[vserver] Process monitoring for host based intrusion detection

Hello!

This is to announce a new project called for-rest. It is an intrusion
detection system that works on a host runing vservers. It is using the bsd
process accounting in the kernel with a little enhancement. Using it, it
can build a set of process trees (a little like the pstree command).

Interestingly the bsd process accounting is already PID namespace aware. So
you end up with one accounting file per vserver. Each file is tracking all
processes in a vserver. Normally process accounting is done at process end
time. With the patch, an accounting record is produced at process creation
time (fork()) and each time the process execs (thus changes name). Using
this, it is possible to build the complete execution tree up to PID 1
(init) for every processes.

All execution trees contains, for each process, the UID,GID and exit code.
So you can really tells process trees apart.

you can find more documentation at
http://www.solucorp.qc.ca/projects/forrest, including the patch and a
package making use
of that to perform intrusion detection.

It works like this

1-You start your vserver with process accounting on. To get this working,
you need
   a) to have vservers running with PID namespace
   b) to execute the accton command (standard accton command) in the PID
namespace,
       but before it changes its root (file system namespace or chroot)
       so the resulting log file is out of view from the vserver itself.
   c) to execute accton before the capabilities are dropped. To turn
process accounting off and on, you
       need CAP_SYS_ACCT. Normally a vserver does not have (and should not
have) this capability.

   If done properly, you end up with process accounting for a vserver and a
vserver can't do anything about it.

2-You let your vserver run for a while. At this point, you should have a
good sample of everything it is doing. You
   may want to let it run for a day so daily crons have a chance to run.

3-Using the supplied script forrest-init, you collect all different process
trees in the sample. This becomes your
   baseline for monitoring.

You add the monitoring tool in the host cron every 5 minutes and whenever
something new occurs in your vservers, you will know.

Comments are welcome.

*Jacques Gélinas*
Vice-président technologies
Croesus Finansoft inc.
600, boulevard Armand-Frappier, bureau 200
Laval (Québec) H7V 4B4
Canada
jacques@croesus.com
450-662-6101 poste 150

<http://www.facebook.com/pages/Croesus-Finansoft/345020305606240>
<http://www.linkedin.com/company/croesus-finansoft?trk=hb_tab_compy_id_26141>
<https://twitter.com/CroesusFin>

-- 
_________________________________________________________________________
*Avis *: Ce message ne vise uniquement que son destinataire et peut 
contenir de l’information confidentielle.  Son utilisation/divulgation 
non-autorisée est interdite.  Si reçu par erreur, veuillez en aviser 
l’expéditeur et supprimer ce message et toute pièce jointe de votre système.
*Notice*:  This  message  is  intended  to  its  recipient  only  and  may 
 contain  privileged  information.   Unauthorized  use/disclosure is 
 prohibited.    If  received  by  error,  please  notify the  sender  and 
 delete this message and any attachments from your system.