Re: [vserver] Process monitoring for host based intrusion detection

From: Bendtsen, Jon <Jon.Bendtsen_at_laerdal.dk>
Date: Mon 06 Oct 2014 - 12:29:52 BST
Message-ID: <5E0BCD71-6485-4E0D-99F8-36F04DAEC4EE@laerdal.dk>

I think it sounds good.

JonB

On 03/10/2014, at 23.30, Jacques Gélinas <jacques@croesus.com> wrote:

> Hello!
>
> This is to announce a new project called for-rest. It is an intrusion detection system that works on a host runing vservers. It is using the bsd process accounting in the kernel with a little enhancement. Using it, it can build a set of process trees (a little like the pstree command).
>
> Interestingly the bsd process accounting is already PID namespace aware. So you end up with one accounting file per vserver. Each file is tracking all processes in a vserver. Normally process accounting is done at process end time. With the patch, an accounting record is produced at process creation time (fork()) and each time the process execs (thus changes name). Using this, it is possible to build the complete execution tree up to PID 1 (init) for every processes.
>
> All execution trees contains, for each process, the UID,GID and exit code. So you can really tells process trees apart.
>
> you can find more documentation at http://www.solucorp.qc.ca/projects/forrest, including the patch and a package making use
> of that to perform intrusion detection.
>
> It works like this
>
> 1-You start your vserver with process accounting on. To get this working, you need
> a) to have vservers running with PID namespace
> b) to execute the accton command (standard accton command) in the PID namespace,
> but before it changes its root (file system namespace or chroot)
> so the resulting log file is out of view from the vserver itself.
> c) to execute accton before the capabilities are dropped. To turn process accounting off and on, you
> need CAP_SYS_ACCT. Normally a vserver does not have (and should not have) this capability.
>
> If done properly, you end up with process accounting for a vserver and a vserver can't do anything about it.
>
> 2-You let your vserver run for a while. At this point, you should have a good sample of everything it is doing. You
> may want to let it run for a day so daily crons have a chance to run.
>
> 3-Using the supplied script forrest-init, you collect all different process trees in the sample. This becomes your
> baseline for monitoring.
>
> You add the monitoring tool in the host cron every 5 minutes and whenever something new occurs in your vservers, you will know.
>
> Comments are welcome.
>
> Jacques Gélinas
> Vice-président technologies
> Croesus Finansoft inc.
> 600, boulevard Armand-Frappier, bureau 200
> Laval (Québec) H7V 4B4
> Canada
> jacques@croesus.com
> 450-662-6101 poste 150
>
>
>
>
> _________________________________________________________________________
>
> Avis : Ce message ne vise uniquement que son destinataire et peut contenir de l’information confidentielle. Son utilisation/divulgation non-autorisée est interdite. Si reçu par erreur, veuillez en aviser l’expéditeur et supprimer ce message et toute pièce jointe de votre système.
>
> Notice: This message is intended to its recipient only and may contain privileged information. Unauthorized use/disclosure is prohibited. If received by error, please notify the sender and delete this message and any attachments from your system.
Received on Mon Oct 6 12:30:00 2014

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Mon 06 Oct 2014 - 12:30:00 BST by hypermail 2.1.8