This is to announce a new project called for-rest. It is an intrusion
detection system that works on a host runing vservers. It is using the bsd
process accounting in the kernel with a little enhancement. Using it, it
can build a set of process trees (a little like the pstree command).
Interestingly the bsd process accounting is already PID namespace aware. So
you end up with one accounting file per vserver. Each file is tracking all
processes in a vserver. Normally process accounting is done at process end
time. With the patch, an accounting record is produced at process creation
time (fork()) and each time the process execs (thus changes name). Using
this, it is possible to build the complete execution tree up to PID 1
(init) for every processes.
All execution trees contains, for each process, the UID,GID and exit code.
So you can really tells process trees apart.
you can find more documentation at
http://www.solucorp.qc.ca/projects/forrest, including the patch and a
package making use
of that to perform intrusion detection.
It works like this
1-You start your vserver with process accounting on. To get this working,
a) to have vservers running with PID namespace
b) to execute the accton command (standard accton command) in the PID
but before it changes its root (file system namespace or chroot)
so the resulting log file is out of view from the vserver itself.
c) to execute accton before the capabilities are dropped. To turn
process accounting off and on, you
need CAP_SYS_ACCT. Normally a vserver does not have (and should not
have) this capability.
If done properly, you end up with process accounting for a vserver and a
vserver can't do anything about it.
2-You let your vserver run for a while. At this point, you should have a
good sample of everything it is doing. You
may want to let it run for a day so daily crons have a chance to run.
3-Using the supplied script forrest-init, you collect all different process
trees in the sample. This becomes your
baseline for monitoring.
You add the monitoring tool in the host cron every 5 minutes and whenever
something new occurs in your vservers, you will know.
Comments are welcome.
Croesus Finansoft inc.
600, boulevard Armand-Frappier, bureau 200
Laval (Québec) H7V 4B4
450-662-6101 poste 150
-- _________________________________________________________________________ *Avis *: Ce message ne vise uniquement que son destinataire et peut contenir de l’information confidentielle. Son utilisation/divulgation non-autorisée est interdite. Si reçu par erreur, veuillez en aviser l’expéditeur et supprimer ce message et toute pièce jointe de votre système. *Notice*: This message is intended to its recipient only and may contain privileged information. Unauthorized use/disclosure is prohibited. If received by error, please notify the sender and delete this message and any attachments from your system.Received on Fri Oct 3 22:30:44 2014