setup sudosh and swatch on Linux server

• purpose:

assuming root password is locked in safebox, normal user like 'jephe' can only use 'sudo sudosh' to become root, after that, everything will be recorded and can be replayed later.

• install sudosh

download it from DAG website(search google for 'DAG sudosh') for using 'yum install sudosh' from CentOS 5 or run 'yum install sudosh' from RHEL 5 after registering with RHN using command 'rhnreg_ks --proxy=http://x.y.z.k:port --username=user1 --password=pass1

• put the folllowing to /etc/sudoers

jephe ALL=/usr/bin/sudosh

• initialize sudo folder by running 'sudosh -i', the permission should be like this:
  

[root@jephe ~]# ls -ld /var/log/sudosh
drwx-wx-wx 2 root root 4096 Apr 10 15:37 /var/log/sudosh

• install swatch to realtime scan /var/log/secure to monitor 'su, sudo and console root login'
  

1. installing swatch rpm using the same method as sudosh
2. put the following to /etc/swatch.conf
[root@jephe ~]# more /etc/swatch.conf
watchfor /sudo:.*/
mail root,subject=--- server sudo alert! ---

watchfor /su:.*/
mail root,subject=--- server su alert! ---

watchfor /login: ROOT LOGIN.*/
mail root,subject=--- server console login alert! ---
3. set root alias in /etc/alias, then run 'newaliases', for those environment that doesn't have DNS server, using /etc/mail/service.switch
[root@jephe ~]# cd /etc/mail
[root@jephe mail]# more service.switch
hosts files
4. put the following to /etc/rc.local
/usr/bin/swatch -c /etc/swatch.conf -t /var/log/secure --daemon
5. put the following to /etc/logrotate.d/syslog
[root@jephe logrotate.d]# more syslog
/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron {
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true

##added by Jephe####
kill -9 `ps -ef | grep -e swatch -e '/usr/bin/tail -n 0' | grep -v grep | awk '{print $2}'`
sleep 5
/usr/bin/swatch -c /etc/swatch.conf -t /var/log/secure --daemon
###end#####
endscript
}
6. put the following to /usr/local/sbin/restartsw (for restarting swatch)
[root@db7 logrotate.d]# more /usr/local/sbin/restartsw
#!/bin/sh
kill -9 `ps -ef | grep -e swatch -e '/usr/bin/tail -n 0' | grep -v grep | awk '{print $2}'`
sleep 2
/usr/bin/swatch -c /etc/swatch.conf -t /var/log/secure --daemon

• configuring sendmail.mc to masquerade in non-dns environment

[root@db7 mail]# diff sendmail.mc.orig sendmail.mc
39a40
> define(`SMART_HOST',`mailrelay')dnl
103c104
<> dnl EXPOSED_USER(`root')dnl
160c161
<> MASQUERADE_AS(`newdomain.com')dnl
164c165
<> FEATURE(masquerade_envelope)dnl
168c169
<> FEATURE(masquerade_entire_domain)dnl
170,172c171,173
<> MASQUERADE_DOMAIN(localhost)dnl
> MASQUERADE_DOMAIN(localhost.localdomain)dnl
> MASQUERADE_DOMAIN(domain.com)dnl

note: assuming server hostname is jephe.domain.com, so swatch will send out email using root@jephe.domain.com normally, which is not-exist domain, but newdomain.com is valid, so we masquerade it to root@newdomain.com.

setup osiris for Windows

• purpose: for recording down system user/group changes and Windows directory and any other directories changes.
• how it works: osiris on Windows is agent, the management tool and daemon are residing on Linux server. You need to configure it on Linux sever after installing software on Windows. Then it will generate a base database for comparing every 24 hours by default, then send out email alert for any changes
  
• install it on Windows
  

if you are installing it through terminal service, it will install to wrong place.
Solution:
1. after installing , copy c:\document and settings\sysmgr\windows\osiris directory to c:\win2k03
2. copy c:\documents and setting\sysmgr\windows\osiris to c:\win2k03\system32
3. startup osiris service again

note: if you encounter error saying "error writing to file osimessage.dll", u can rename c:\windows\system32\osimessage.dll first

