Red Hat ENTERPRISE LINUX 4 - SECURITY GUIDE Manual

Also see for ENTERPRISE LINUX 4 - DEVELOPER TOOLS GUIDE: Installation guide Installation guide Tuning guide Installation guide Manual

Contents

Chapter 9. Intrusion Detection86(MISSING KEYS: GPG#897da07a)Exercise caution when installing packages that are unsigned as they are not approved by RedHat, Inc and could contain malicious code.RPM can be a powerful tool, as evidenced by its many verification tools for installed packages andRPM package files. It is strongly recommended that the contents of the RPM database directory (/var/lib/rpm/) be backed up to read-only media, such as CD-ROM, after installation of Red HatEnterprise Linux. Doing so allows verification of files and packages against the read-only database,rather than against the database on the system, as malicious users may corrupt the database andskew the results.9.2.3. Other Host-based IDSesThe following list discusses some of the other popular host-based intrusion detection systemsavailable. Refer to the websites of the respective utilities for more information regarding installationand configuration.NoteThese applications are not included with Red Hat Enterprise Linux and are not supported.They have been included in this document as a reference to users who may be interestedin evaluating such applications.• SWATCH http://sourceforge.net/projects/swatch/ — The Simple WATCHer (SWATCH) uses logfiles generated by syslog to alert administrators of anomalies based on user configuration files.SWATCH was designed to log any event that the user wants to add into the configuration file;however, it has been adopted widely as a host-based IDS.• LIDS http://www.lids.org/ — The Linux Intrusion Detection System (LIDS) is a kernel patch andadministration tool that can also control file modification with access control lists (ACLs), and protectprocesses and files, even from the root user.9.3. Network-based IDSNetwork-based intrusion detection systems operate differently from host-based IDSes. The designphilosophy of a network-based IDS is to scan network packets at the router or host-level, auditingpacket information, and logging any suspicious packets into a special log file with extendedinformation. Based on these suspicious packets, a network-based IDS can scan its own databaseof known network attack signatures and assign a severity level for each packet. If severity levels arehigh enough, a warning email or cellular pager is placed to security team members so they can furtherinvestigate the nature of the anomaly.Network-based IDSes have become popular as the Internet grows in size and traffic. IDSes that canscan the voluminous amounts of network activity and successfully tag suspect transmissions are well-received within the security industry. Due to the inherent insecurity of the TCP/IP protocols, it hasbecome imperative to develop scanners, sniffers, and other network auditing and detection tools toprevent security breaches due to such malicious network activity as:• IP Spoofing• denial-of-service attacks