OracleLinux8.8 : SNORT3 , Tripwire , Chkrootkit インストール

Contents

SNORT3 インストール

Snortは、IPネットワーク上でリアルタイムのトラフィック分析とパケットロギングを実行できるオープンソースのネットワーク侵入検知システムです。

「プロトコル分析」「コンテンツ検索」「マッチング」を実行でき、「バッファオーバーフロー」「ステルスポートスキャン」「CGI攻撃」「SMBプローブ」「OSフィンガープリント試行」「セマンティックURL攻撃」「サーバメッセージブロック探査」など、さまざまな攻撃検出に使用できます。

1.事前準備

①CodeReady Red Hat リポジトリを追加し、必要なソフトウェアをインストールする

# dnf config-manager --set-enabled ol8_codeready_builder
# dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
# dnf config-manager --set-enabled epel
# dnf upgrade

# dnf config-manager --set-enabled ol8_codeready_builder

# dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm

# dnf config-manager --set-enabled epel

# dnf upgrade

必要なビルドツールとライブラリをインストール

# dnf -y install bison flex libtool nghttp2 libnghttp2-devel \
libpcap-devel pcre-devel openssl-devel libdnet-devel \
libtirpc-devel git gcc-c++ libunwind-devel cmake hwloc-devel \
luajit-devel xz-devel libnfnetlink-devel libmnl-devel \
libnetfilter_queue-devel uuid-devel libsafec-devel

# dnf -y install bison flex libtool nghttp2 libnghttp2-devel \

libpcap-devel pcre-devel openssl-devel libdnet-devel \

libtirpc-devel git gcc-c++ libunwind-devel cmake hwloc-devel \

luajit-devel xz-devel libnfnetlink-devel libmnl-devel \

libnetfilter_queue-devel uuid-devel libsafec-devel

②DAQ のインストール
作業ディレクトリーを作成し、そのディレクトリーに移動し進める

# mkdir snort-source && cd snort-source
# git clone https://github.com/snort3/libdaq.git
# cd libdaq
# ./bootstrap
# ./configure
# make
# make install

# mkdir snort-source && cd snort-source

# git clone https://github.com/snort3/libdaq.git

# cd libdaq

# ./bootstrap

# ./configure

# make

# make install

③Tcmallocインストール

# cd ../
# wget https://github.com/gperftools/gperftools/releases/download/gperftools-2.9.1/gperftools-2.9.1.tar.gz
# tar xzf gperftools-2.9.1.tar.gz
# cd gperftools-2.9.1/
# ./configure
# make
# make install

# cd ../

# wget https://github.com/gperftools/gperftools/releases/download/gperftools-2.9.1/gperftools-2.9.1.tar.gz

# tar xzf gperftools-2.9.1.tar.gz

# cd gperftools-2.9.1/

# ./configure

# make

# make install

2. Snort をダウンロード、コンパイル、インストール

バージョンについては最新のものに変更してください

# cd ../
# wget https://github.com/snort3/snort3/archive/refs/tags/3.1.28.0.tar.gz
# tar xzf 3.1.28.0.tar.gz
# cd snort3-3.1.28.0
# ./configure_cmake.sh --prefix=/usr/local --enable-tcmalloc
# cd build
# export PKG_CONFIG_PATH=$PKG_CONFIG_PATH:/usr/local/lib64/pkgconfig:/usr/local/lib/pkgconfig
# make
# make install

