OSSEC HIDS, Host Based Intrusion Detection System Aurora Mazzone, INFN Sezione di Torino Parte Seconda

Scelta del tipo di installazione: server, agent o local?

Installazione E-mail notification: invio di e-mail per segnalare eventi rilevanti, importanti o gravi.

Installazione Integrity check daemon: controllo su file di configurazione ed eseguibili.

Rootkit detection engine: ricerca di rootkit. Installazione Rootkit detection engine: ricerca di rootkit.

Active response: risposta ad un evento. Installazione Active response: risposta ad un evento.

File di configurazione /var/ossec/etc/ossec.conf: opzioni globali, completamente personalizzabili. /var/ossec/etc/internal_options.conf: opzioni chiave per il funzionamento generale, da modificare solo in casi particolari.

ossec.conf: e-mail <global> Configurazione e-mail (sezione “global”): <global> <email_notification>yes</email_notification> <email_to>root@localhost</email_to> <smtp_server>127.0.0.1</smtp_server> <email_from>ossecm@localhost.localdomain</email_from> <email_maxperhour>70</email_maxperhour> </global>

ossec.conf: e-mail <email_alerts> Configurazione e-mail granulare (sezione “email_alerts”): <email_to> <event_location> <group> <level> <rule_id> <do_not_delay /> <do_not_group /> <format>

ossec.conf: e-mail <email_alerts> Configurazione e-mail granulare (sezione “email_alerts”): <email_alerts> <email_to>pluto@localhost</email_to> <level>12</level> <do_not_group/> <do_not_delay/> </email_alerts>

ossec.conf: e-mail <email_alerts> Configurazione e-mail granulare (sezione “email_alerts”): <email_alerts> <email_to>pippo@localhost</email_to> <event_location>vm-ossec-c|vm-ossec-d|192.168.0.0/24</event_location> <do_not_group/> </email_alerts>

ossec.conf: e-mail <email_alerts> Configurazione e-mail granulare (sezione “email_alerts”): <email_alerts> <email_to>anna@localhost</email_to> <group>syscheck</group> <format>sms</format> </email_alerts>

ossec.conf: e-mail <email_alerts> Configurazione e-mail granulare (sezione “email_alerts”): <email_alerts> <email_to>admin@localhost</email_to> <rule_id>40111</rule_id> <format>sms</format> </email_alerts>

ossec.conf: e-mail <alerts> Configurazione e-mail (sezione “alerts”): <alerts> <log_alert_level>1</log_alert_level> <email_alert_level>7</email_alert_level> </alerts>

ossec.conf: e-mail <alerts> Level 0: Ignored, no action taken. Scanned before all others (grouping). Level 2: System low priority notification and “catch all” rule with BAD_WORD. Level 3: Successful/authorized events. Level 4: System low priority errors. Level 5: User generated error (missed passwords, denied actions, etc.). Level 7: Syscheck. Level 8: First time seen events. Stats alerts.

ossec.conf: e-mail <alerts> Level 10: Multiple user generated errors: multiple bad passwords, multiple failed logins. Level 12: High importance event: error or warning messages from the system, kernel, etc. or something that might indicate an attack against a specific application. Level 13: Unusual error. Common attack patterns. Level 14: High importance security event: correlation of multiple attack rules. Level 15: Attack successful.

internal_options.conf: e-mail grouping Configurazione e-mail: # Maild grouping (0=disabled, 1=enabled)‏ # Groups alerts within the same e-mail. maild.groupping=1

“Stats” Numero di eventi generati: per ogni ora della giornata per ogni giorno della settimana totali

ossec.conf: “stats” <global> <stats>8</stats> </global> Ogni variazione significativa del numero di eventi segnalati in un certo periodo di tempo genera un alert di livello 8.

Internal_options.conf: “stats” # Analysisd stats maximum diff. analysisd.stats_maxdiff=25000 # Analysisd stats minimum diff. analysisd.stats_mindiff=250 # Analysisd stats percentage (how much to differ from average)‏ analysisd.stats_percent_diff=30

ossec.conf: file di log da monitorare <localfile>‏ <log_format>syslog</log_format> <location>/var/log/messages</location> </localfile> Formati supportati nativamente: syslog, snort-full, snort-fast, squid, iis, eventlog, nmapg (greppable nmap formatted logs), mysql_log, postgresql_log, apache.

ossec.conf: file integrity check <syscheck>‏ Opzioni <syscheck>: <frequency> <scan_day>* <scan_time> <scan_on_start> <directories> <ignore> <auto_ignore> <alert_new_files> <windows_registry> <registry_ignore>

ossec.conf: file integrity check <syscheck> Configurazione <syscheck>: day/time <syscheck> <scan_day>monday</scan_day>* <scan_time>8 pm</scan_time> <scan_on_start>no</scan_on_start> <auto_ignore>no</auto_ignore> [...] </syscheck>

ossec.conf: file integrity check <syscheck> Configurazione <syscheck>: frequency <syscheck> <frequency>7200</frequency> <auto_ignore>no</auto_ignore> <alert_new_files>yes</alert_new_files> [...] </syscheck>

ossec.conf: file integrity check <syscheck> Configurazione <syscheck>: <directories> <syscheck> <directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories> <directories check_all="yes">/bin,/sbin</directories> <windows_registry>HKEY_LOCAL_MACHINE\Software</windows_registry> [...] </syscheck>

ossec.conf: file integrity check <syscheck>‏ Configurazione <syscheck>: <directories> attributes check_all check_sum check_size check_owner check_group check_perm

ossec.conf: file integrity check <syscheck> Configurazione <syscheck>: <ignore> <syscheck> <ignore>/etc/mtab</ignore> <ignore>C:\WINDOWS/System32/LogFiles</ignore> <registry_ignore>HKEY_CURRENT_USER</registry_ignore> [...] </syscheck> I file ignorati sul server vengono ignorati anche su tutti gli agent.

internal_options.conf: file integrity check # Syscheck checking/usage speed. To avoid large cpu/memory usage, you can specify how much to sleep after generating the checksum of X files. The default is to sleep 2 seconds after reading 15 files. syscheck.sleep=2 syscheck.sleep_after=15

ossec.conf: rootkit detection engine and policy enforcement <rootcheck> Opzioni <rootcheck>: <disabled> <frequency> <rootkit_files> <rootkit_trojans> <system_audit> <windows_audit> <windows_apps> <windows_malware>

ossec.conf: rootkit detection engine and policy enforcement <rootcheck> Opzioni <rootcheck>: <rootkit_files>: application level rootkit signatures file <rootkit_trojans>: application level trojan signatures file

ossec.conf: rootkit detection engine and policy enforcement <rootcheck>‏ Opzioni <rootcheck>: policy enforcement <system_audit> <windows_audit> <windows_apps> <windows_malware> Controllo su: f: file o directory (e loro contenuto)‏ r: registry key p: processo

Tool Principali tool di gestione (versione 1.6): /var/ossec/bin ossec-control syscheck_control clear_stats rootcheck_control agent_control list_agents syscheck_update manage_agents

Demoni Principali demoni (versione 1.6): /var/ossec/bin ossec-remoted ossec-agentd ossec-execd ossec-syscheckd* ossec-analysisd ossec-logcollector* ossec-maild ossec-monitord * girano come root