Slashdot Mirror
Security Auditing for Linux
malibu_mex writes: "LinuxToday, ZDNet Australia, and NewsForge are all reporting on a loadable kernel module + GUI combination that implements an auditing subsystem on Linux (Like the NT event logger, or solaris BSM). This could be yet another reason for big business and government to migrate away from the costly commercial alternatives to Linux. First it was SAMBA, now it's SNARE. What have these Aussies got with 5 letter 'S' names? This topic has been discussed on Slashdot previously here."
Q. Is it RedHat?
A. Yes.
Conclusion: It's insecure.
but I wouldn't trust a snare... we keep reproaching MS to entangle us. I don't want this to happen to linux. no snare for me :-)
One shall speak only if what one has to say is more beautiful than silence
CNET
Although this storuy claims "is the first intrusion detection system to reside on individual computers rather than a network"
which is clearly wrong.
First it was SAMBA, now it's SNARE. What have these Aussies got with 5 letter 'S' names?
Apparently the first idea for a name was System Tracking, User Protection and Intrusion Detection but they thought that would be stupid.
Loadable Kernel Module means you dont have to recompile your kernel, i know for some people (me!!) not having to recompile your kernel is a big importance (i might be wrong on this, but thats what i remember, ill try and install it myself just to verify)
Microsoft IIS is to webserving as KFC is to healthy eating
The people that make the decisions to go Microsoft will almost never touch the systems they implement.
Tough cookies, but that's the real deal. Don't believe me? Go to a magazine store and pick up some financial glossies...
Luck favors the prepared, darling.
Vermifax
Logout
First it was SAMBA, now it's SNARE. What have these Aussies got with 5 letter 'S' names?
Maybe the same deviation as the Americans with their 3 letter acronyms...
But, wait, I thought that MySQL was the best database in existence.....?
Maybe VA should look at investing a bit of money in a copy of Oracle. It wouldn't stop responding every two hours like MySQL does.
Sheep?
From Jeremy Allison interview:
Remember, for all you gits who for some reason think I'm an Australian (pah!) I'm a Brit - and my home town is Sheffield (in the Independent Socialist Republic of South Yorkshire). That's right - "THE FULL MONTY"! I've never even *been* to Australia, and have *never* eaten koala or emu
per mere, per terras
Why is it "cool" when Linux gets something that Windows has had, but when Windows gets something that Linux has had its, "Linux is so far ahead of Windows, blah, blah."
The short time to market can also be attributed to three other factors, according to Cora: "We have the programming skills, we have a small company that is not bureaucratic, and we put aside the established OSes (operating systems) and started from scratch."
After my own heart. Bureaucracies are not an "asset", and trying to salvage (reuse) existing stuff, that happens to be crap, is not "efficient".
1Alpha7
Live to be Moderated
VA Software(Soon to be renamed VA Burger Chefs) couldn't afford a blank CD to make an illicit copy of Oracle, let alone buy a copy of it.
Of course, having a front-end to cut out all the useless messages is nice, but I would imagine most sysadmins have already written (or could write) a simple script in Perl custom tailored to their liking to do the same thing.
Sig (appended to the end of comments you post, 120 chars)
What can this snare do that syslog can't?
On my systems I get a thorough analysis of the past hour of syslog events in my inbox, sorted by security risk. And getting a live view of syslog events is easy with tail -f.
If this generates extra events, then the code for the original pieces of code these events are generated for should be adapted to generate them. If this doesn't generate extra events then it's just another way of looking at exactly the same data, and shouldn't be hyped so much on slashdot.
I really don't get it.
No really.
Just compile the MODULE.
make dep, modules, modules_install.
Sure, if it dont even came prepared to do
this for you, like yhe NVidia driver.
=oP
Better luck next time!
First it was SAMBA, now it's SNARE. What have these Aussies got with 5 letter 'S' names?
Snares are used to catch the dingos. Duh.
I knew it!--they're all Vulcans in disguise. Next we can expect a System Protection Oscillator for Chemical Kudos or something...
Have fun: Join D.N.A. (National Dyslexics Association)
What have these Aussies got with 5 letter 'S' names?
Hopefully Sweden will be providing us with 14-letter 'S' solutions. I could definitely get into some serious Snugglebunnies with their Bikini Team.
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
It appeared on http://www.hackerjournal.com yesterday morning.
-=*(CC)*=-
Isn't this just a glorified facelift for the various /var/log parts? Seriously. I less /var/log/secure every day or two for that exact reason. If you want it pretty pipe it to a perl script to HTMLify it and read it inside your favorite browser.
-dave
This is not a sig. this is a duck. quack.
Umm, SNARE sounds like a bit more than tail -f of various log files. The Solaris BSM creates a full audit trail which can be used to track a user from the moment they enter the system including what they execute (and from which connection) etc. Assuming SNARE is anything like this it will be ace.
Great! I work on a mil project that deals with audit trails. Having a linux module to allow for auditing is exactly what we need and have been trying to get going. If it is anywere near as good as Solaris BSM auditing it will be a great thing, not just for yo, but for those that support Linux in a govt/military environment. This is a HUGE step forward since requirments require auditing records to be stored. Linux coming to an Afganistan site near you ;)
huh?
Event Viewer is the most useless piece of junk in the Windows world. It's not set up to be truly queried, or use complex filtering, or tag important information based on what the admin wants to see.
It can tell you who logged in to what machine and how many pages they printed to what printer. Yee Haw.
Hopefully these people have more sense than to try to mindlessly copy the Windows paradigm. There is so much going on with system security that real time, query-enhanced auditing with a good set of heuristics combined with a pointy-haired gui, reporting tools, etc., could be very useful.