# cd ../

# wget https://github.com/snort3/snort3/archive/refs/tags/3.1.28.0.tar.gz

# tar xzf 3.1.28.0.tar.gz

# cd snort3-3.1.28.0

# ./configure_cmake.sh --prefix=/usr/local --enable-tcmalloc

# cd build

# export PKG_CONFIG_PATH=$PKG_CONFIG_PATH:/usr/local/lib64/pkgconfig:/usr/local/lib/pkgconfig

# make

# make install

共有ライブラリを更新

# ln -s /usr/local/lib/libtcmalloc.so.4 /lib/
# ln -s /usr/local/lib/libdaq.so.3 /lib/
# ldconfig

# ln -s /usr/local/lib/libtcmalloc.so.4 /lib/

# ln -s /usr/local/lib/libdaq.so.3 /lib/

# ldconfig

バージョンを確認

# snort -V

  ,,_     -*> Snort++ <*-
  o"  )~   Version 3.1.28.0
   ''''    By Martin Roesch & The Snort Team
           http://snort.org/contact#team
           Copyright (C) 2014-2022 Cisco and/or its affiliates. All rights reserved.
           Copyright (C) 1998-2013 Sourcefire, Inc., et al.
           Using DAQ version 3.0.12
           Using LuaJIT version 2.1.0-beta3
           Using OpenSSL 1.1.1k  FIPS 25 Mar 2021
           Using libpcap version 1.9.1 (with TPACKET_V3)
           Using PCRE version 8.42 2018-03-20
           Using ZLIB version 1.2.11
           Using LZMA version 5.2.4

# snort -V

,,_ -*> Snort++ <*-

o" )~ Version 3.1.28.0

'''' By Martin Roesch & The Snort Team

http://snort.org/contact#team

Using DAQ version 3.0.12

Using LuaJIT version 2.1.0-beta3

Using OpenSSL 1.1.1k FIPS 25 Mar 2021

Using libpcap version 1.9.1 (with TPACKET_V3)

Using PCRE version 8.42 2018-03-20

Using ZLIB version 1.2.11

Using LZMA version 5.2.4

3. ネットワークインターフェースカードの設定

Snortがネットワークトラフィックをリッスンしているインタフェースをプロミスキャスモードにして、Snortに送信されたすべてのネットワークトラフィックを参照できるようにします。

# ip link set dev ens160 promisc on

1	# ip link set dev ens160 promisc on

検証

# ip add sh ens160
2: ens160: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:0c:29:02:01:27 brd ff:ff:ff:ff:ff:ff
    altname enp3s0
    inet 192.168.11.83/24 brd 192.168.11.255 scope global noprefixroute ens160
       valid_lft forever preferred_lft forever

# ip add sh ens160

2: ens160: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000

link/ether 00:0c:29:02:01:27 brd ff:ff:ff:ff:ff:ff

altname enp3s0

inet 192.168.11.83/24 brd 192.168.11.255 scope global noprefixroute ens160

valid_lft forever preferred_lft forever

インターフェイスオフロードを無効にする
まずこの機能が有効になっているかどうかを確認

# ethtool -k ens160 | grep receive-offload
generic-receive-offload: on
large-receive-offload: on

# ethtool -k ens160 | grep receive-offload

generic-receive-offload: on

large-receive-offload: on

GRO,LROを無効にする

# ethtool -K ens160 gro off lro off

1	# ethtool -K ens160 gro off lro off

システムの再起動後も変更が持続するように、systemd サービスユニットを作成して有効にし、変更を反映する

# vi /etc/systemd/system/snort3-nic.service
下記内容を記述
[Unit]
Description=Set Snort 3 NIC in promiscuous mode and Disable GRO, LRO on boot
After=network.target

[Service]
Type=oneshot
ExecStart=/usr/sbin/ip link set dev ens160 promisc on
ExecStart=/usr/sbin/ethtool -K ens160 gro off lro off
TimeoutStartSec=0
RemainAfterExit=yes

[Install]
WantedBy=default.target

# vi /etc/systemd/system/snort3-nic.service

下記内容を記述

[Unit]

Description=Set Snort 3 NIC in promiscuous mode and Disable GRO, LRO on boot

After=network.target

[Service]

Type=oneshot

ExecStart=/usr/sbin/ip link set dev ens160 promisc on

ExecStart=/usr/sbin/ethtool -K ens160 gro off lro off

TimeoutStartSec=0

RemainAfterExit=yes

[Install]

