OSSEC HIDS, Host Based Intrusion

Detection System

Aurora Mazzone, INFN Sezione di Torino

Parte Seconda
Installazione

Scelta del tipo di installazione:

server, agent o local?

Installazione

E-mail notification:

invio di e-mail per segnalare eventi rilevanti,

importanti o gravi.
Installazione

Integrity check daemon:

controllo su file di configurazione ed eseguibili.

Installazione

Rootkit detection engine:

ricerca di rootkit.
Installazione

Active response:

risposta ad un evento.
File di configurazione

/var/ossec/etc/ossec.conf:

opzioni globali, completamente personalizzabili.

/var/ossec/etc/internal_options.conf:

opzioni chiave per il funzionamento generale, da

modificare solo in casi particolari.
ossec.conf: e-mail <global>

Configurazione e-mail (sezione “global”):

<global>
<email_notification>yes</email_notification>
<email_to>root@localhost</email_to>
<smtp_server>127.0.0.1</smtp_server>
<email_from>ossecm@localhost.localdomain</email_from>
<email_maxperhour>70</email_maxperhour>
</global>
ossec.conf: e-mail <email_alerts>

Configurazione e-mail granulare (sezione

“email_alerts”):
<email_to>
<event_location>
<group>
<level>
<rule_id>
<do_not_delay />
<do_not_group />
<format>
ossec.conf: e-mail <email_alerts>

Configurazione e-mail granulare (sezione

“email_alerts”):
<email_alerts>
<email_to>pluto@localhost</email_to>
<level>12</level>
<do_not_group/>
<do_not_delay/>
</email_alerts>
ossec.conf: e-mail <email_alerts>

Configurazione e-mail granulare (sezione

“email_alerts”):
<email_alerts>
<email_to>pippo@localhost</email_to>
<event_location>vm-ossec-c|vm-ossec-d|
192.168.0.0/24</event_location>
<do_not_group/>
</email_alerts>
ossec.conf: e-mail <email_alerts>

Configurazione e-mail granulare (sezione

“email_alerts”):
<email_alerts>
<email_to>anna@localhost</email_to>
<group>syscheck</group>
<format>sms</format>
</email_alerts>
ossec.conf: e-mail <email_alerts>

Configurazione e-mail granulare (sezione

“email_alerts”):
<email_alerts>
<email_to>admin@localhost</email_to>
<rule_id>40111</rule_id>
<format>sms</format>
</email_alerts>
ossec.conf: e-mail <alerts>

Configurazione e-mail (sezione “alerts”):

<alerts>
<log_alert_level>1</log_alert_level>
<email_alert_level>7</email_alert_level>
</alerts>
ossec.conf: e-mail <alerts>

Level 0: Ignored, no action taken. Scanned before all others

(grouping).
Level 2: System low priority notification and “catch all”
rule with BAD_WORD.
Level 3: Successful/authorized events.
Level 4: System low priority errors.
Level 5: User generated error (missed passwords, denied
actions, etc.).
Level 7: Syscheck.
Level 8: First time seen events. Stats alerts.
ossec.conf: e-mail <alerts>

Level 10: Multiple user generated errors: multiple bad

passwords, multiple failed logins.
Level 12: High importance event: error or warning
messages from the system, kernel, etc. or something that
might indicate an attack against a specific application.
Level 13: Unusual error. Common attack patterns.
Level 14: High importance security event: correlation of
multiple attack rules.
Level 15: Attack successful.
internal_options.conf: e-mail
grouping

Configurazione e-mail:
# Maild grouping (0=disabled, 1=enabled)
# Groups alerts within the same e-mail.
maild.groupping=1
“Stats”

Numero di eventi generati:


per ogni ora della giornata

per ogni giorno della settimana

totali
ossec.conf: “stats” <global>

<global>
<stats>8</stats>
</global>
Ogni variazione significativa del numero di eventi
segnalati in un certo periodo di tempo genera un
alert di livello 8.
Internal_options.conf: “stats”

