CentOS7.9 ; SNORT2 , Tripwire , Chkrootkitインストール

Contents

SNORT2 インストール
Tripwire インストール
Chkrootkit インストール

SNORT2 インストール

1.事前準備

①必要なソフトウェアをインストールする

# yum -y install bison flex libtool nghttp2 libnghttp2-devel \
libpcap-devel pcre-devel openssl-devel libdnet-devel \
libtirpc-devel git gcc-c++ libunwind-devel cmake hwloc-devel \
luajit-devel xz-devel libnfnetlink-devel libmnl-devel \
libnetfilter_queue-devel uuid-devel libsafec-devel

# yum -y install bison flex libtool nghttp2 libnghttp2-devel \

libpcap-devel pcre-devel openssl-devel libdnet-devel \

libtirpc-devel git gcc-c++ libunwind-devel cmake hwloc-devel \

luajit-devel xz-devel libnfnetlink-devel libmnl-devel \

libnetfilter_queue-devel uuid-devel libsafec-devel

②DAQ のインストール

# mkdir /var/src
# cd /var/src
# wget https://snort.org/downloads/snort/daq-2.0.7.tar.gz
# tar zxvf daq-2.0.7.tar.gz
# cd daq-2.0.7
# autoreconf -f -i
# ./configure
# make
# make install

# mkdir /var/src

# cd /var/src

# wget https://snort.org/downloads/snort/daq-2.0.7.tar.gz

# tar zxvf daq-2.0.7.tar.gz

# cd daq-2.0.7

# autoreconf -f -i

# ./configure

# make

# make install

③Lua のインストール

# cd /var/src
# wget http://luajit.org/download/LuaJIT-2.0.5.tar.gz
# tar -zxvf LuaJIT-2.0.5.tar.gz
# cd LuaJIT-2.0.5
# make
# make install

# cd /var/src

# wget http://luajit.org/download/LuaJIT-2.0.5.tar.gz

# tar -zxvf LuaJIT-2.0.5.tar.gz

# cd LuaJIT-2.0.5

# make

# make install

④偽のリリースファイルを作成

# /bin/cat &lt;&lt; EOT &gt;/etc/fedora-release
Fedora release 28 (Rawhide)
EOT

# /bin/cat << EOT >/etc/fedora-release

Fedora release 28 (Rawhide)

EOT

2. Snort をダウンロード、コンパイル、インストール

# cd /var/src
# wget https://snort.org/downloads/archive/snort/snort-2.9.18.1.tar.gz
# tar -zxvf snort-2.9.18.1.tar.gz
# cd snort-2.9.18.1
# ./configure --enable-sourcefire
# make
# make install
# ldconfig
# ln -s /usr/local/bin/snort /usr/sbin/snort

# cd /var/src

# wget https://snort.org/downloads/archive/snort/snort-2.9.18.1.tar.gz

# tar -zxvf snort-2.9.18.1.tar.gz

# cd snort-2.9.18.1

# ./configure --enable-sourcefire

# make

# make install

# ldconfig

# ln -s /usr/local/bin/snort /usr/sbin/snort

偽のリリースファイルを削除

# rm /etc/fedora-release

1	# rm /etc/fedora-release

3.グルーブとユーザー作成、必要なディレクトリー、ファイル作成

# groupadd snort
# useradd snort -r -s /sbin/nologin -c SNORT_IDS -g snort

1 2	# groupadd snort # useradd snort -r -s /sbin/nologin -c SNORT_IDS -g snort

# mkdir /etc/snort
# mkdir -p /etc/snort/rules
# mkdir /var/log/snort
# mkdir /usr/local/lib/snort_dynamicrules
# mkdir /etc/snort/preproc_rules

# chmod -R 5775 /etc/snort
# chmod -R 5775 /var/log/snort
# chmod -R 5775 /usr/local/lib/snort_dynamicrules
# chown -R snort:snort /etc/snort
# chown -R snort:snort /var/log/snort
# chown -R snort:snort /usr/local/lib/snort_dynamicrules

下記ファイル作成
# touch /etc/snort/rules/white_list.rules
# touch /etc/snort/rules/black_list.rules
# touch /etc/snort/rules/local.rules

# mkdir /etc/snort

# mkdir -p /etc/snort/rules

# mkdir /var/log/snort

# mkdir /usr/local/lib/snort_dynamicrules

# mkdir /etc/snort/preproc_rules

# chmod -R 5775 /etc/snort

# chmod -R 5775 /var/log/snort

# chmod -R 5775 /usr/local/lib/snort_dynamicrules

# chown -R snort:snort /etc/snort

# chown -R snort:snort /var/log/snort

# chown -R snort:snort /usr/local/lib/snort_dynamicrules

下記ファイル作成

# touch /etc/snort/rules/white_list.rules

# touch /etc/snort/rules/black_list.rules

# touch /etc/snort/rules/local.rules

設定ファイルのセットアップ・・・すべてのファイルを構成ディレクトリにコピーします。

# cp /var/src/snort-2.9.18.1/etc/*.conf* /etc/snort
# cp /var/src/snort-2.9.18.1/etc/*.map* /etc/snort

1 2	# cp /var/src/snort-2.9.18.1/etc/.conf /etc/snort # cp /var/src/snort-2.9.18.1/etc/.map /etc/snort

4.コミュニティルールの使用

①コミュニティルールを取得

# wget https://www.snort.org/rules/community -O ~/community.tar.gz

1	# wget https://www.snort.org/rules/community -O ~/community.tar.gz

②ルールを抽出し、構成フォルダーにコピー

# tar -xvf ~/community.tar.gz -C ~/
# cp ~/community-rules/* /etc/snort/rules

1 2	# tar -xvf ~/community.tar.gz -C ~/ # cp ~/community-rules/* /etc/snort/rules