WantedBy=default.target

設定をリロードして、起動時にサービスを開始し、有効にする

# systemctl daemon-reload
# systemctl enable --now snort3-nic.service

1 2	# systemctl daemon-reload # systemctl enable --now snort3-nic.service

4.コミュニティルールの使用

①Snort Rulesディレクトリを作成

# mkdir /usr/local/etc/rules

1	# mkdir /usr/local/etc/rules

➁Snort 3ダウンロードページからSnort 3コミュニティルールをダウンロード
ルールを抽出し、構成フォルダーにコピー

# wget -qO- https://www.snort.org/downloads/community/snort3-community-rules.tar.gz \
| tar xz -C /usr/local/etc/rules/

1 2	# wget -qO- https://www.snort.org/downloads/community/snort3-community-rules.tar.gz \ \| tar xz -C /usr/local/etc/rules/

構成フォルダーの中を確認する

# ls -1 /usr/local/etc/rules/snort3-community-rules/
AUTHORS
LICENSE
sid-msg.map
snort3-community.rules
VRT-License.txt

# ls -1 /usr/local/etc/rules/snort3-community-rules/

AUTHORS

LICENSE

sid-msg.map

snort3-community.rules

VRT-License.txt

5. メイン設定ファイル編集

# vi /usr/local/etc/snort/snort.lua

1	# vi /usr/local/etc/snort/snort.lua

24行目: 自サーバーIPアドレスに変更
HOME_NET = '192.168.11.83/24'

28行目 : 変更
EXTERNAL_NET = '!$HOME_NET'

186行目あたり : ipsセクションの中のルールのパスを更新
variables = default_variables,
rules = [[ 
    include $RULE_PATH/snort3-community-rules/snort3-community.rules
    ]]

24行目: 自サーバーIPアドレスに変更

HOME_NET = '192.168.11.83/24'

28行目 : 変更

EXTERNAL_NET = '!$HOME_NET'

186行目あたり : ipsセクションの中のルールのパスを更新

variables = default_variables,

rules = [[

include $RULE_PATH/snort3-community-rules/snort3-community.rules

]]

OpenAppID　インストール
Snort 3のダウンロードページからSnort OpenAppIDをダウンロードしインストール
バージョンについては最新のものに変更してください

# wget https://www.snort.org/downloads/openappid/33380
# tar -xzvf 33380
# cp -R odp /usr/local/lib/

# wget https://www.snort.org/downloads/openappid/33380

# tar -xzvf 33380

# cp -R odp /usr/local/lib/

snort 3設定ファイルを編集し、OpenAppIDライブラリの場所を定義

# vi /usr/local/etc/snort/snort.lua

98行目当たり : appidセクションに追加
appid =
{
    -- appid requires this to use appids in rules
    --app_detector_dir = 'directory to load appid detectors from'
    app_detector_dir = '/usr/local/lib',
    log_stats = true,
}

# vi /usr/local/etc/snort/snort.lua

98行目当たり : appidセクションに追加

appid =

{

-- appid requires this to use appids in rules

--app_detector_dir = 'directory to load appid detectors from'

app_detector_dir = '/usr/local/lib',

log_stats = true,

}

Snorts ログディレクトリー作成

# mkdir /var/log/snort

1	# mkdir /var/log/snort

設定ファイルのチェック

# snort -T -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq -i ens160 -l /var/log/snort

1	# snort -T -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq -i ens160 -l /var/log/snort