How they figure logging is keeping Linux out of businesses is beyond me, since a program like Exchange will crash the server if you want to look at the logs.
we now have SNARE, what is next, SNEPILADY?
Or how about SMEEE? Serving Microsoft's Embrace Extend Extinguish?
....or, SMITE, Server Migration Information Technology Epicenter? Call up the vendor of a product and say "I'd like you to SMITE me".
And Captain Vulture said to his troops "Carrion".
GISboy
If it is not on fire, it is a software problem.
OK, yes, there are third-party tools you can purchase extra to provide better functionality or you have to write some vbscript on your own to get the info. My point is, crap like this should be part of the OS. I'd rather have useful tools than a flock()ing media player, web browser, and instant messenger as part of the OS. :(
But to get back to the topic, yeah, having better auditing tools under Linux is needed. Just don't look up to Windows as the way to implement them! :)
I'm going to eat out your mom's ass.
I didn't find any info on this on Intersect, but what happens if someone roots the machine and unloads the module? No more logging then. And an excellent opportunity to erase all the existing logs.
I assume that the logs are kept somewhere safe (another host maybe, or just printed as some prefer), so it is not a *huge* issue, but still ability to turn off the logging (and leave some trojans / backdoors without further traces) is somewhat scary.
Yes, I know that after being rooted you shall reinstall.
e-mail: karol at tls-technologies.com
www: http://www.tls-technologies.com
sig: not found
I think it's fantastic that Linux is getting better and better features, options, software, and support for security-critical large environments. However, isn't it a bit premature to say, the instant that ONE application comes out that provides auditing, to say, "Ok, cool! Linux is now on par with all those other OSes that have had stuff like this developed for them for years...let's all adopt Linux now!" I wouldn't bet that there will be major changes just yet...security people who are on the cutting edge are not usually first adopters unless necessary, and it's not necessary to choose first-generation auditing in Linux over more proven equivalents for Solaris, for example. It's good to see Linux getting there, though :)
For your security, this post has been encrypted with ROT-13, twice.
This does seem like a complete package, but I was wondering why a kernel module was needed as opposed to using the process accounting facilities already in the kernel. It is already possible to turn on logging for all processes (man accton), has anyone ever written any sort of log scraper for the binary accounting file? I would think for detecting specific locally run commands it would be adequate.
Well, they could shoplift one, then.
..a webserver that can handle more than 100 hits a day.
Anyone got a mirror anywhere?
It's "cool" because Microsoft is not.
Take for instance, this: The megacorp I used to work at was coerced into migrating from Navigator to IE, otherwise, we 'sure wouldn't like the new cost of the Office license when it comes up for negotiation'.
It's not good for the economy, world, computing industry to have companies running around using threats to stifle the potential of other companies, especially if the company that loses out has a superior product.
Let's say you developed some software and tried to make a living by selling it. How would you feel if a company came in with an inferior product and told your biggest client they had better stop using yours or they'd face higher prices on unrelated software that they were already invested and dependant upon? Legal or not, all-is-fair-in-love-and-war or not, I call that a "low blow". I call that "immoral". I call that not being the best but still winning first prize.
It's "cool" anytime you can get similar functionality from something which is community-supported, rather than monopoly-coerced.
It's "cool" when Linux is ahead of Windows because it (usually) shows how people with (usually) selfless intentions, people with passion for the art of computing, are able to lead the way; to demonstrate their vision and skill while doing something that is for the common good. Not (usually) for Money, but for Kindness and other generally soft and fluffy concepts.
In my book, "selfless" = Good.
In my book, "greedy" = Evil.
So, to me, this is about Good versus Evil. The events that I have been exposed to don't, imho, point to any other conclusion.
And Good is "cool".
"migrate away from the costly commercial alternatives to Linux. "
You guys still haven't got it, have you? The OS license cost is not an issue. What do you think a server os for a few thousand or so is for a enterprise setup when you spend $50000 on oracle and about as much on experts setting it up?
I simple don't understand why there so much nagging about license costs when those are just not an issue.
Hi, you are a self-serving twit. Thank you for your dopey comments.
If you look at the proceedings of the 1999 O'Reilly Open Source Convention, somebody presented a paper on a loadable kernel module for Linux (called "Laudit"), that enabled auditing/event monitoring in the kernel. This one is essentially the same idea (except Laudit had a command line/ /proc API).
Regards
It should be abbreviated as S.I.A.R.E.
...but I find that whenever I go to type BSM (into a search engine, whatever), my fingers want to type BDSM.
"People who do stupid things with hazardous materials often die." -- Jim Davidson on alt.folklore.urban
ftp://ftp.wiretapped.net/pub/security/host-securit y/snare/
Hi all, the LinuxBSM project was started as an initiative of the University of California at Davis to build an auditor that meets the government's C2 compliance standards. I was the original author of the project and have received help from several people in the open source community, including Jeremy Banford (my roommate) who did nearly a complete rewrite of a good percentage of the code. Unfortunately, the project has fallen by the wayside as I have now graduated and work fulltime (and doing a little bit of work on OpenOffice - shameless plug) However, every two years or so the topic pops up on /. again.
So I was wondering if there are a couple of people out there that might be interested in helping with the project. If so I'd certain begin developing again.
drop me an email : )
holmlundNO@SPAMinnercite.com
Check out this product from hp.
Amongst its other features, it also provides an auditing subsystem, so you can audit pretty anything going on in the system. You can then use a filter to produce either plain text or xml reports.
It has lots of other nifty features too - compartments, with kernel-level access control that goes beyond chmod.It makes it easy to run Internet services in a chrooted environment, with tightly controlled access limiting damage if one app were to be compromised.
(Yes I do work for HP, but not for the ISSL division. The thoughts above are my own, not HP'S)
- Lindsay