コミュニティルールに含まれていないさまざまなルールファイルがある。
sedコマンドを使用して、不要な行をコメントアウトする。

# sed -i 's/include \$RULE\_PATH/#include \$RULE\_PATH/' /etc/snort/snort.conf

1	# sed -i 's/include \$RULE\_PATH/#include \$RULE\_PATH/' /etc/snort/snort.conf

5. 登録済みユーザールールの取得

Snortのウェブサイトに登録すると、Oink コードを使用して登録済みユーザールールをダウンロードできます。Oink コードは Snort ユーザーアカウントの詳細にあります。
次のコマンドのoinkcode を個人コードに置き換えます。

# wget https://www.snort.org/rules/snortrules-snapshot-29181.tar.gz?oinkcode=&lt;oink-code&gt; -O ~/registered.tar.gz

1	# wget https://www.snort.org/rules/snortrules-snapshot-29181.tar.gz?oinkcode=<oink-code> -O ~/registered.tar.gz

ダウンロードが完了したら、構成ディレクトリにルールを抽出

# tar -xvf ~/registered.tar.gz -C /etc/snort

1	# tar -xvf ~/registered.tar.gz -C /etc/snort

6. ネットワークおよびルールの構成

# vi /etc/snort/snort.conf
●45行目
# Setup the network addresses you are protecting
ipvar HOME_NET 192.168.11.0/24　←各自の環境に合わす
●48行目
# Set up the external network addresses. Leave as "any" in most situations
ipvar EXTERNAL_NET !$HOME_NET
●104-106行目　コメントアウトして下に追加
# Path to your rules files (this can be a relative path)
# var RULE_PATH ../rules
# var SO_RULE_PATH ../so_rules
# var PREPROC_RULE_PATH ../preproc_rules
var RULE_PATH /etc/snort/rules
var SO_RULE_PATH /etc/snort/so_rules
var PREPROC_RULE_PATH /etc/snort/preproc_rules
●116行目あたりコメントアウトして下に追加
# Set the absolute path appropriately
#var WHITE_LIST_PATH ../rules
#var BLACK_LIST_PATH ../rules
var WHITE_LIST_PATH /etc/snort/rules
var BLACK_LIST_PATH /etc/snort/rules
●525行目あたり追加
# unified2
# Recommended for most installs
output unified2: filename snort.log, limit 128
●550行目 カスタム ルールを読み込むようにするには、local.rules のコメントを解除する必要があります
include $RULE_PATH/local.rules
●コミュニティ ルールを使用している場合はlocal.rules 行のすぐ下などに次の行も追加
include $RULE_PATH/community.rules

# vi /etc/snort/snort.conf

●45行目

# Setup the network addresses you are protecting

ipvar HOME_NET 192.168.11.0/24　←各自の環境に合わす

●48行目

# Set up the external network addresses. Leave as "any" in most situations

ipvar EXTERNAL_NET !$HOME_NET

●104-106行目　コメントアウトして下に追加

# Path to your rules files (this can be a relative path)

# var RULE_PATH ../rules

# var SO_RULE_PATH ../so_rules

# var PREPROC_RULE_PATH ../preproc_rules

var RULE_PATH /etc/snort/rules

var SO_RULE_PATH /etc/snort/so_rules

var PREPROC_RULE_PATH /etc/snort/preproc_rules

●116行目あたりコメントアウトして下に追加

# Set the absolute path appropriately

#var WHITE_LIST_PATH ../rules

#var BLACK_LIST_PATH ../rules

var WHITE_LIST_PATH /etc/snort/rules

var BLACK_LIST_PATH /etc/snort/rules

●525行目あたり追加

# unified2

# Recommended for most installs

output unified2: filename snort.log, limit 128

●550行目カスタムルールを読み込むようにするには、local.rules のコメントを解除する必要があります

include $RULE_PATH/local.rules

●コミュニティルールを使用している場合はlocal.rules 行のすぐ下などに次の行も追加

include $RULE_PATH/community.rules

7. 設定の検証

パラメーター -T を使用して構成をテストし、テスト・モードを使用可能にします

# snort -T -c /etc/snort/rules/snort.conf

MaxRss at the end of detection rules:809420

--== Initialization Complete ==--

,,_&nbsp; &nbsp; &nbsp; &nbsp;-*&gt; Snort! &lt;*-
o" )~&nbsp; &nbsp; Version 2.9.18.1 GRE (Build 1005)
''''&nbsp; &nbsp; &nbsp; &nbsp;By Martin Roesch &amp; The Snort Team: http://www.snort.org/contact#team
Copyright (C) 2014-2021 Cisco and/or its affiliates. All rights reserved.
Copyright (C) 1998-2013 Sourcefire, Inc., et al.
Using libpcap version 1.9.1 (with TPACKET_V3)
Using PCRE version: 8.45 2021-06-15
Using ZLIB version: 1.2.11

Rules Engine: SF_SNORT_DETECTION_ENGINE Version 3.2 &lt;Build 1&gt;
Preprocessor Object: SF_DNS Version 1.1 &lt;Build 4&gt;
Preprocessor Object: appid Version 1.1 &lt;Build 5&gt;
Preprocessor Object: SF_S7COMMPLUS Version 1.0 &lt;Build 1&gt;
Preprocessor Object: SF_FTPTELNET Version 1.2 &lt;Build 13&gt;
Preprocessor Object: SF_POP Version 1.0 &lt;Build 1&gt;
Preprocessor Object: SF_SSLPP Version 1.1 &lt;Build 4&gt;

Total snort Fixed Memory Cost - MaxRss:809420
Snort successfully validated the configuration!
Snort exiting

# snort -T -c /etc/snort/rules/snort.conf

MaxRss at the end of detection rules:809420

--== Initialization Complete ==--

,,_       -*> Snort! <*-

o" )~    Version 2.9.18.1 GRE (Build 1005)

''''       By Martin Roesch & The Snort Team: http://www.snort.org/contact#team

Using libpcap version 1.9.1 (with TPACKET_V3)

Using PCRE version: 8.45 2021-06-15

Using ZLIB version: 1.2.11

Rules Engine: SF_SNORT_DETECTION_ENGINE Version 3.2 <Build 1>

Preprocessor Object: SF_DNS Version 1.1 <Build 4>

Preprocessor Object: appid Version 1.1 <Build 5>

Preprocessor Object: SF_S7COMMPLUS Version 1.0 <Build 1>

Preprocessor Object: SF_FTPTELNET Version 1.2 <Build 13>

Preprocessor Object: SF_POP Version 1.0 <Build 1>

Preprocessor Object: SF_SSLPP Version 1.1 <Build 4>

Total snort Fixed Memory Cost - MaxRss:809420

Snort successfully validated the configuration!