チェックの結果次のように表示されればOK

--------------------------------------------------
o")~   Snort++ 3.1.28.0
--------------------------------------------------
Loading /usr/local/etc/snort/snort.lua:
Loading snort_defaults.lua:
Finished snort_defaults.lua:
Loading file_magic.lua:
Finished file_magic.lua:
        ssh
        host_cache
        pop
        so_proxy
        stream_tcp
        mms
        smtp
        gtp_inspect
        packets
        dce_http_proxy
        stream_icmp
        normalizer
        ips
        binder
        wizard
        appid
        file_id
        stream_udp
        http2_inspect
        http_inspect
        ftp_data
        search_engine
        ftp_server
        port_scan
        dce_http_server
        dce_smb
        dce_tcp
        netflow
        iec104
        cip
        telnet
        ssl
        sip
        rpc_decode
        modbus
        host_tracker
        stream_user
        stream_ip
        back_orifice
        trace
        classifications
        dnp3
        active
        process
        ftp_client
        decode
        daq
        alerts
        stream
        network
        references
        arp_spoof
        output
        hosts
        dns
        dce_udp
        imap
        file_policy
        s7commplus
        stream_file
Finished /usr/local/etc/snort/snort.lua:
Loading ips.rules:
Loading ../rules/snort3-community-rules/snort3-community.rules:
Finished ../rules/snort3-community-rules/snort3-community.rules:
Finished ips.rules:
--------------------------------------------------
ips policies rule stats
              id  loaded  shared enabled    file
               0    4021       0    4021    /usr/local/etc/snort/snort.lua
--------------------------------------------------
rule counts
       total rules loaded: 4021
               text rules: 4021
            option chains: 4021
            chain headers: 323
                 flowbits: 48
     flowbits not checked: 23
--------------------------------------------------
port rule counts
             tcp     udp    icmp      ip
     any     473      58     147      22
     src     177      17       0       0
     dst     778     153       0       0
    both       6      11       0       0
   total    1434     239     147      22
--------------------------------------------------
service rule counts          to-srv  to-cli
                   dcerpc:        7       4
                     dhcp:        2       2
                      dns:       28       7
                      ftp:       90       4
                 ftp-data:        1      97
                     http:     2082     256
                    http2:     2082     256
                     imap:       35     118
                      irc:        5       2
                 kerberos:        5       0
                     ldap:        0       1
                    mysql:        3       0
              netbios-dgm:        1       1
               netbios-ns:        4       3
              netbios-ssn:       69      17
                     nntp:        2       0
                     pop3:       23     118
                      rdp:        5       0
                      sip:        5       5
                     smtp:      130       2
                     snmp:       18       7
                     ssdp:        3       0
                      ssl:       20      42
                   sunrpc:       68       4
                   telnet:       12       6
                     tftp:        1       0
                     wins:        1       0
                    total:     4702     952
--------------------------------------------------
fast pattern groups
                      src: 59
                      dst: 158
                      any: 4
                to_server: 47
                to_client: 34
--------------------------------------------------
search engine
        fast pattern only: 4971
--------------------------------------------------
pcap DAQ configured to passive.

Snort successfully validated the configuration (with 0 warnings).
o")~   Snort exiting

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

--------------------------------------------------

o")~ Snort++ 3.1.28.0

--------------------------------------------------

Loading /usr/local/etc/snort/snort.lua:

Loading snort_defaults.lua:

Finished snort_defaults.lua:

Loading file_magic.lua:

Finished file_magic.lua:

ssh

host_cache

pop

so_proxy

stream_tcp

mms

smtp

gtp_inspect

packets

dce_http_proxy

stream_icmp

normalizer

ips

binder

wizard

appid

file_id

stream_udp

http2_inspect

http_inspect

ftp_data

search_engine

ftp_server

port_scan

dce_http_server

dce_smb

dce_tcp

netflow

iec104

cip

telnet

ssl

sip

rpc_decode

modbus

host_tracker

stream_user

stream_ip

back_orifice

trace

classifications

dnp3

active

process

ftp_client

decode

daq

alerts

stream

network

references

arp_spoof

output

hosts

dns

dce_udp

imap

file_policy

s7commplus

stream_file

Finished /usr/local/etc/snort/snort.lua:

Loading ips.rules:

Loading ../rules/snort3-community-rules/snort3-community.rules:

Finished ../rules/snort3-community-rules/snort3-community.rules:

Finished ips.rules:

