AW: [vserver] Process monitoring for host based intrusion detection

From: Fiedler Roman <Roman.Fiedler_at_ait.ac.at>
Date: Mon 06 Oct 2014 - 13:06:00 BST
Message-ID: <2ECE9D9EEF1F524185270138AE23265947D080A5@S0MSMAIL112.arc.local>

Hello,

> Von: Jacques Gélinas [mailto:jacques@croesus.com]
>
> Hello!
>
> This is to announce a new project called for-rest. It is an intrusion detection
> system that works on a host runing vservers. It is using the bsd process
> accounting in the kernel with a little enhancement. Using it, it can build a set
> of process trees (a little like the pstree command).
>
> Interestingly the bsd process accounting is already PID namespace aware. So
> you end up with one accounting file per vserver. Each file is tracking all
> processes in a vserver. Normally process accounting is done at process end
> time. With the patch, an accounting record is produced at process creation
> time (fork()) and each time the process execs (thus changes name). Using this,
> it is possible to build the complete execution tree up to PID 1 (init) for every
> processes.

OK, this is a simple and lean approach. What was the rationale to not fixing the audit subsystem, like e.g. done with [1], which would be very generic (should also work for other pid-ns cases, e.g. lxc or google chrome launcher if I remember correctly). Apart from that, audit logs can be used by other SIEM/IDS systems, some of those are already using audit data as input source, e.g. searching for "Intrusion detection system linux syscall" (and subtracting the entries for syscall-table-modification-checkers)

> .....

Roman

[1] https://www.redhat.com/archives/linux-audit/2013-August/msg00021.html

Received on Mon Oct 6 13:06:08 2014
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Mon 06 Oct 2014 - 13:06:08 BST by hypermail 2.1.8