Snort exiting

エラーが出た場合該当のファイルを　/etc/snort/rulesにコピーする
当方の場合、下記のファイルでエラーが出た

# cp /var/src/snort-2.9.18.1/etc/classification.config /etc/snort/rules\
cp /var/src/snort-2.9.18.1/etc/reference.config /etc/snort/rules \
cp /var/src/snort-2.9.18.1/etc/threshold.conf /etc/snort/rules \
cp /var/src/snort-2.9.18.1/etc/unicode.map /etc/snort/rules

# cp /var/src/snort-2.9.18.1/etc/classification.config /etc/snort/rules\

cp /var/src/snort-2.9.18.1/etc/reference.config /etc/snort/rules \

cp /var/src/snort-2.9.18.1/etc/threshold.conf /etc/snort/rules \

cp /var/src/snort-2.9.18.1/etc/unicode.map /etc/snort/rules

unicode.mapエラーが出る場合は

# cp /usr/local/src/snort-2.9.18.1/etc/unicode.map /etc/snort/rules

1	# cp /usr/local/src/snort-2.9.18.1/etc/unicode.map /etc/snort/rules

また、「/etc/snort/rules/snort.conf(322) => Invalid keyword '}'」エラーが出る場合
該当行
decompress_swf { deflate lzma } \　　をコメントにしてください
# decompress_swf { deflate lzma } \

8. 構成のテスト

①Snort がアラートをログに記録しているかどうかをテストするには、着信 ICMP 接続に関するカスタム検出ルールアラートを local.rules ファイルに追加します。

# vi /etc/snort/rules/local.rules
●次の行を最終行に追加します
alert icmp any any -&gt; $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:001;)

# vi /etc/snort/rules/local.rules

●次の行を最終行に追加します

alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:001;)

②コンソールで Snort を起動し、アラートを stdout に出力します。正しいネットワークインターフェイス(eth0 など)を選択する必要があります

# snort -A console -i eth0 -u snort -g snort -c /etc/snort/snort.conf

Snortを起動して実行した状態で、他のコンピューターから ping を実行します。Snort を実行しているターミナルに ICMP 呼び出しごとに次のような通知が表示されます
Commencing packet processing (pid=33565)
02/18-13:39:15.162545  [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.22 -&gt; 192.168.11.83
02/18-13:39:15.162585  [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.83 -&gt; 192.168.11.22
02/18-13:39:16.167356  [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.22 -&gt; 192.168.11.83
02/18-13:39:16.167401  [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.83 -&gt; 192.168.11.22
02/18-13:39:17.180964  [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.22 -&gt; 192.168.11.83
02/18-13:39:17.181003  [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.83 -&gt; 192.168.11.22
02/18-13:39:18.199202  [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.22 -&gt; 192.168.11.83
02/18-13:39:18.199274  [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.83 -&gt; 192.168.11.22

# snort -A console -i eth0 -u snort -g snort -c /etc/snort/snort.conf

Snortを起動して実行した状態で、他のコンピューターから ping を実行します。Snort を実行しているターミナルに ICMP 呼び出しごとに次のような通知が表示されます

Commencing packet processing (pid=33565)

02/18-13:39:15.162545 [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.22 -> 192.168.11.83

02/18-13:39:15.162585 [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.83 -> 192.168.11.22

02/18-13:39:16.167356 [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.22 -> 192.168.11.83

02/18-13:39:16.167401 [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.83 -> 192.168.11.22

02/18-13:39:17.180964 [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.22 -> 192.168.11.83

02/18-13:39:17.181003 [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.83 -> 192.168.11.22

02/18-13:39:18.199202 [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.22 -> 192.168.11.83

02/18-13:39:18.199274 [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.83 -> 192.168.11.22

9. バックグラウンドで Snortを実行する

①Snort のスタートアップスクリプトを作成(eth0は各自の環境に合わす)

# vi /lib/systemd/system/snort.service

[Unit]

Description=Snort NIDS Daemon
After=syslog.target network.target

[Service]

Type=simple
ExecStart=/usr/local/bin/snort -q -u snort -g snort -c /etc/snort/snort.conf -i eth0

[Install]

WantedBy=multi-user.target

# vi /lib/systemd/system/snort.service

[Unit]

Description=Snort NIDS Daemon

After=syslog.target network.target

[Service]

Type=simple

ExecStart=/usr/local/bin/snort -q -u snort -g snort -c /etc/snort/snort.conf -i eth0

[Install]

