Subject: Re: [vserver] Process monitoring for host based intrusion detection
From: "Bendtsen, Jon" <Jon.Bendtsen@laerdal.dk>
Date: Mon, 6 Oct 2014 11:29:52 +0000

 Mon, 6 Oct 2014 11:29:52 +0000
I think it sounds good.


JonB


On 03/10/2014, at 23.30, Jacques Gélinas <jacques@croesus.com> wrote:

> Hello!
> 
> This is to announce a new project called for-rest. It is an intrusion detection system
that works on a host runing vservers. It is using the bsd process accounting in the
kernel with a little enhancement. Using it, it can build a set of process trees (a little
like the pstree command). 
> 
> Interestingly the bsd process accounting is already PID namespace aware. So you end
up with one accounting file per vserver. Each file is tracking all processes in a vserver.
Normally process accounting is done at process end time. With the patch, an accounting
record is produced at process creation time (fork()) and each time the process execs
(thus changes name). Using this, it is possible to build the complete execution tree
up to PID 1 (init) for every processes.
> 
> All execution trees contains, for each process, the UID,GID and exit code. So you
can really tells process trees apart.
> 
> you can find more documentation at http://www.solucorp.qc.ca/projects/forrest, including
the patch and a package making use
> of that to perform intrusion detection.
> 
> It works like this
> 
> 1-You start your vserver with process accounting on. To get this working, you need
>    a) to have vservers running with PID namespace
>    b) to execute the accton command (standard accton command) in the PID namespace,
>        but before it changes its root (file system namespace or chroot)
>        so the resulting log file is out of view from the vserver itself.
>    c) to execute accton before the capabilities are dropped. To turn process accounting
off and on, you
>        need CAP SYS ACCT. Normally a vserver does not have (and should not have) this
capability.
> 
>    If done properly, you end up with process accounting for a vserver and a vserver
can't do anything about it.
> 
> 2-You let your vserver run for a while. At this point, you should have a good sample
of everything it is doing. You
>    may want to let it run for a day so daily crons have a chance to run.
> 
> 3-Using the supplied script forrest-init, you collect all different process trees
in the sample. This becomes your
>    baseline for monitoring.
> 
> You add the monitoring tool in the host cron every 5 minutes and whenever something
new occurs in your vservers, you will know.
> 
> Comments are welcome.
> 
> Jacques Gélinas
> Vice-président technologies
> Croesus Finansoft inc.
> 600, boulevard Armand-Frappier, bureau 200
> Laval (Québec) H7V 4B4 
> Canada
> jacques@croesus.com
> 450-662-6101 poste 150
> 
> 
> 
> 
>                                                                          
> 
> Avis : Ce message ne vise uniquement que son destinataire et peut contenir de l’information
confidentielle.  Son utilisation/divulgation non-autorisée est interdite.  Si reçu par
erreur, veuillez en aviser l’expéditeur et supprimer ce message et toute pièce jointe
de votre système.
> 
> Notice:  This  message  is  intended  to  its  recipient  only  and  may  contain
 privileged  information.   Unauthorized  use/disclosure is  prohibited.    If  received
 by  error,  please  notify the  sender  and  delete this message and any attachments
from your system.