ホスト型IDSの導入2010/06/14 |
| [1] | ホスト型IDS(Intrusion Detection System - 侵入検知システム)のTripwireを導入します。 IDSとは、不正行為を検出するシステムです。ホスト型とは、それをコンピュータに対してしてくれるもので(コンピュータのI/Oパケットを監視)、 それに対してネットワーク型もあります。ネットワーク型ではネットワーク上のパケットを監視します。 |
|
[root@www ~]# yum -y install tripwire [root@www ~]# /usr/sbin/tripwire-setup-keyfiles # 以下のようにパスフレーズを何度か求められるので入力する Enter the site keyfile passphrase: # (1)任意のパスフレーズ入力 Verify the site keyfile passphrase: # 再入力 Enter the local keyfile passphrase: # (2)任意のパスフレーズ入力 Verify the local keyfile passphrase: # 再入力 Please enter your site passphrase: # (1)のパスフレーズで応答 Please enter your site passphrase: # 再び(1)のパスフレーズで応答 [root@www ~]# cd /etc/tripwire [root@www tripwire]# vi twcfg.txt # 9行目：'true'指定でディレクトリにファイルが追加・削除された場合、
そのディレクトリの変更は報告されない LOOSEDIRECTORYCHECKING = true # 12行目：報告レベル最大に変更 REPORTLEVEL = 4 # 暗号署名設定ファイル作成 [root@www tripwire]# twadmin -m F -c tw.cfg -S site.key twcfg.txt Please enter your site passphrase: # (1)のパスフレーズ入力 Wrote configuration file: /etc/tripwire/tw.cfg # ポリシーファイル最適化スクリプトが配布されてるのでそちらを使わせていただく [root@www tripwire]# vi twpolmake.pl
#!/usr/bin/perl # Tripwire Policy File customize tool # ---------------------------------------------------------------- # Copyright (C) 2003 Hiroaki Izumi # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; either version 2 # of the License, or (at your option) any later version. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. # ---------------------------------------------------------------- # Usage: # perl twpolmake.pl {Pol file} # ---------------------------------------------------------------- # $POLFILE=$ARGV[0]; open(POL,"$POLFILE") or die "open error: $POLFILE" ; my($myhost,$thost) ; my($sharp,$tpath,$cond) ; my($INRULE) = 0 ; while (<POL>) { chomp; if (($thost) = /^HOSTNAME\s*=\s*(.*)\s*;/) { $myhost = `hostname` ; chomp($myhost) ; if ($thost ne $myhost) { $_="HOSTNAME=\"$myhost\";" ; } } elsif ( /^{/ ) { $INRULE=1 ; } elsif ( /^}/ ) { $INRULE=0 ; } elsif ($INRULE == 1 and ($sharp,$tpath,$cond) = /^(\s*\#?\s*)(\/\S+)\b(\s+->\s+.+)$/) { $ret = ($sharp =~ s/\#//g) ; if ($tpath eq '/sbin/e2fsadm' ) { $cond =~ s/;\s+(tune2fs.*)$/; \#$1/ ; } if (! -s $tpath) { $_ = "$sharp#$tpath$cond" if ($ret == 0) ; } else { $_ = "$sharp$tpath$cond" ; } } print "$_\n" ; } close(POL) ; [root@www tripwire]# perl twpolmake.pl twpol.txt > twpol.txt.new [root@www tripwire]# twadmin -m P -c tw.cfg -p tw.pol -S site.key twpol.txt.new Please enter your site passphrase: # パスフレーズ Wrote policy file: /etc/tripwire/tw.pol [root@www tripwire]# tripwire -m i -s -c tw.cfg # データベース作成 Please enter your local passphrase: # パスフレーズ [root@www tripwire]# tripwire -m c -s -c tw.cfg # チェック実行 Open Source Tripwire(R) 2.4.1 Integrity Check Report Report generated by: root Report created on: Wed 16 May 2007 10:17:40 PM JST Database last updated on: Never ====================================================== Report Summary: ====================================================== Host name: www.srv.world Host IP address: 127.0.0.1 Host ID: None Policy file used: /usr/local/etc/tw.pol Configuration file used: /usr/local/etc/tw.cfg Database file used: /usr/local/lib/tripwire/www.srv.world.twd Command line used: tripwire -m c -s -c tw.cfg ====================================================== Rule Summary: ====================================================== ------------------------------------------------------ Section: Unix File System ------------------------------------------------------- Rule Name Severity Level Added Removed Modified --------- -------------- ----- ------- -------- Tripwire Data Files 0 0 0 0 * Monitor Filesystems 0 0 0 2 User Binaries and Libraries 0 0 0 0 Tripwire Binaries 0 0 0 0 OS Binaries and Libraries 0 0 0 