HLIPS - Hardened Linux from scratch Intrusion Prevention System

Hi :]
I started a new project and wanted to know Your opinion on the base=20
ideas I have about it.
As You read in the title, I called it HLIPS.
(The HLFS is there, as that's where I develope and test it at and=20
because it's my favourite distro (if You can call it a distro of course) =
:)
The whole thing is a big script composed with the AIDE, ChkRootKit and=20
ChkExploit.
I tweaked the ChkRootKit a little bit (It tended to find a few rootkits=20
on fresh HLFS binaries, a compiled netstat as an example - I know it's=20
not in HLFS, but ChkRootKit relays on it)
Thus making a check and notification system.
Currently it's still under development (duh), but I want to release an=20
alpha someday maybe in the next 2 weeks :]
So what it does?

It checks and makes archives (when changes occur) of the systems=20
configuration (/etc and everywhere else where You keep Your configs that=20
You would not want too lose)
It checks the system for exploits and rootkits using ChkRootKit and=20
ChkExploit.
It uses AIDE to make sure that there were no changes where they=20
shouldn't be.
It depends on only a few binaries (grep, cat, echo, aide, chkrootkit bins=
)
It parses the SYSLOG and outputs desired data, right now I got it set up=20
to filter out all info on malicious packets, group it into 'per IP',=20
count it (how many packets, how many different IPs) and if there was any=20
info retrieved by netfilters OSF module, display it too.
For example, a typical output looks like this:
SRC=3D220.248.201.210 [7] () TTL=3D103 SPT=3D4625 DPT=3D1025 [7]
SRC=3D218.64.66.169 [3] () TTL=3D95 SPT=3D4795 DPT=3D1025 [2] TTL=3D95 SP=
T=3D4794=20
DPT=3D1025 [1]
SRC=3D221.12.40.144 [1] () TTL=3D34 PROTO=3DUDP SPT=3D35315 DPT=3D1026 [1=
]
SRC=3D218.64.77.180 [2] () TTL=3D94 SPT=3D1953 DPT=3D1025 [2]
SRC=3D202.111.173.82 [1] () TTL=3D32 PROTO=3DUDP SPT=3D39261 DPT=3D1026 [=
1]
SRC=3D212.176.49.56 [1] (Redline [::Redline_T|X_2200] : hops=3D141) TTL=3D=
114=20
SPT=3D30386 DPT=3D1080 [1]

the first brackets after the IP tell how many connection's have been=20
logged into syslog (I use somewhat more complicated firewall, so it=20
doesn't mean that there were only this many connection attempts, but=20
many of the others were tarpitted and dropped without logging)
the second () contain info on the system from which the packet=20
originated, it's OSF (fingerprint) based and usually works well.
Then there are a few informations I want it to tell me like=20
TTL,PROTO,SPT,DPT, if PROTO is unspecified it's assumed to be TCP (it=20
keeps the output even more readable) the last brackets tell how many=20
such connections were logged (with the same TTL,PROTO,SPT and DPT)

Finally it outputs everything else from the syslog, if there were any=20
other errors or such.

Every hour the scripts is run and I get a stat on everything into my=20
email box.
Currently when something is detected, depending on the severity, I=20
either get it by email with a marker in the subject to look at it more=20
closely, or when it's something really weird, I get info by SMS :]

I also have a little script allowing the remote shutdown of the entire=20
server, using just the mobile and a specialy crafted message, that when=20
delivered to a specified account, from a specified adress causes the=20
shutdown :] (if things would go very bad and I couldn't access the=20
server directly)


So the order in which it works is:
- check the config archives for modifications (if I update, I also=20
update the aide database, so this should ALWAYS return NO MODIFICATIONS,=20
else sms me right now and tell me who's logged, what's he executing and=20
such info)
- check the config and do an archive if something changed
- run chkrootkit and filter the output from things like 'not found' or=20
'not infected' etc. to let only the important ones stay
- run chexploit and parse the output in the same way
- run aide to generally check most of the system
- run the syslog analiser script
mail all the output info to my email account with apropriate subject=20
(depending on whether there were changes found or not)

The entire process on my Celeron 600mhz with 192MbRAM takes around 8 to=20
10 minutes.


When doing the installable package of it, I'd like to use as many=20
randomness as possible. To do that I'd have to make it even more=20
position independent then it is now but it's possible.
And another thing would be to hide it as well as possible (why any=20
intruder would need to know that it's target is using the HLIPS? :)

Then on compilation, the location would be choosen based on existing=20
system structures (some random existing location, of course after=20
telling the user where and if he/she agries to it) and so would be the=20
file names, to make finding of the system even harder.
Another thing I'd like it to do is to hide from ps aux
For example to pretend it's another running program (say httpd or=20
anything else or to just vanish)
Another thing is to make it start we need the position dependency, when=20
tracing the /etc/rc.d/init.d and /etc/inittab we can find everything=20
that gets started up (I assume the intruder gets root privilliges)
but let's say it would get started from inside another program, some=20
specialy crafted `echo` (or anything else) command option that would=20
look as normal as it is :] Then that would be the only place to put the=20
position of the system into, and even We could go ahead and forget about=20
it :]

So what do You think? Is it paranoic enough?
And maybe You already know something similar to this?

I wish to make the program as customizable as it gets, and also easy to=20
use and install. Make some English and Polish docs on it (maybe someone=20
will help with other languages).
You know, everything that a good program should have :]

If anybody is interested, I can post later info on the subject when I'll=20
be close enough to the alpha to let it run somewhere outside my server=20
for the first time :]

--=20
Best wishes
=A3ukasz Hejnak
szift at szift.org

--=20
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page