Using Nagios for Intrusion detection Miguel Cárdenas Montes Elio Pérez Calle Francisco Javier Rodríguez Calonge

Overview ●The construction of GRID will require an efective system of security. ●To avoid that GRID is used by an unauthorized person and to prevent that the system is used to realize attacks against other systems. ●In this context, the Intrusion Detection System acquires special importance.

Aims ●Our aim has been the study, evalutation and implementation of a Host Intrusion Detection System based on Open Source software. ●A system based on technologies such as Nagios, SNMP, Tripwire and Chkrootkit has been implanted in the CIEMAT, in the University of Barcelona and the University Autonoma of Madrid.

Nagios Characteristics ●Nagios is a system designed for the monitoring of computers, detection of failures in services and sending notifications out to administrative contacts. ●Nagios is not specifically an IDS. ●Nagios has a modular design with a web interface, a set of plugins, support for consultations on the SNMP protocol, and ability to execute scripts on remote hosts using SSH protocol.

Nagios: Threats ●As soon as an intruder gains access to a system across a vulnerability, he frequently tries to conceal his presence and to create a privileged access, with actions like: – create a superuser account (uid=0), – create a user with empty password, – capture information using a sniffer, – hide used files in /dev directory.

Nagios: Use of scripts ●Four scripts have been created for monitoring: – how many users there are with uid=0, – users without password, – interface in promiscuous mode, – regular files hidden in the directory /dev.

What does not cover? ●A knowledgeable malicious user will try to modify certain system binaries to conceal his presence. ●Some of those binaries will be: ifconfig, netstat, ps, ls, top... ●In this case our scripts are not useful. Why?

A knowledgeable malicious user ●The modified ps will conceal the execution of the sniffer installed by intruder. ●In the case of ifconfig, it will hide the promiscuous mode of the NIC. ●The altered ls will not show the directory where the intruder has installed his files.

Tripwire. What is it? ●Tripwire is an intrusion detection tool able to detect and pinpoint changes, such as: – File additions, deletes and modifications. – File permissions and properties. – Inode number and number of links – User id and group id of owner. – Inode and file creation and modification timestamp. – Hash checking: RSA, MD5, MD4, MD2,... – Device number to which an inode points.

DB/reports. How Tripwire works? ●Tripwire establishes a ciphered database of monitored files, to detect these changes. ●Periodically the consistency is checked against the reference database. ●A report is created with the most relevant information.

Integrity of Tripwire database ●A checksum is executed and the hash is inserted in the MIB tree to test the integrity of Tripwire database in the remote nodes ●A SNMP request is used to check the hash of the database against resident information in the central platform.

Use of Tripwire ●Our aim: analyze the consistency of a set of system binaries. ●These binaries have been chosen because they are the principal targets of intruders. ●The chosen binaries are: ls, mkdir, ps, top, login, mount, netstat, su, ifconfig, syslogd, find, killall, passwd, rpc.mountd, rpc.nfsd, tcpd, xinetd.

What does not cover? ●With the popularization of the automated tools of assaults, gaining privileged accesses and concealing them has become an extremely simple task. ●After the phase of exploration and obtaining a privileged access, the intruder centres on the installation of a rootkit to conceal his presence.

Chkrootkit. What is it? ●Chkrootkit is a command line tool that detects the presence of rootkits. – Checking the promiscuous mode ni NIC. – Differences between ps and /proc information. – Elimination of entries in the wtmp file. – Checking the fingerprints of known rootkits.

Use of Chkrootkit ●In the integration of Chkrootkit with Nagios, a script has been created, and is executed by snmpd. ●Information is inserted in MIB tree. ●A SNMP request is used to gather the information.

Conclusions ●The implantation of a HIDS formed by several GNU technologies is possible. ●In the implemented facilities at Ciemat, University of Barcelona and University Autonoma of Madrid we monitor to detail the computing nodes, being capable of detecting the presence of an intruder from his initial steps.

Nagios snapshot I

Nagios snapshot II