WantedBy=multi-user.target

②サービスを定義した後、systemctl デーモンを再ロードし実行する

# systemctl daemon-reload
# systemctl start snort

1 2	# systemctl daemon-reload # systemctl start snort

Tripwire インストール

1.ダウンロード、インストール

# yum install tripwire

1	# yum install tripwire

2.パスフレーズ設定

サイトパスフレーズとローカルパスフレーズを設定する

# tripwire-setup-keyfiles

1	# tripwire-setup-keyfiles

----------------------------------------------
The Tripwire site and local passphrases are used to sign a variety of
files, such as the configuration, policy, and database files.
Passphrases should be at least 8 characters in length and contain both
letters and numbers.
See the Tripwire manual for more information.
----------------------------------------------
Creating key files...
(When selecting a passphrase, keep in mind that good passphrases typically
have upper and lower case letters, digits and punctuation marks, and are
at least 8 characters in length.)
Enter the site keyfile passphrase: ←任意の「サイトパスフレーズ」を入力
Verify the site keyfile passphrase: ←再度「サイトパスフレーズ」を入力
Generating key (this may take several minutes)...Key generation complete.
(When selecting a passphrase, keep in mind that good passphrases typically
have upper and lower case letters, digits and punctuation marks, and are
at least 8 characters in length.)
Enter the local keyfile passphrase: ←任意の「ローカルパスフレーズ」を入力
Verify the local keyfile passphrase: ←再度「ローカルパスフレーズ」を入力
Generating key (this may take several minutes)...Key generation complete.
----------------------------------------------
Signing configuration file...
Please enter your site passphrase: ←「サイトパスフレーズ」を入力
Wrote configuration file: /etc/tripwire/tw.cfg
A clear-text version of the Tripwire configuration file:
/etc/tripwire/twcfg.txt
has been preserved for your inspection. It is recommended that you
move this file to a secure location and/or encrypt it in place (using a
tool such as GPG, for example) after you have examined it.
----------------------------------------------
Signing policy file...
Please enter your site passphrase: ←「サイトパスフレーズ」を入力
Wrote policy file: /etc/tripwire/tw.pol
A clear-text version of the Tripwire policy file:
/etc/tripwire/twpol.txt
～中略～
default values from the current configuration file are used.

----------------------------------------------

The Tripwire site and local passphrases are used to sign a variety of

files, such as the configuration, policy, and database files.

Passphrases should be at least 8 characters in length and contain both

letters and numbers.

See the Tripwire manual for more information.

----------------------------------------------

Creating key files...

(When selecting a passphrase, keep in mind that good passphrases typically

have upper and lower case letters, digits and punctuation marks, and are

at least 8 characters in length.)

Enter the site keyfile passphrase: ←任意の「サイトパスフレーズ」を入力

Verify the site keyfile passphrase: ←再度「サイトパスフレーズ」を入力

Generating key (this may take several minutes)...Key generation complete.

(When selecting a passphrase, keep in mind that good passphrases typically

have upper and lower case letters, digits and punctuation marks, and are

at least 8 characters in length.)

Enter the local keyfile passphrase: ←任意の「ローカルパスフレーズ」を入力

Verify the local keyfile passphrase: ←再度「ローカルパスフレーズ」を入力

Generating key (this may take several minutes)...Key generation complete.

----------------------------------------------

Signing configuration file...

Please enter your site passphrase: ←「サイトパスフレーズ」を入力

Wrote configuration file: /etc/tripwire/tw.cfg

A clear-text version of the Tripwire configuration file:

/etc/tripwire/twcfg.txt

has been preserved for your inspection. It is recommended that you

move this file to a secure location and/or encrypt it in place (using a

tool such as GPG, for example) after you have examined it.

----------------------------------------------

Signing policy file...

Please enter your site passphrase: ←「サイトパスフレーズ」を入力

Wrote policy file: /etc/tripwire/tw.pol

A clear-text version of the Tripwire policy file:

/etc/tripwire/twpol.txt

～中略～

default values from the current configuration file are used.

3.Tripwire の設定

①設定ファイル編集

# vi /etc/tripwire/twcfg.txt
●9 行目あたり
行頭に「#」を追加し、その下の行に「LOOSEDIRECTORYCHECKING =true」を追加します。
●12 行目あたり
行頭に「#」を追加し、その下の行に「REPORTLEVEL =4」を追加します。
レベル4 にすることで「0 」～「4 」までの5 段階中、最も詳細なレポートが表示されます。
#REPORTLEVEL =3
REPORTLEVEL =4

# vi /etc/tripwire/twcfg.txt

●9 行目あたり

行頭に「#」を追加し、その下の行に「LOOSEDIRECTORYCHECKING =true」を追加します。

●12 行目あたり

行頭に「#」を追加し、その下の行に「REPORTLEVEL =4」を追加します。

レベル4 にすることで「0 」～「4 」までの5 段階中、最も詳細なレポートが表示されます。

#REPORTLEVEL =3

REPORTLEVEL =4

②Tripwire 設定ファイル(暗号署名版)を作成

# twadmin -m F -c /etc/tripwire/tw.cfg -S /etc/tripwire/site.key /etc/tripwire/twcfg.txt
Please enter your site passphrase: ←サイトパスフレーズを入力
Wrote configuration file: /etc/tripwire/tw.cfg

# twadmin -m F -c /etc/tripwire/tw.cfg -S /etc/tripwire/site.key /etc/tripwire/twcfg.txt

Please enter your site passphrase: ←サイトパスフレーズを入力

Wrote configuration file: /etc/tripwire/tw.cfg

③Tripwire 設定ファイル(テキスト版)削除

# rm -f /etc/tripwire/twcfg.txt

1	# rm -f /etc/tripwire/twcfg.txt

④ポリシーファイル設定

# cd /etc/tripwire/
# vi twpolmake.pl

1 2	# cd /etc/tripwire/ # vi twpolmake.pl

twpolmake.plの内容

#!/usr/bin/perl
# Tripwire Policy File customize tool
#
$POLFILE=$ARGV[0];

open(POL,"$POLFILE") or die "open error: $POLFILE" ;
my($myhost,$thost) ;
my($sharp,$tpath,$cond) ;
my($INRULE) = 0 ;

while (<POL>) {
chomp;
if (($thost) = /^HOSTNAME\s*=\s*(.*)\s*;/) {
$myhost = `hostname` ; chomp($myhost) ;
if ($thost ne $myhost) {
$_="HOSTNAME=\"$myhost\";" ;
}
}
elsif ( /^{/ ) {
$INRULE=1 ;
}
elsif ( /^}/ ) {
$INRULE=0 ;
}
elsif ($INRULE == 1 and ($sharp,$tpath,$cond) = /^(\s*\#?\s*)(\/\S+)\b(\s+->\s+.+)$/) {
$ret = ($sharp =~ s/\#//g) ;
if ($tpath eq '/sbin/e2fsadm' ) {
$cond =~ s/;\s+(tune2fs.*)$/; \#$1/ ;
}
if (! -s $tpath) {
$_ = "$sharp#$tpath$cond" if ($ret == 0) ;
}
else {
$_ = "$sharp$tpath$cond" ;
}
}
print "$_\n" ;
}
close(POL) ;