0 Temporary Directories 0 0 0 0 Global Configuration Files 0 0 0 0 System Boot Changes 0 0 0 0 RPM Checksum Files 0 0 0 0 (/var/lib/rpm) OS Devices and Misc Directories 0 0 0 0 OS Boot Files and Mount Points 0 0 0 0 Root Directory and Files 0 0 0 0 Total objects scanned: 60551 Total violations found: 2 ====================================================== Object Summary: ====================================================== ------------------------------------------------------ # Section: Unix File System ------------------------------------------------------ ------------------------------------------------------ Rule Name: Monitor Filesystems (/var) Severity Level: 0 ------------------------------------------------------ Modified: "/var/yp/binding/srv.world.1" "/var/yp/binding/srv.world.2" ====================================================== Error Report: ====================================================== No Errors ------------------------------------------------------ *** End of report *** Open Source Tripwire 2.4 Portions copyright 2000 Tripwire, Inc. Tripwire is a registered trademark of Tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY; for details use --version. This is free software which may be redistributed or modified only under certain conditions; see COPYING for details. All rights reserved. |
| [2] | ファイルを追加してテストしてみます。 |
|
[root@www tripwire]# [root@www ~]# touch hacking [root@www ~]# tripwire -m c -s -c /etc/tripwire/tw.cfg Open Source Tripwire(R) 2.4.1 Integrity Check Report Report generated by: root Report created on: Wed 16 May 2007 10:17:40 PM JST Database last updated on: Never ====================================================== Report Summary: ====================================================== Host name: www.srv.world Host IP address: 127.0.0.1 Host ID: None Policy file used: /usr/local/etc/tw.pol Configuration file used: /usr/local/etc/tw.cfg Database file used: /usr/local/lib/tripwire/www.srv.world.twd Command line used: tripwire -m c -s -c tw.cfg ====================================================== Rule Summary: ====================================================== ------------------------------------------------------ Section: Unix File System ------------------------------------------------------ Rule Name Severity Level Added Removed Modified --------- -------------- ----- ------- -------- Tripwire Data Files 0 0 0 0 * Monitor Filesystems 0 0 0 2 User Binaries and Libraries 0 0 0 0 Tripwire Binaries 0 0 0 0 OS Binaries and Libraries 0 0 0 0 Temporary Directories 0 0 0 0 Global Configuration Files 0 0 0 0 System Boot Changes 0 0 0 0 RPM Checksum Files 0 0 0 0 (/var/lib/rpm) OS Devices and Misc Directories 0 0 0 0 OS Boot Files and Mount Points 0 0 0 0 * Root Directory and Files 0 1 0 0 Total objects scanned: 60552 Total violations found: 3 ====================================================== Object Summary: ====================================================== ------------------------------------------------------ # Section: Unix File System ------------------------------------------------------ ------------------------------------------------------ Rule Name: Monitor Filesystems (/var) Severity Level: 0 ------------------------------------------------------ Modified: "/var/yp/binding/srv.world.1" "/var/yp/binding/srv.world.2" ------------------------------------------------------ Rule Name: Root Directory and Files (/root) Severity Level: 0 ------------------------------------------------------ Added: "/root/hacking" # しっかり検出 ====================================================== Error Report: ====================================================== No Errors ------------------------------------------------------ *** End of report *** Open Source Tripwire 2.4 Portions copyright 2000 Tripwire, Inc. Tripwire is a registered trademark of Tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY; for details use --version. This is free software which may be redistributed or modified only under certain conditions; see COPYING for details. All rights reserved. |
