunOS jfs | |-- 4 jfs | |-- 5 jfs .... jfs those are the specific configuration files for each system Tiger knows of jfs well, they are located in those directories. So files for Solaris 8 (SunOS 5.8) are provided undersystems/SunOS/5/ jfs (sorry) under systems/SunOS/5/ jfs Tiger is designed in such a way that it will determine which OS you are running (operating system, revision, and architecture) jfs and will use the configuration files available under $OS/$REV/$ARCH, or $OS/$REV/ or $OS or the general ones (if none is available) jfs These configuration files are the one that tell Tiger where SED, AWK, LS, HEAD, CAT... are located jfs (since the location of these tools vary amongst different UNIX systems, as do the commnad line arguments, the location of configuration files, etc...) jfs so, each module first configures itself (. $basedir/config and $BASEDIR/initdefs) and then determines if it has all the tools it needs jfs Sample (check_rhosts): haveallcmds AWK CAT EXPR GEN_PASSWD_SETS JOIN LS RM SED || exit 1 jfs The module then calls $AWK (and not '/usr/bin/awk' or '/bin/awk') which must be properly configured jfs How are the modules run? jfs As I said previously: jfs - through a cron job jfs (tigercron, to attempt to do intrusion detection) jfs - or through the main tool: 'tiger' jfs which will run all the modules defined in the the 'tigerrc' configuration file jfs (this configuration file also hols some configuration which can be used to adjust the behaviour of some modules) jfs How do I implement my security policy in Tiger? jfs - determine which modules are appropiate and enable them jfs - configure the modules properly (they might have some variables which change the behaviour, sample: users that will not be checked since they are considered 'administrative' users) jfs - create your own modules (for things Tiger does not do) jfs Some modules cannot be tweaked to not report things they consider a security issue. And that's where the baseline reports come in. jfs You can run tiger and read the report. It might say you have some security issues you don't consider such. jfs You take those security warnings and add them to a baseline (a file per module) jfs Next time the security check (through the module) is run, those warnings will _not_ show up. jfs That's what util/difflogs does (when called by tigercron) jfs Any questions up to here? jfs Anyone= jfs Anyone? jfs <sarnold> jfs: what prevents an intruder from just updating the baseline file to prevent checks from being run? jfs first off, changing the baseline will not prevent checks from being run jfs changing the cron server will jfs changing the baseline might prevent tiger from reporting some security issues when it's run jfs I will get (at the end of the presentation) to some of the pros/cons of Tiger and you might understand it further then. jfs The main problem is: ID in user-level space (not kernel level) can be tampered with. The only protection is the system's protection (permissions, MAC, etc..) jfs Another question: <amd> how to the tiger reports look like? jfs Answere: you have two flavors: plain text report and HTML report jfs the plain text is not very nice: jfs (sample) jfs Security scripts *** 2.2.4-20, 2002.0903.1138 *** jfs sáb abr 20 11:21:53 CEST 2002 jfs 11:21> Beginning security report for jfernandezp.germinus.com (i686 Linux 2.4.17-686). jfs # Performing check of passwd files... jfs --WARN-- [pass006w] Integrity of password files questionable (pwck -r). jfs --WARN-- [pass007w] Password control PASS_MIN_LEN missing from jfs /etc/login.defs. jfs # Performing check of group files... jfs (...) jfs There are errors (ERR), warnings (WARN) and information notices (INFO) jfs (BTW tarzeau posted another example at www.linuks.mine.nu/people/amd/tiger.txt) jfs (That's a sample of a diff report BTW, which is part of the mails sent to root for ID) jfs any more questions on the design? jfs Even if you have not understood the design completely I recommend you to download/browse the CVS sources. jfs (let's give some time for the translators in case people following the translated channels want to make questions too) jfs <tarzeau> jfs: have you tried tiger on the Hurd too yet? or on some bsd's? jfs <tarzeau> i've tried it on solaris, works there nice as well jfs Simple question: I have not tried it on the Hurd or on some BSDs. jfs That's on my TODO list. jfs As you will see further on I would like Tiger to be used more by both Linux distributions and BSD distributions. jfs In any case, testing on other platforms (besides Linux) has helped weed out some programming mistakes that were hidden in the code. jfs And I do appreciate people testing the tool in whatever Unix system they want to test in. jfs (just make sure you are using the latest version since some people have tested 2.2.4 which is not really in proper shape) jfs I will keep on talking about the evolution of Tiger jfs (if people don't mind me