• osiris on Linux

1. ./configure;make;make install
2. enable tcp port 2265 and 2266 for iptables host firewall
3. enable in-between firewall ports too for above 2 ports
4. on server, configure management console
# osiris
# login as username and password
# add-host
all the way to default, except for email alert part choose (y,y,n,y)

copy configuration file to the windows server name to be monitored
start-scan servername
list-db servername

setup Snare for Windows for centralized system log

• download snare for Windows
• after install, access it using http://localhost:6161
• go to 'network configuration' to give the remote Linux syslog-ng server ip at 'Destination Snare Server address', also give 'Destination Port which is 514 for syslog-ng'
• go to 'remote control' to setup password
• access it next time using username and password pair 'snare/password you gave'

setup Snort on CentOS 5

1. follow the documentation on www.internetsecurityguru.com
2. certain things to take note as follow:

• selinux
  

vi /etc/selinux/config, change to disabled, then reboot

• yum -y update, and you might want to add 'export http_proxy=http://10.0.0.252:8080' to /etc/profile
• oinkmaster

login to snort website as registered user, go to rules-download rules, from there you will know how to get the oinkmaster code for automatic download rules for registered user.

after setting up oinkmaster cronjob script, you might want to add root cronjob to restart snort itself also, in case the new rules are downloaded by oinkmaster, then it can be used snort

cronjob -l -u snort
30 5 * * * export http_proxy=http://1.2.3.4:8080; /usr/bin/oinkmaster.pl -C /etc/pinkmaster.conf -C /etc/autodisable.conf -b /etc/snort/backup > /tmp/snort.cron 2>&1 ;sync;sync;sync;sleep 15; (echo:snort@domain.com";echo "Subject: snort rules daily update";echo "";cat /tmp/snort.cron) | /usr/sbin/sendmail -f snort@domain.com jephe@domain.com

• pear config-show

use pear config-set to set http_proxy as 1.2.3.4:8080 then run 'pear install xxxxx'

• perl -MCPAN -e shell

install Net::RawIP or force install Net::RawIP

• barnyard

download it from www.snort.org
./configure --enable-mysql;make;make install
use the following configuration for /etc/snort/barnyard.conf
config localtime
config hostname: localhost
config interface: eth1
output alert_fast
output log_dump
output log_acid_db: mysql, database snort, server localhost, user snort, password snort, detail full

you only need to modify bylog.waldo once, after that, barnyard will update it automatically.

here is the init script for barnyard:
--------------------
#!/bin/sh
#
# chkconfig: 2345 99 82
# description: Starts and stops Barnyard
#
# config: /etc/snort/barnyard.conf
# processname: barnyard

# Source function library
. /etc/rc.d/init.d/functions

# program name
BASE=barnyard

# program options
CONF="/etc/snort/barnyard.conf"
GEN_MAP="/etc/snort/gen-msg.map"
SID_MAP="/etc/snort/sid-msg.map"
LOG_DIR="/var/log/snort"
LOG_FILE="snort.log"
WALDO_FILE="/var/log/snort/bylog.waldo"
DAEMON="-D"

# Check that $BASE exists.
[ -f /usr/local/bin/$BASE ] || exit 0

# Source networking configuration.
. /etc/sysconfig/network

# Check that networking is up.
[ ${NETWORKING} = "no" ] && exit 0

RETVAL=0

# See how we were called.
case "$1" in
start)
if [ -n "`/sbin/pidof $BASE`" ]; then
echo -n $"$BASE: already running"
echo ""
exit $RETVAL
fi
echo -n "Starting Barnyard service: "
/usr/local/bin/$BASE -c $CONF -g $GEN_MAP -s $SID_MAP -d $LOG_DIR -f $LOG_FILE -w $WALDO_FILE $DAEMON
sleep 1
action "" /sbin/pidof $BASE
RETVAL=$?
[ $RETVAL -eq 0 ] && touch /var/lock/subsys/barnyard
;;
stop)
echo -n "Shutting down Barnyard service: "
killproc /usr/local/bin/$BASE
RETVAL=$?
echo
[ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/barnyard
;;
restart|reload)
$0 stop
$0 start
RETVAL=$?
;;
status)
status $BASE
RETVAL=$?
;;
*)
echo "Usage: snort {start|stop|restart|reload|status}"
exit 1
esac

exit $RETVAL
--------------------------

• snort.conf

output alert_syslog: LOG_LOCAL1
output alert_unified: filename snort.alert, limit 128
output log_unified: filename snort.log, limit 128

change interface to eth1 in /etc/init.d/snort script

cronjob for snort:
50 5 * * * /sbin/service snort restart 2>&1 > /tmp/snortrestart.cron;sleep 5;(echo "From:sensor1@domain.com";echo "Subject:snort daily restart";echo "";cat /tmp/snortrestart.cron)| /usr/sbin/sendmail -f snort@domain.com jephe@domain.com