--------------------------------------------------

ips policies rule stats

id loaded shared enabled file

0 4021 0 4021 /usr/local/etc/snort/snort.lua

--------------------------------------------------

rule counts

total rules loaded: 4021

text rules: 4021

option chains: 4021

chain headers: 323

flowbits: 48

flowbits not checked: 23

--------------------------------------------------

port rule counts

tcp udp icmp ip

any 473 58 147 22

src 177 17 0 0

dst 778 153 0 0

both 6 11 0 0

total 1434 239 147 22

--------------------------------------------------

service rule counts to-srv to-cli

dcerpc: 7 4

dhcp: 2 2

dns: 28 7

ftp: 90 4

ftp-data: 1 97

http: 2082 256

http2: 2082 256

imap: 35 118

irc: 5 2

kerberos: 5 0

ldap: 0 1

mysql: 3 0

netbios-dgm: 1 1

netbios-ns: 4 3

netbios-ssn: 69 17

nntp: 2 0

pop3: 23 118

rdp: 5 0

sip: 5 5

smtp: 130 2

snmp: 18 7

ssdp: 3 0

ssl: 20 42

sunrpc: 68 4

telnet: 12 6

tftp: 1 0

wins: 1 0

total: 4702 952

--------------------------------------------------

fast pattern groups

src: 59

dst: 158

any: 4

to_server: 47

to_client: 34

--------------------------------------------------

search engine

fast pattern only: 4971

--------------------------------------------------

pcap DAQ configured to passive.

Snort successfully validated the configuration (with 0 warnings).

o")~ Snort exiting

6. カスタムローカルルールを作成

# vi /usr/local/etc/rules/local.rules

alert icmp any any -> $HOME_NET any (msg:"ICMP connection test"; sid:1000001; rev:1;)

# vi /usr/local/etc/rules/local.rules

alert icmp any any -> $HOME_NET any (msg:"ICMP connection test"; sid:1000001; rev:1;)

7. 設定の検証

パラメーター -T を使用して構成をテストし、テスト・モードを使用可能にします

# snort -T -c /usr/local/etc/snort/snort.lua -R /usr/local/etc/rules/local.rules  --daq-dir /usr/local/lib/daq -i ens160 -l /var/log/snort

1	# snort -T -c /usr/local/etc/snort/snort.lua -R /usr/local/etc/rules/local.rules --daq-dir /usr/local/lib/daq -i ens160 -l /var/log/snort

次に、以下のコマンドを実行してテストを実行する

# snort -c /usr/local/etc/snort/snort.lua -R /usr/local/etc/rules/local.rules --daq-dir /usr/local/lib/daq -i ens160 -l /var/log/snort -A alert_fast -s 65535 -k none

1	# snort -c /usr/local/etc/snort/snort.lua -R /usr/local/etc/rules/local.rules --daq-dir /usr/local/lib/daq -i ens160 -l /var/log/snort -A alert_fast -s 65535 -k none

同じローカルネットワーク内の別のPCから本サーバーにpingを実行すると、下記のように本サーバーコンソール画面ににアラート行が書き出される

++ [0] ens160
08/19-10:53:10.149326 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.22 -> 192.168.11.83
08/19-10:53:10.149343 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.22 -> 192.168.11.83
08/19-10:53:10.149467 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22
08/19-10:53:11.159190 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.22 -> 192.168.11.83
08/19-10:53:11.159224 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.22 -> 192.168.11.83
08/19-10:53:11.159264 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22
08/19-10:53:11.159371 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22
08/19-10:53:12.167132 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.22 -> 192.168.11.83
08/19-10:53:12.167150 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.22 -> 192.168.11.83
08/19-10:53:12.167197 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22
08/19-10:53:12.167278 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22
08/19-10:53:13.177170 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.22 -> 192.168.11.83
08/19-10:53:13.177220 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.22 -> 192.168.11.83
08/19-10:53:13.177260 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22
08/19-10:53:13.177405 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22

++ [0] ens160

08/19-10:53:10.149326 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.22 -> 192.168.11.83

08/19-10:53:10.149343 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.22 -> 192.168.11.83

08/19-10:53:10.149467 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22

08/19-10:53:11.159190 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.22 -> 192.168.11.83

08/19-10:53:11.159224 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.22 -> 192.168.11.83

08/19-10:53:11.159264 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22

08/19-10:53:11.159371 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22

08/19-10:53:12.167132 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.22 -> 192.168.11.83

08/19-10:53:12.167150 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.22 -> 192.168.11.83

08/19-10:53:12.167197 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22

08/19-10:53:12.167278 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22

08/19-10:53:13.177170 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.22 -> 192.168.11.83

08/19-10:53:13.177220 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.22 -> 192.168.11.83

08/19-10:53:13.177260 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22

08/19-10:53:13.177405 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22

ログファイルに書き込む設定

# vi /usr/local/etc/snort/snort.lua

258行目当たり-- 7. configure outputsセクションの中に下記追加
alert_fast = { 
        file = true, 
        packet = false,
        limit = 10,
}