talking this much : jfs :) jfs Ok. Some history first jfs Tiger started as a set of security scripts to scan a system looking for security issues jfs it was started in 1993 by Douglas Lee Schales, David K. Hess, David R. Safford jfs at the CIS network group of the Texas A&M university jfs (that's why it's part of the TAMU security tools: TAMU = Texas A&M University) jfs http://www.net.tamu.edu/network/tools/tiger.html jfs it was written around the same time that Cops, SATAN and ISS were jfs (IIRC) jfs it was maintained for quite some time by the people at TAMU jfs but, eventually, and after 2.2.4 was released (around 1994) jfs work on Tiger was reduced to update the signature set jfs the people at Advanced Research Corporation (arc) jfs forked a version of Tiger which they called TARA (http://www-arc.com/tara/) jfs Which they are still updating (I looked today and they have published a 3.0.3 version, based, I think, on the Tiger 3.0 release) jfs I started working with Tiger slightly over a year ago jfs I was looking for a host-based IDS tool for Debian, but didn't find much (besides the file integrity and logcheckers already available) jfs so, I packaged tiger-2.2.4 on august 2001 and sent it to Debian's upload queue jfs Besides fixing bugs, I added some (debian-specific) checks jfs Since it was getting popular (in Debian) I did get a number of bug reports, and made more than 17 patch releases until december jfs Then I thought it would be nice to integrate Tara's work into Debian's tiger jfs and I did jfs And then, Bryan Gartner (from HP) sent a mail to the TAMU team, ARSC and me asking if we could all merge (he had also done some work on Tiger) jfs So, after some integration and testing I released 2.2.4p2-1 which was the Debian package that provided (most of) the TARA changes as well as Bryan's jfs this was done april this year jfs Since it was obvious that there were different people interested and we could all work in a common codebase I tried to create a place were the Tiger could evolve jfs I selected savannah: http://savannah.nongnu.org/projects/tiger/ jfs And, after some more integration, I released (in june) the 3.0 version jfs which integrated all the forks and provided a common source code base with which to start working jfs So far, the mailing lists (developer's and user's) are not very active but some users have reported their attempts at using Tiger in HP-UX, Solaris and Compaq Tru64 jfs And I've mainly done bug fixes for 3.1 (release the day before my birthday) jfs Where do I want tiger to get to? jfs I want Tiger to be able to check all the stuff that Bastille tries to fix (since Bastille cannot audit the local system) jfs And I want to update all the signatures (and systems) which are rather out of date (I recently updated HP-UX and have yet to update Solaris) jfs I didn't comment on signatures BTW jfs Signatures are MD5 hashes stored on Tiger which are taken from out-of-the-box OS (installed or patched) jfs Tiger will try to check if there is a trojan in the system based on this signatures. This is not exactly file integrity testing (what tripwire, aide, integrit, et al do) but similar. jfs Once this is done I intend to fix some of the design issues of Tiger (cron/mail dependence) which can be exploited to attack when running in host-IDS mode jfs (providing a daemon and a modular way to send IDS alerts, which should be able to use mail/snmp/syslog...) jfs You can see some of this pending tasks at http://savannah.nongnu.org/pm/?group=tiger jfs so if you feel like helping. Step up! jfs Of course, there is a tiger-users mailing list and a tiger-developers mailing list jfs http://savannah.nongnu.org/mail/?group=tiger jfs If you are using tiger, or think you can help improve it _please_ suscribe to them. There are really low-volume (at the moment) and are the best way to ask questions on tiger (since both ARSC's team, HP's team and me are suscribed) jfs Let me do some final remarks then jfs I could title this Pros/Cons on using Tiger jfs Pros: jfs the modular design allows anyone to add his own modules (it's fairly easy) and modify Tiger to it's needs jfs the multi-platform design allows Tiger to be used as a single tool for HID in a heterogeneous environment jfs This doesn't mean it's the silver bullet, and you'll want to add more things to your HID solution (more on this later) jfs the fact that it's GPLd (and thus free) permits you to look at the code and _learn_ about how security checks can be implemented jfs You can also sell an IT service based on Tiger (that's what ARSC does BTW) jfs And that's great! jfs (as long as you contribute your fixes/patches to the common codebase) jfs Now, Cons: jfs - the fact that it runs in 'user space' makes it susceptible to attacks jfs (it depends on cron to run as an HID, it depends on mail to report, files are used to determine the baseline, etc...) jfs - Tiger does not yet offer a complete HID solution, it has