#!/usr/bin/perl

# Tripwire Policy File customize tool

$POLFILE=$ARGV[0];

open(POL,"$POLFILE") or die "open error: $POLFILE" ;

my($myhost,$thost) ;

my($sharp,$tpath,$cond) ;

my($INRULE) = 0 ;

while (<POL>) {

chomp;

if (($thost) = /^HOSTNAME\s*=\s*(.*)\s*;/) {

$myhost = `hostname` ; chomp($myhost) ;

if ($thost ne $myhost) {

$_="HOSTNAME=\"$myhost\";" ;

}

elsif ( /^{/ ) {

$INRULE=1 ;

}

elsif ( /^}/ ) {

$INRULE=0 ;

}

elsif ($INRULE == 1 and ($sharp,$tpath,$cond) = /^(\s*\#?\s*)(\/\S+)\b(\s+->\s+.+)$/) {

$ret = ($sharp =~ s/\#//g) ;

if ($tpath eq '/sbin/e2fsadm' ) {

$cond =~ s/;\s+(tune2fs.*)$/; \#$1/ ;

}

if (! -s $tpath) {

$_ = "$sharp#$tpath$cond" if ($ret == 0) ;

}

else {

$_ = "$sharp$tpath$cond" ;

}

print "$_\n" ;

}

close(POL) ;

⑤ポリシーファイル最適化

# perl /etc/tripwire/twpolmake.pl /etc/tripwire/twpol.txt &gt; /etc/tripwire/twpol.txt.new

1	# perl /etc/tripwire/twpolmake.pl /etc/tripwire/twpol.txt > /etc/tripwire/twpol.txt.new

⑥最適化済ポリシーファイルを元に、ポリシーファイル(暗号署名版)作成

# twadmin -m P -c /etc/tripwire/tw.cfg -p /etc/tripwire/tw.pol -S /etc/tripwire/site.key /etc/tripwire/twpol.txt.new
Please enter your site passphrase: ←サイトパスフレーズを入力
Wrote policy file: /etc/tripwire/tw.pol

# twadmin -m P -c /etc/tripwire/tw.cfg -p /etc/tripwire/tw.pol -S /etc/tripwire/site.key /etc/tripwire/twpol.txt.new

Please enter your site passphrase: ←サイトパスフレーズを入力

Wrote policy file: /etc/tripwire/tw.pol

⑦データベースを作成、動作確認

# tripwire -m i -s -c /etc/tripwire/tw.cfg
Please enter your local passphrase: ←ローカルパスフレーズを入力

テスト用ファイルを作成
# echo test &gt; /root/test.txt
Tripwire の動作確認
# tripwire -m c -s -c /etc/tripwire/tw.cfg
下記のように表示されればOK

# tripwire -m i -s -c /etc/tripwire/tw.cfg

Please enter your local passphrase: ←ローカルパスフレーズを入力

テスト用ファイルを作成

# echo test > /root/test.txt

Tripwire の動作確認

# tripwire -m c -s -c /etc/tripwire/tw.cfg

下記のように表示されればOK

Open Source Tripwire(R) 2.4.3.7 Integrity Check Report

Report generated by:          root
Report created on:            Sat 18 Feb 2023 02:28:02 PM JST
Database last updated on:     Never

===============================================================================
Report Summary:
===============================================================================

Host name:                    Lepard
Host IP address:              192.168.11.83
Host ID:                      None
Policy file used:             /etc/tripwire/tw.pol
Configuration file used:      /etc/tripwire/tw.cfg
Database file used:           /var/lib/tripwire/Lepard.twd
Command line used:            tripwire -m c -s -c /etc/tripwire/tw.cfg

===============================================================================
Rule Summary:
===============================================================================

-------------------------------------------------------------------------------
  Section: Unix File System
-------------------------------------------------------------------------------

  Rule Name                       Severity Level    Added    Removed  Modified
  ---------                       --------------    -----    -------  --------
  User binaries                   66                0        0        0
  Tripwire Binaries               100               0        0        0
  Libraries                       66                0        0        0
  Operating System Utilities      100               0        0        0
  File System and Disk Administraton Programs
                                  100               0        0        0
  Kernel Administration Programs  100               0        0        0
  Networking Programs             100               0        0        0
  System Administration Programs  100               0        0        0
  Hardware and Device Control Programs
                                  100               0        0        0
  System Information Programs     100               0        0        0
  Application Information Programs
                                  100               0        0        0
  (/sbin/rtmon)
  Critical Utility Sym-Links      100               0        0        0
  Shell Binaries                  100               0        0        0
  Critical system boot files      100               0        0        0
* Tripwire Data Files             100               1        0        0
  System boot changes             100               0        0        0
  OS executables and libraries    100               0        0        0
  Critical configuration files    100               0        0        0
  Security Control                100               0        0        0
  Login Scripts                   100               0        0        0
* Root config files               100               1        0        0
  Invariant Directories           66                0        0        0
  Temporary directories           33                0        0        0
  Critical devices                100               0        0        0
  (/proc/kcore)

Total objects scanned:  32789
Total violations found:  2

===============================================================================
Object Summary:
===============================================================================

-------------------------------------------------------------------------------
# Section: Unix File System
-------------------------------------------------------------------------------

-------------------------------------------------------------------------------
Rule Name: Tripwire Data Files (/var/lib/tripwire)
Severity Level: 100
-------------------------------------------------------------------------------

Added:
"/var/lib/tripwire/Lepard.twd"

-------------------------------------------------------------------------------
Rule Name: Root config files (/root)
Severity Level: 100
-------------------------------------------------------------------------------

Added:
"/root/test.txt"

===============================================================================
Error Report:
===============================================================================

No Errors

-------------------------------------------------------------------------------
*** End of report ***

Open Source Tripwire 2.4 Portions copyright 2000-2018 Tripwire, Inc.  Tripwire is a registered
trademark of Tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY;
for details use --version. This is free software which may be redistributed
or modified only under certain conditions; see COPYING for details.
All rights reserved.