| [3] | ファイルの変更前に整合性チェックをし、ファイルの変更をしたらデータベースのアップデートをします。 しないと整合性のとれないファイルがどんどん増えていき、正しいものがどれか分からなくなります。 アップデートをするには下記コマンドに、 変更を検知しているが問題のないレポートファイルを続けて指定してデータベースに反映させ、次からは検知しないようにします。 下記コマンドを実行するとエディタでレポートが開きます。変更のあった箇所の行頭に[×]がついているので、問題なければそのままにして 保存終了します。 |
|
[root@www ~]# tripwire -m u -r /var/lib/tripwire/report/www.srv.world-20070517-014755.twr Open Source Tripwire(R) 2.4.1 Integrity Check Report Report generated by: root Report created on: Wed 16 May 2007 10:17:40 PM JST Database last updated on: Never ====================================================== Report Summary: ====================================================== Host name: www.srv.world Host IP address: 127.0.0.1 Host ID: None Policy file used: /usr/local/etc/tw.pol Configuration file used: /usr/local/etc/tw.cfg Database file used: /usr/local/lib/tripwire/www.srv.world.twd Command line used: tripwire -m c -s -c tw.cfg ====================================================== Rule Summary: ====================================================== ------------------------------------------------------ Section: Unix File System ------------------------------------------------------ Rule Name Severity Level Added Removed Modified --------- -------------- ----- ------- -------- Tripwire Data Files 0 0 0 0 * Monitor Filesystems 0 0 0 2 User Binaries and Libraries 0 0 0 0 Tripwire Binaries 0 0 0 0 OS Binaries and Libraries 0 0 0 0 Temporary Directories 0 0 0 0 Global Configuration Files 0 0 0 0 System Boot Changes 0 0 0 0 RPM Checksum Files 0 0 0 0 (/var/lib/rpm) OS Devices and Misc Directories 0 0 0 0 OS Boot Files and Mount Points 0 0 0 0 * Root Directory and Files 0 1 0 0 Total objects scanned: 60552 Total violations found: 3 ====================================================== Object Summary: ====================================================== ------------------------------------------------------ # Section: Unix File System ------------------------------------------------------ ------------------------------------------------------ Rule Name: Monitor Filesystems (/var) Severity Level: 0 ------------------------------------------------------ Remove the "x" from the adjacent box to prevent updating the database with the new values for this object. Modified: [x] "/var/yp/binding/srv.world.1" # 整合性がとれなかったので[x] がついている [x] "/var/yp/binding/srv.world.2" ------------------------------------------------------ Rule Name: Root Directory and Files (/root) Severity Level: 0 ------------------------------------------------------ Remove the "x" from the adjacent box to prevent updating the database with the new values for this object. Added: [x] "/root/hacking" # 整合性がとれなかったので[x] がついている ====================================================== Error Report: ====================================================== No Errors ------------------------------------------------------ *** End of report *** Open Source Tripwire 2.4 Portions copyright 2000 Tripwire, Inc. Tripwire is a registered trademark of Tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY; for details use --version. This is free software which may be redistributed or modified only under certain conditions; see COPYING for details. All rights reserved. # 問題なければ保存終了する。すると以下のようにパスフレーズを求められるので入力 Please enter your local passphrase: Wrote database file: /usr/local/lib/tripwire/www.srv.world.twd |