# vi /usr/local/etc/snort/snort.lua

258行目当たり-- 7. configure outputsセクションの中に下記追加

alert_fast = {

file = true,

packet = false,

limit = 10,

}

構文チェックを実行

# snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq

1	# snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq

今度は、-A alert_fastというオプションはつけずに、-l /var/log/snortというログ・ディレクトリを指定するオプションをつけ実行する

# snort -c /usr/local/etc/snort/snort.lua -R /usr/local/etc/rules/local.rules --daq-dir /usr/local/lib/daq -i ens160 -s 65535 -k none -l /var/log/snort/

1	# snort -c /usr/local/etc/snort/snort.lua -R /usr/local/etc/rules/local.rules --daq-dir /usr/local/lib/daq -i ens160 -s 65535 -k none -l /var/log/snort/

l別のPCからpingを実行するとlogsディレクトリをチェックすると、alert_fast.txtファイルが作成されている

# tail -f /var/log/snort/alert_fast.txt

08/19-10:58:51.281913 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22
08/19-10:58:51.281994 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22
08/19-10:58:52.293533 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.22 -> 192.168.11.83
08/19-10:58:52.293553 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.22 -> 192.168.11.83
08/19-10:58:52.293596 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22
08/19-10:58:52.293690 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22
08/19-10:58:53.308536 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.22 -> 192.168.11.83
08/19-10:58:53.308557 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.22 -> 192.168.11.83
08/19-10:58:53.308597 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22
08/19-10:58:53.308676 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22

# tail -f /var/log/snort/alert_fast.txt

08/19-10:58:51.281913 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22

08/19-10:58:51.281994 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22

08/19-10:58:52.293533 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.22 -> 192.168.11.83

08/19-10:58:52.293553 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.22 -> 192.168.11.83

08/19-10:58:52.293596 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22

08/19-10:58:52.293690 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22

08/19-10:58:53.308536 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.22 -> 192.168.11.83

08/19-10:58:53.308557 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.22 -> 192.168.11.83

08/19-10:58:53.308597 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22

08/19-10:58:53.308676 [**] [1:1000001:1] "ICMP connection test" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.22

snort.luaにローカルルールを含める

# vi /usr/local/etc/snort/snort.lua

198行目あたりipsセクションの中に追加
rules = [[ 
    include $RULE_PATH/snort3-community-rules/snort3-community.rules
    include $RULE_PATH/local.rules
    ]]

# vi /usr/local/etc/snort/snort.lua

198行目あたりipsセクションの中に追加

rules = [[

include $RULE_PATH/snort3-community-rules/snort3-community.rules

include $RULE_PATH/local.rules

]]

8. Snort用のユーザー作成

Snort用の非ログインシステムユーザーアカウントを作成

# useradd -r -s /usr/sbin/nologin -M -c SNORT_IDS snort

1	# useradd -r -s /usr/sbin/nologin -M -c SNORT_IDS snort

9. Snort用のsystemdサービスユニットを作成

# vi /etc/systemd/system/snort3.service

下記内容を記述
[Unit]
Description=Snort Daemon
After=syslog.target network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/snort --daq-dir /usr/local/lib/daq -c /usr/local/etc/snort/snort.lua -s 65535 -k none -l /var/log/snort -D -i ens160 -m 0x1b -u snort -g snort
ExecStop=/bin/kill -9 $MAINPID

[Install]
WantedBy=multi-user.target

# vi /etc/systemd/system/snort3.service

下記内容を記述

[Unit]

Description=Snort Daemon

After=syslog.target network.target

[Service]

Type=simple

ExecStart=/usr/local/bin/snort --daq-dir /usr/local/lib/daq -c /usr/local/etc/snort/snort.lua -s 65535 -k none -l /var/log/snort -D -i ens160 -m 0x1b -u snort -g snort

ExecStop=/bin/kill -9 $MAINPID

[Install]

WantedBy=multi-user.target

systemdの設定をリロードする

# systemctl daemon-reload

1	# systemctl daemon-reload

ログファイルの所有権とパーミッションを設定

# chmod -R 5775 /var/log/snort
# chown -R snort:snort /var/log/snort

1 2	# chmod -R 5775 /var/log/snort # chown -R snort:snort /var/log/snort

システム起動時にSnortを起動し、実行できるようにする

# systemctl enable --now snort3
Created symlink /etc/systemd/system/multi-user.target.wants/snort3.service → /etc/systemd/system/snort3.service.