Open Source Tripwire(R) 2.4.3.7 Integrity Check Report

Report generated by: root

Report created on: Sat 18 Feb 2023 02:28:02 PM JST

Database last updated on: Never

===============================================================================

Report Summary:

===============================================================================

Host name: Lepard

Host IP address: 192.168.11.83

Host ID: None

Policy file used: /etc/tripwire/tw.pol

Configuration file used: /etc/tripwire/tw.cfg

Database file used: /var/lib/tripwire/Lepard.twd

Command line used: tripwire -m c -s -c /etc/tripwire/tw.cfg

===============================================================================

Rule Summary:

===============================================================================

-------------------------------------------------------------------------------

Section: Unix File System

-------------------------------------------------------------------------------

Rule Name Severity Level Added Removed Modified

--------- -------------- ----- ------- --------

User binaries 66 0 0 0

Tripwire Binaries 100 0 0 0

Libraries 66 0 0 0

Operating System Utilities 100 0 0 0

File System and Disk Administraton Programs

100 0 0 0

Kernel Administration Programs 100 0 0 0

Networking Programs 100 0 0 0

System Administration Programs 100 0 0 0

Hardware and Device Control Programs

100 0 0 0

System Information Programs 100 0 0 0

Application Information Programs

100 0 0 0

(/sbin/rtmon)

Critical Utility Sym-Links 100 0 0 0

Shell Binaries 100 0 0 0

Critical system boot files 100 0 0 0

* Tripwire Data Files 100 1 0 0

System boot changes 100 0 0 0

OS executables and libraries 100 0 0 0

Critical configuration files 100 0 0 0

Security Control 100 0 0 0

* Root config files 100 1 0 0

Invariant Directories 66 0 0 0

Temporary directories 33 0 0 0

Critical devices 100 0 0 0

(/proc/kcore)

Total objects scanned: 32789

Total violations found: 2

===============================================================================

Object Summary:

===============================================================================

-------------------------------------------------------------------------------

# Section: Unix File System

-------------------------------------------------------------------------------

Rule Name: Tripwire Data Files (/var/lib/tripwire)

Severity Level: 100

-------------------------------------------------------------------------------

Added:

"/var/lib/tripwire/Lepard.twd"

-------------------------------------------------------------------------------

Rule Name: Root config files (/root)

Severity Level: 100

-------------------------------------------------------------------------------

Added:

"/root/test.txt"

===============================================================================

Error Report:

===============================================================================

No Errors

-------------------------------------------------------------------------------

*** End of report ***

trademark of Tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY;

for details use --version. This is free software which may be redistributed

or modified only under certain conditions; see COPYING for details.

テスト用ファイルを削除

# rm -f /root/test.txt

1	# rm -f /root/test.txt

⑧Tripwire 定期実行スクリプト

# cd /var/www/system
# vi tripwire.sh

1 2	# cd /var/www/system # vi tripwire.sh

tripwire.shの内容

#!/bin/bash

PATH=/usr/sbin:/usr/bin:/bin:/usr/local/tripwire/sbin

# パスフレーズ設定
LOCALPASS= ←ローカルパスフレーズ
SITEPASS= 　←サイトパスフレーズ

cd /etc/tripwire

# Tripwireチェック実行
tripwire -m c -s -c tw.cfg|mail -s "Tripwire(R) Integrity Check Report in `hostname`" root

# ポリシーファイル最新化
twadmin -m p -c tw.cfg -p tw.pol -S site.key > twpol.txt
perl twpolmake.pl twpol.txt > twpol.txt.new
twadmin -m P -c tw.cfg -p tw.pol -S site.key -Q $SITEPASS twpol.txt.new > /dev/null
rm -f twpol.txt* *.bak

# データベース最新化
rm -f /usr/local/tripwire/lib/tripwire/*.twd*
tripwire -m i -s -c tw.cfg -P $LOCALPASS

#!/bin/bash

PATH=/usr/sbin:/usr/bin:/bin:/usr/local/tripwire/sbin

# パスフレーズ設定

LOCALPASS= ←ローカルパスフレーズ

SITEPASS= 　←サイトパスフレーズ

cd /etc/tripwire

# Tripwireチェック実行

tripwire -m c -s -c tw.cfg|mail -s "Tripwire(R) Integrity Check Report in `hostname`" root

# ポリシーファイル最新化

twadmin -m p -c tw.cfg -p tw.pol -S site.key > twpol.txt

perl twpolmake.pl twpol.txt > twpol.txt.new

twadmin -m P -c tw.cfg -p tw.pol -S site.key -Q $SITEPASS twpol.txt.new > /dev/null

rm -f twpol.txt* *.bak

# データベース最新化

rm -f /usr/local/tripwire/lib/tripwire/*.twd*

tripwire -m i -s -c tw.cfg -P $LOCALPASS

⑨Tripwire 自動実行スクリプト実行設定

# chmod 700 tripwire.sh

cron に追加
# crontab -e
0 3 * * * /var/www/system/tripwire.sh

# chmod 700 tripwire.sh

cron に追加

# crontab -e

0 3 * * * /var/www/system/tripwire.sh

参考: メールで結果報告用スクリプト

#!/bin/bash

PATH=/usr/sbin:/usr/bin:/bin:/usr/local/tripwire/sbin

# パスフレーズ設定
LOCALPASS=xxxxx # ローカルキーパスフレーズ
SITEPASS=xxxxx # サイトキーパスフレーズ

#通知先メールアドレス指定
MAIL="<your mailaddress> "

cd /etc/tripwire

# Tripwireチェック実行
tripwire -m c -s -c tw.cfg|mail -s "Tripwire(R) Integrity Check Report in `hostname`" $MAIL

# ポリシーファイル最新化
twadmin -m p -c tw.cfg -p tw.pol -S site.key > twpol.txt
perl twpolmake.pl twpol.txt > twpol.txt.new
twadmin -m P -c tw.cfg -p tw.pol -S site.key -Q $SITEPASS twpol.txt.new > /dev/null
rm -f twpol.txt* *.bak