• swatch

more /etc/swatch.conf:
watchfor /snort.*Priority.* -> .*/
mail jephe@domain.com:wu@domain.com,subject=--- Sensor1 Snort Alert! ---

• syslog

add the following to /etc/logrotate.d/syslog
/var/log/snortalert {
daily
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
kill -9 `ps -ef | grep -e swatch -e '/usr/bin/tail -n 0' | grep -v grep | awk '{print $2}'`
sleep 5
/usr/bin/swatch -c /etc/swatch.conf -t /var/log/snortalert --daemon
endscript
}
grep snort /etc/syslog.conf
local1.* /var/log/snortalert

• /etc/rc.local

/usr/bin/swatch -c /etc/swatch.conf -t /var/log/snortalert --daemon

• sendmail

masqrade root@snort.domain.com to root@domain.com
a. change DS part to DS[1.2.3.5] which is smtp server
b. put the following to /etc/mail/sendmail.mc
masquerade_as('domain.com')
feature(masquerade_envelope)
feature(masquerade_entire_domain)
masquerade_domain(localhost)
masquerade_domain(localhost.domain)
then go to /etc/mail/sendmail.cf to commen out C{E} root

• conclusion
  

use snort, oinkmaster update rules daily then require snort restart, swatch to watch /var/log/snortalert to send out email notification, but after syslog rotation, need to restart swatch. barnyard is doing mysql database recording for snort alert.

enable snmptrapd to work with selinux under Fedora Core 3

Purpose: to make HP ILO to send out snmp trap to snmp trap server running snmptrapd, through which, to send out email using snmptraptoemail function.

1. enable snmptrapd to work with selinux first

• download selinux-policy-targeted-sources-1.17.30-2.19.noarch.rpm then install it using rpm -ivh , after that, run the following commands

[root@mail policy]# pwd
/etc/selinux/targeted/src/policy
[root@mail policy]# dmesg |audit2allow
allow snmpd_t bin_t:dir { search };
allow snmpd_t device_t:sock_file { write };
allow snmpd_t snmpd_t:fifo_file { write };

then put the above lines to domains /etc/selinux/targeted/src/policy/domains/misc/local.te, after that, under policy folder, then 'make load'
finally, restart snmptrapd service before testing sending test snmp alert from ILO web interface.

2. how to setup snmptrap to email?
[root@mail snmp]# more /etc/snmp/snmptrapd.conf
traphandle default /usr/bin/perl /usr/bin/traptoemail -s localhost -f hpsnmptrap@yourdomain.com youremailaddress

You can put multiple lines for above snmptrapd.conf configuration

3. go to ILO - Administration - SNMP/ Insight Manager Setting to enable SNMP ILO Alert and put your snmp trap server IP address, send test alert out now.

set up webcam for home security under CentOS 4

step:

1. yum install *sdl*
this will install DSL and devel-DSL and a lot of xorg-x11 rpm packages if you don't have X11 installed

2. modprobe video

3. install kernel devel rpm packages for compiling spca5xx

4. download spca5xx driver and spcaview package from docs.maxposs.com/docs/spca5xx
then do 'make; make install ' for them

5. modprobe spca5xx

6. ssh -X jephe.dyndns.org
xterm
spcaview (default device is /dev/video0)

7. install libjpeg-devel* using yum

8. download motion tar file from http://www.lavrsen.dk/twiki/bin/view/Motion/WebHome
then compile it

9. cd /usr/local/share/doc/motion-3.2.8/examples
cp /usr/local/share/doc/motion-3.2.8/examples/motion.init-RH to /etc/init.d/motion
chkconfig motion on

cd /usr/local/etc/
cp /usr/local/etc/motion-dist.conf to /usr/local/etc/motion.conf
vi /usr/local/etc/motion.conf to change
webcam_quality 300
webcam_localhost off
control_localhost off

10. service motion restart

11. point your firefox to http://192.168.100.150:8081/

afick and chkrootkit

1. define alias in configuration file which is linux.conf
2. running fick
#afick -c linux.conf -i
#afick -c linux.conf -k
#crontab -e
#afick -c linux.conf -u

0 1 * * * rot /path/to/afick.cron

3. http://www.chkrootkit.org/