Red Hat ENTERPRISE LINUX 4 - SECURITY GUIDE Manual

Also see for ENTERPRISE LINUX 4 - DEVELOPER TOOLS GUIDE: Installation guide Installation guide Tuning guide Installation guide Manual

Contents

Chapter 9. Intrusion Detection849.2. Host-based IDSA host-based IDS analyzes several areas to determine misuse (malicious or abusive activity insidethe network) or intrusion (breaches from the outside). Host-based IDSes consult several types oflog files (kernel, system, server, network, firewall, and more), and compare the logs against aninternal database of common signatures for known attacks. UNIX and Linux host-based IDSes makeheavy use of syslog and its ability to separate logged events by their severity (for example, minorprinter messages versus major kernel warnings). The syslog command is available when installingthe sysklogd package, which is included with Red Hat Enterprise Linux. This package providessystem logging and kernel message trapping. The host-based IDS filters logs (which, in the case ofsome network and kernel event logs, can be quite verbose), analyzes them, re-tags the anomalousmessages with its own system of severity rating, and collects them in its own specialized log foradministrator analysis.A host-based IDS can also verify the data integrity of important files and executables. It checks adatabase of sensitive files (and any files added by the administrator) and creates a checksum ofeach file with a message-file digest utility such as md5sum (128-bit algorithm) or sha1sum (160-bitalgorithm). The host-based IDS then stores the sums in a plain text file and periodically comparesthe file checksums against the values in the text file. If any of the file checksums do not match, theIDS alerts the administrator by email or cellular pager. This is the process used by Tripwire, which isdiscussed in Section 9.2.1, “Tripwire”.9.2.1. TripwireTripwire is the most popular host-based IDS for Linux. Tripwire, Inc., the developers of Tripwire,opened the software source code for the Linux version and licensed it under the terms of the GNUGeneral Public License. Tripwire is available from http://www.tripwire.org/.NoteTripwire is not included with Red Hat Enterprise Linux and is not supported. It has beenincluded in this document as a reference to users who may be interested in using thispopular application.9.2.2. RPM as an IDSThe RPM Package Manager (RPM) is another program that can be used as a host-based IDS. RPMcontains various options for querying packages and their contents. These verification options canbe invaluable to an administrator who suspects that critical system files and executables have beenmodified.The following list details some RPM options that can verify file integrity on a Red Hat Enterprise Linuxsystem. Refer to the System Administrators Guide for complete information about using RPM.ImportantSome of the commands in the following list require the importation of the Red Hat GPGpublic key into the system's RPM keyring. This key verifies that packages installed onthe system contain an Red Hat package signature, which ensures that the packagesoriginated from Red Hat. The key can be imported by issuing the following command asroot (substituting with the version of RPM installed on the system):