# データベース最新化
rm -f /usr/local/tripwire/lib/tripwire/*.twd*
tripwire -m i -s -c tw.cfg -P $LOCALPASS

#!/bin/bash

PATH=/usr/sbin:/usr/bin:/bin:/usr/local/tripwire/sbin

# パスフレーズ設定

LOCALPASS=xxxxx # ローカルキーパスフレーズ

SITEPASS=xxxxx # サイトキーパスフレーズ

#通知先メールアドレス指定

MAIL="<your mailaddress> "

cd /etc/tripwire

# Tripwireチェック実行

tripwire -m c -s -c tw.cfg|mail -s "Tripwire(R) Integrity Check Report in `hostname`" $MAIL

# ポリシーファイル最新化

twadmin -m p -c tw.cfg -p tw.pol -S site.key > twpol.txt

perl twpolmake.pl twpol.txt > twpol.txt.new

twadmin -m P -c tw.cfg -p tw.pol -S site.key -Q $SITEPASS twpol.txt.new > /dev/null

rm -f twpol.txt* *.bak

# データベース最新化

rm -f /usr/local/tripwire/lib/tripwire/*.twd*

tripwire -m i -s -c tw.cfg -P $LOCALPASS

Chkrootkit インストール

①chkrootkit をダウンロード、インストール

# cd /usr/local/src
# wget https://launchpad.net/chkrootkit/main/0.55/+download/chkrootkit-0.55.tar.gz
# tar xvf chkrootkit-0.55.tar.gz

# cd /usr/local/src

# wget https://launchpad.net/chkrootkit/main/0.55/+download/chkrootkit-0.55.tar.gz

# tar xvf chkrootkit-0.55.tar.gz

➁/root/bin ディレクトリを作成し、そのディレクトリにchkrootkit コマンドを移動

# mkdir -p /root/bin
# mv chkrootkit-0.55/chkrootkit /root/bin

1 2	# mkdir -p /root/bin # mv chkrootkit-0.55/chkrootkit /root/bin

➂chkrootkit を確認します。

# chkrootkit | grep INFECTED
何も表示されなければ問題ありません

1 2	# chkrootkit \| grep INFECTED 何も表示されなければ問題ありません

Searching for Linux.Xor.DDoS ... INFECTED: Possible Malicious Linux.Xor.DDoS installed

上記のエラーが出る場合
/tmp配下に実行可能なファイルがある場合に起こる誤検知と思われます。
当方の場合下記のファイルを実行不可にしました。

# chmod -x ks-script-ha_lzbh5 ks-script-uu6cvhzn

1	# chmod -x ks-script-ha_lzbh5 ks-script-uu6cvhzn

④chkrootkit 定期実行スクリプトの作成と権限変更

chkrootkit実行スクリプトを毎日自動実行されるディレクトリへ作成
# vi /etc/cron.daily/chkrootkit

1 2	chkrootkit実行スクリプトを毎日自動実行されるディレクトリへ作成 # vi /etc/cron.daily/chkrootkit

定期実行スクリプトの内容

#!/bin/bash

PATH=/usr/bin:/bin:/root/bin

LOG=/tmp/$(basename ${0})

# chkrootkit実行
chkrootkit > $LOG 2>&1

# ログ出力
cat $LOG | logger -t $(basename ${0})

# SMTPSのbindshell誤検知対応
if [ ! -z "$(grep 465 $LOG)" ] && \
[ -z $(/usr/sbin/lsof -i:465|grep bindshell) ]; then
sed -i '/465/d' $LOG
fi

# upstartパッケージ更新時のSuckit誤検知対応
if [ ! -z "$(grep Suckit $LOG)" ] && \
[ -z "$(rpm -V `rpm -qf /sbin/init`)" ]; then
sed -i '/Suckit/d' $LOG
fi

# rootkit検知時のみroot宛メール送信
[ ! -z "$(grep INFECTED $LOG)" ] && \
grep INFECTED $LOG | mail -s "chkrootkit report in `hostname`" root

#!/bin/bash

PATH=/usr/bin:/bin:/root/bin

LOG=/tmp/$(basename ${0})

# chkrootkit実行

chkrootkit > $LOG 2>&1

# ログ出力

cat $LOG | logger -t $(basename ${0})

# SMTPSのbindshell誤検知対応

if [ ! -z "$(grep 465 $LOG)" ] && \

[ -z $(/usr/sbin/lsof -i:465|grep bindshell) ]; then

sed -i '/465/d' $LOG

# upstartパッケージ更新時のSuckit誤検知対応

if [ ! -z "$(grep Suckit $LOG)" ] && \

[ -z "$(rpm -V `rpm -qf /sbin/init`)" ]; then

sed -i '/Suckit/d' $LOG

# rootkit検知時のみroot宛メール送信

[ ! -z "$(grep INFECTED $LOG)" ] && \

grep INFECTED $LOG | mail -s "chkrootkit report in `hostname`" root

chkrootkit実行スクリプトへ実行権限付加

# chmod 700 /etc/cron.daily/chkrootkit

1	# chmod 700 /etc/cron.daily/chkrootkit

⑥chkrootkit が使用するコマンドをバックアップ

chkrootkit が使用するコマンドが改ざんされた場合、rootkit を検出できなくなるので、
これらのコマンドをバックアップしておきます。
必要な場合は、バックアップしたコマンドを使用してchkrootkit を実行します