# Analysisd stats maximum diff.

analysisd.stats_maxdiff=25000
# Analysisd stats minimum diff.
analysisd.stats_mindiff=250
# Analysisd stats percentage (how much to differ
from average)
analysisd.stats_percent_diff=30
ossec.conf: file di log da
monitorare <localfile>

<localfile>
<log_format>syslog</log_format>
<location>/var/log/messages</location>
</localfile>
Formati supportati nativamente:
syslog, snort-full, snort-fast, squid, iis, eventlog,
nmapg (greppable nmap formatted logs),
mysql_log, postgresql_log, apache.
ossec.conf: file integrity check
<syscheck>
Opzioni <syscheck>:
<frequency>
<scan_day>*
<scan_time>
<scan_on_start>
<directories>
<ignore>
<auto_ignore>
<alert_new_files>
<windows_registry>
<registry_ignore>
ossec.conf: file integrity check
<syscheck>

Configurazione <syscheck>: day/time

<syscheck>
<scan_day>monday</scan_day>*
<scan_time>8 pm</scan_time>
<scan_on_start>no</scan_on_start>
<auto_ignore>no</auto_ignore>
[...]
</syscheck>
ossec.conf: file integrity check
<syscheck>

Configurazione <syscheck>: frequency

<syscheck>
<frequency>7200</frequency>
<auto_ignore>no</auto_ignore>
<alert_new_files>yes</alert_new_files>
[...]
</syscheck>
 ossec.conf: file integrity check
<syscheck>

Configurazione <syscheck>: <directories>

<syscheck>
<directories
check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
<directories check_all="yes">/bin,/sbin</directories>
<windows_registry>HKEY_LOCAL_MACHINE\
Software</windows_registry>
[...]
</syscheck>
ossec.conf: file integrity check
<syscheck>

Configurazione <syscheck>: <directories>

attributes

check_all

check_sum

check_size

check_owner

check_group

check_perm
 ossec.conf: file integrity check
<syscheck>

Configurazione <syscheck>: <ignore>

<syscheck>
<ignore>/etc/mtab</ignore> <ignore>C:\
WINDOWS/System32/LogFiles</ignore>
<registry_ignore>HKEY_CURRENT_USER</registry
_ignore>
[...]
</syscheck>
I file ignorati sul server vengono ignorati anche su tutti
gli agent.
internal_options.conf: file integrity
check

# Syscheck checking/usage speed. To avoid large

cpu/memory usage, you can specify how much to
sleep after generating the checksum of X files. The
default is to sleep 2 seconds after reading 15 files.
syscheck.sleep=2
syscheck.sleep_after=15
ossec.conf: rootkit detection
engine and policy enforcement
<rootcheck>

Opzioni <rootcheck>:
<disabled>
<frequency>
<rootkit_files>
<rootkit_trojans>
<system_audit>
<windows_audit>
<windows_apps>
<windows_malware>
ossec.conf: rootkit detection
engine and policy enforcement
<rootcheck>

Opzioni <rootcheck>:
<rootkit_files>: application level rootkit signatures
file

<rootkit_trojans>: application level trojan

signatures file
ossec.conf: rootkit detection
engine and policy enforcement
<rootcheck>
Opzioni <rootcheck>: policy enforcement
<system_audit>
<windows_audit>
<windows_apps>
<windows_malware>
Controllo su:
f: file o directory (e loro contenuto)
r: registry key
p: processo
Tool

Principali tool di gestione (versione 1.6):

/var/ossec/bin
ossec-control
syscheck_control
clear_stats
rootcheck_control
agent_control
list_agents
syscheck_update
manage_agents
Demoni
Principali demoni (versione 1.6):
/var/ossec/bin
ossec-remoted
ossec-agentd
ossec-execd
ossec-syscheckd*
ossec-analysisd
ossec-logcollector*
ossec-maild
ossec-monitord
* girano come root