Re: New sensor for Linux deployments

On Monday 04 February 2008 06:13:23 Sebastien Tricaud wrote:
> I can see the auditd sensor offline in the prewikka agent view, maybe
> you start prelude with incorrect parameters. You may add:
>
> prelude_client_set_flags(prelude_client,
> prelude_client_get_flags(prelude_client) |
> PRELUDE_CLIENT_FLAGS_ASYNC_TIMER);

Hmm...that's basically what I'm doing.


> To test auditd, I wrote a program to segfault and I got the following
> message:
>
>         assessment:
>                 impact:
>                         severity: low (2)
>                         completion: (null) (-1)
>                         type: other (0)
>                         description: An application terminated
> abnormally. An attacker may be trying to exploit a weakness in the program.
>
> Few questions:
> - Why do you consider this attack as low ? I guess a program
> segfaulting, is (well should be) unusual and get a medium impact severity.

I considered it low since the application was in fact terminated. I am willing 
to make it Medium if that's more appropriate. So, this will be fixed in the 
next release.


> - Is there a reason why the completion is null ?

The code "as is" sets the completion to IDMEF_IMPACT_COMPLETION_ERROR and then 
it looks for evidence in the audit stream that supports a conclusion of 
succeeded or failed. If it doesn't find support for either conclusion, it 
leaves it unchanged. I really think that there should be a way to tell admins 
that the analysis was indeterminate so they can take whatever steps they feel 
is necessary.

Anyways, I just updated it so that its now hardcoded as a failure for this 
record type.

Thanks for the feedback. I'm happy to make any other updates that people feel 
need changing.

Thanks,
-Steve
_______________________________________________
Prelude-user site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-user