# cd /root
# mkdir /root/chkrootkit_cmd
# cp `which --skip-alias awk cut echo egrep find head id ls netstat ps strings sed ssh uname` chkrootkit_cmd/
# ls -l /root/chkrootkit_cmd/
total 2060
-rwxr-xr-x 1 root root 428584 Feb 18 15:34 awk
-rwxr-xr-x 1 root root  41584 Feb 18 15:34 cut
-rwxr-xr-x 1 root root  33088 Feb 18 15:34 echo
-rwxr-xr-x 1 root root    290 Feb 18 15:34 egrep
-rwxr-xr-x 1 root root 199304 Feb 18 15:34 find
-rwxr-xr-x 1 root root  41480 Feb 18 15:34 head
-rwxr-xr-x 1 root root  37400 Feb 18 15:34 id
-rwxr-xr-x 1 root root 117608 Feb 18 15:34 ls
-rwxr-xr-x 1 root root 155008 Feb 18 15:34 netstat
-rwxr-xr-x 1 root root 100112 Feb 18 15:34 ps
-rwxr-xr-x 1 root root  76072 Feb 18 15:34 sed
-rwxr-xr-x 1 root root 774544 Feb 18 15:34 ssh
-rwxr-xr-x 1 root root  33328 Feb 18 15:34 strings
-rwxr-xr-x 1 root root  33072 Feb 18 15:34 uname

# cd /root

# mkdir /root/chkrootkit_cmd

# cp `which --skip-alias awk cut echo egrep find head id ls netstat ps strings sed ssh uname` chkrootkit_cmd/

# ls -l /root/chkrootkit_cmd/

total 2060

-rwxr-xr-x 1 root root 428584 Feb 18 15:34 awk

-rwxr-xr-x 1 root root 41584 Feb 18 15:34 cut

-rwxr-xr-x 1 root root 33088 Feb 18 15:34 echo

-rwxr-xr-x 1 root root 290 Feb 18 15:34 egrep

-rwxr-xr-x 1 root root 199304 Feb 18 15:34 find

-rwxr-xr-x 1 root root 41480 Feb 18 15:34 head

-rwxr-xr-x 1 root root 37400 Feb 18 15:34 id

-rwxr-xr-x 1 root root 117608 Feb 18 15:34 ls

-rwxr-xr-x 1 root root 155008 Feb 18 15:34 netstat

-rwxr-xr-x 1 root root 100112 Feb 18 15:34 ps

-rwxr-xr-x 1 root root 76072 Feb 18 15:34 sed

-rwxr-xr-x 1 root root 774544 Feb 18 15:34 ssh

-rwxr-xr-x 1 root root 33328 Feb 18 15:34 strings

-rwxr-xr-x 1 root root 33072 Feb 18 15:34 uname

⑦コピーしたコマンドにchkrootkit を実行

# chkrootkit -p /root/chkrootkit_cmd | grep INFECTED

1	# chkrootkit -p /root/chkrootkit_cmd \| grep INFECTED

何も表示されなければ問題ありません

⑧バックアップしたコマンドを圧縮

# tar zcvf chkrootkit_cmd.tar.gz chkrootkit_cmd
chkrootkit_cmd/
chkrootkit_cmd/awk
chkrootkit_cmd/cut
chkrootkit_cmd/echo
chkrootkit_cmd/egrep
chkrootkit_cmd/find
chkrootkit_cmd/head
chkrootkit_cmd/id
chkrootkit_cmd/ls
chkrootkit_cmd/netstat
chkrootkit_cmd/ps
chkrootkit_cmd/strings
chkrootkit_cmd/sed
chkrootkit_cmd/ssh
chkrootkit_cmd/uname

# tar zcvf chkrootkit_cmd.tar.gz chkrootkit_cmd

chkrootkit_cmd/

chkrootkit_cmd/awk

chkrootkit_cmd/cut

chkrootkit_cmd/echo

chkrootkit_cmd/egrep

chkrootkit_cmd/find

chkrootkit_cmd/head

chkrootkit_cmd/id

chkrootkit_cmd/ls

chkrootkit_cmd/netstat

chkrootkit_cmd/ps

chkrootkit_cmd/strings

chkrootkit_cmd/sed

chkrootkit_cmd/ssh

chkrootkit_cmd/uname

# ls -l
total 126512
-rw-------. 1 root root       1606 Feb 16 22:36 anaconda-ks.cfg
drwxr-xr-x  2 root root         24 Feb 18 15:28 bin
drwxr-xr-x  2 root root        172 Feb 18 15:34 chkrootkit_cmd
-rw-r--r--  1 root root     971076 Feb 18 15:35 chkrootkit_cmd.tar.gz

# ls -l

total 126512

-rw-------. 1 root root 1606 Feb 16 22:36 anaconda-ks.cfg

drwxr-xr-x 2 root root 24 Feb 18 15:28 bin

drwxr-xr-x 2 root root 172 Feb 18 15:34 chkrootkit_cmd

-rw-r--r-- 1 root root 971076 Feb 18 15:35 chkrootkit_cmd.tar.gz

⑨chkrootkit使用コマンド(圧縮版)をroot宛にメール送信

# echo|mail -a chkrootkit_cmd.tar.gz -s chkrootkit_cmd.tar.gz root

1	# echo\|mail -a chkrootkit_cmd.tar.gz -s chkrootkit_cmd.tar.gz root

⑩Windows にchkrootkit_cmd.tar.gz ファイルをダウンロードして退避

⑪バックアップしたサーバー上のコマンドを削除

# rm -f chkrootkit_cmd.tar.gz

1	# rm -f chkrootkit_cmd.tar.gz

ページのトップへ