not been maintainer for a while and there's a lot of stuff it could do in the HID area that it simply does not do yet (integrity checking, log analysis, etc..) jfs - Also, because it's a user space tool it can be "fooled" if the server is compromised (think of rootkits) jfs However, i forgot of one Pro: jfs since it's not system-dependant, there are some security checks which can be done offline (through a filesystem shared over the network) in a host that is not the one that's being audited jfs Tiger could be improved in many areas (and people need to volunteer to help in these). jfs For example, proper integration with other available HID open source tools (such as tripwire, integrit, aide, and samhain) would be great. jfs As would be integration with log-analysis tools (logcheck, log-analyss and snorter) jfs In any case, if you are very paranoid, you might be interested in HID solutions which are kernel-based (and thus are not multi-platform) jfs such as LIDS or Snare jfs (for Linux) jfs or systrace (for BSD and now linux also) jfs Now. That's finishes what I wanted to talk about in this presentation jfs Any question on the subject can be sent now :) fernand0 plas plas plas plas plas plas plas plas plas plas MJesus clap clap clap clap clap clap clap clap clap clap Arador pals pals plas pla splas MJesus clap clap clap clap clap clap clap clap clap clap MJesus clap clap clap clap clap clap clap clap clap clap fernand0 plas plas plas plas plas plas plas plas plas plas fernand0 plas plas plas plas plas plas plas plas plas plas MJesus clap clap clap clap clap clap clap clap clap clap sarnold thanks jfs :) thanks also arador and ricardo for translating :) MJesus clap clap clap clap clap clap clap clap clap clap MJesus clap clap clap clap clap clap clap clap clap clap MJesus clap clap clap clap clap clap clap clap clap clap bart clap sarnold clap clap clap clap clap :) raul clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap Arador plas plas plas plas plas plas plas plas plas plas plas sarnold clap clap clap clap clap :) raul clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap Arador plas plas plas plas plas plas plas plas plas plas plas sarnold clap clap clap clap clap :) Arador plas plas plas plas plas plas plas plas plas plas plas raul clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap sarnold clap clap clap clap clap :) Arador plas plas plas plas plas plas plas plas plas plas plas raul clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap raul clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap Arador plas plas plas plas plas plas plas plas plas plas plas bart clap clap raul clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap raul clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap MJesus clap clap clap clap clap clap clap clap clap clap ismak plas plas plas plas plas plas plas plas plas plas MJesus bravo bravo bravo ismak plas plas plas plas plas plas plas plas plas plas ismak plas plas plas plas plas plas plas plas plas plas ismak plas plas plas plas plas plas plas plas plas plas raul clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap raul clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap psypete clap MJesus bravo bravo bravo fernand0 plas plas plas plas plas plas plas plas plas plas MJesus bravo bravo bravo raul clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap amd clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap raul clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap amd clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap raul clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap ismak clap clap clap clap clap clap clap clap clap clap clap clapclap clap clap clap clap clap clap clap clap clap clap clap raul clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap Lovechild CLAP CLAP CLAP !!! ismak clap clap clap clap clap clap clap clap clap clap clap clap jose_n plas plas plas plas plasplas 100x Arador (silbidos) raul clap clap clap clap clap clap clap clap clap clap clap clap clap clap raul clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap raul clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap raul clap clap clap clap clap clap clap clap clap clap clap clap clap clap MJesus bravo bravo bravo raul clap clap clap clap clap clap clap clap clap clap clap clap clap clap clap MJesus bravo bravo bravo MJesus bravo bravo bravo psypete clap sarnold jfs: thanks :) jfs sarnold: you are welcome :) amd nice ;) horacio bravo ! ! jose_n jfs++ horacio clap clap clap clap clap horacio clap clap clap clap clap horacio clap clap clap clap clap horacio clap clap clap clap clap bart jfs: happy hacking AAA Bravo bravo bravo AAA Bravo bravo bravo AAA Bravo bravo bravo AAA Bravo bravo bravo jfs bart: I was on it during the conference :) Ducky_Pha hi xtingray Ducky_Pha how are you bart jfs: and nice work, thx Generated by irclog2html.pl 2.1 by Jeff Waugh - find it at freshmeat.net!