Download Securing Debian Manual

Chapter 10. Before the compromise
10.3.2
178
Host based intrusion detection
Host based intrusion detection involves loading software on the system to be monitored which
uses log files and/or the systems auditing programs as a data source. It looks for suspicious
processes, monitors host access, and may even monitor changes to critical system files.
tiger is an older intrusion detection tool which has been ported to Debian since the Woody
branch. tiger provides checks of common issues related to security break-ins, like password
strength, file system problems, communicating processes, and other ways root might be compromised. This package includes new Debian-specific security checks including: MD5sums
checks of installed files, locations of files not belonging to packages, and analysis of local listening processes. The default installation sets up tiger to run each day, generating a report
that is sent to the superuser about possible compromises of the system.
Log analysis tools, such as logcheck can also be used to detect intrusion attempts. See ‘Using
and customizing logcheck’ on page 72.
In addition, packages which monitor file system integrity (see ‘Checking file system integrity’
on page 81) can be quite useful in detecting anomalies in a secured environment. It is most
likely that an effective intrusion will modify some files in the local file system in order to
circumvent local security policy, install Trojans, or create users. Such events can be detected
with file system integrity checkers.
10.4
Avoiding root-kits
10.4.1
Loadable Kernel Modules (LKM)
Loadable kernel modules are files containing dynamically loadable kernel components used
to expand the functionality of the kernel. The main benefit of using modules is the ability to
add additional devices, like an Ethernet or sound card, without patching the kernel source and
recompiling the entire kernel. However, crackers are now using LKMs for root-kits (knark and
adore), opening up back doors in GNU/Linux systems.
LKM back doors are more sophisticated and less detectable than traditional root-kits. They can
hide processes, files, directories and even connections without modifying the source code of
binaries. For example, a malicious LKM can force the kernel into hiding specific processes from
procfs, so that even a known good copy of the binary ps would not list accurate information
about the current processes on the system.
10.4.2
Detecting root-kits
There are two approaches to defending your system against LKM root-kits, a proactive defense
and a reactive defense. The detection work can be simple and painless, or difficult and tiring,
depending on the approach taken.