1 2	# systemctl enable --now snort3 Created symlink /etc/systemd/system/multi-user.target.wants/snort3.service → /etc/systemd/system/snort3.service.

ステータスチェック

# systemctl status snort3
● snort3.service - Snort Daemon
   Loaded: loaded (/etc/systemd/system/snort3.service; enabled; vendor preset: disabled)
   Active: active (running) since Sat 2023-08-19 11:18:11 JST; 1min 31s ago
 Main PID: 136931 (snort)
    Tasks: 2 (limit: 22884)
   Memory: 270.4M
   CGroup: /system.slice/snort3.service
           mq136931 /usr/local/bin/snort --daq-dir /usr/local/lib/daq -c /usr/local/etc/snort/snort.lua -s 65535 -k none>

Aug 19 11:18:11 Lepard systemd[1]: Started Snort Daemon.

# systemctl status snort3

● snort3.service - Snort Daemon

Loaded: loaded (/etc/systemd/system/snort3.service; enabled; vendor preset: disabled)

Active: active (running) since Sat 2023-08-19 11:18:11 JST; 1min 31s ago

Main PID: 136931 (snort)

Tasks: 2 (limit: 22884)

Memory: 270.4M

CGroup: /system.slice/snort3.service

mq136931 /usr/local/bin/snort --daq-dir /usr/local/lib/daq -c /usr/local/etc/snort/snort.lua -s 65535 -k none>

Aug 19 11:18:11 Lepard systemd[1]: Started Snort Daemon.

Tripwire インストール

1.ダウンロード、インストール

# cd /usr/local/src
# wget https://rpmfind.net/linux/epel/8/Everything/x86_64/Packages/t/tripwire-2.4.3.7-5.el8.x86_64.rpm
# rpm -Uvh tripwire-2.4.3.7-5.el8.x86_64.rpm

# cd /usr/local/src

# wget https://rpmfind.net/linux/epel/8/Everything/x86_64/Packages/t/tripwire-2.4.3.7-5.el8.x86_64.rpm

# rpm -Uvh tripwire-2.4.3.7-5.el8.x86_64.rpm

2.パスフレーズ設定

サイトパスフレーズとローカルパスフレーズを設定する

# tripwire-setup-keyfiles

1	# tripwire-setup-keyfiles

----------------------------------------------
The Tripwire site and local passphrases are used to sign a variety of
files, such as the configuration, policy, and database files.
Passphrases should be at least 8 characters in length and contain both
letters and numbers.
See the Tripwire manual for more information.
----------------------------------------------
Creating key files...
(When selecting a passphrase, keep in mind that good passphrases typically
have upper and lower case letters, digits and punctuation marks, and are
at least 8 characters in length.)
Enter the site keyfile passphrase: ←任意の「サイトパスフレーズ」を入力
Verify the site keyfile passphrase: ←再度「サイトパスフレーズ」を入力
Generating key (this may take several minutes)...Key generation complete.
(When selecting a passphrase, keep in mind that good passphrases typically
have upper and lower case letters, digits and punctuation marks, and are
at least 8 characters in length.)
Enter the local keyfile passphrase: ←任意の「ローカルパスフレーズ」を入力
Verify the local keyfile passphrase: ←再度「ローカルパスフレーズ」を入力
Generating key (this may take several minutes)...Key generation complete.
----------------------------------------------
Signing configuration file...
Please enter your site passphrase: ←「サイトパスフレーズ」を入力
Wrote configuration file: /etc/tripwire/tw.cfg
A clear-text version of the Tripwire configuration file:
/etc/tripwire/twcfg.txt
has been preserved for your inspection. It is recommended that you
move this file to a secure location and/or encrypt it in place (using a
tool such as GPG, for example) after you have examined it.
----------------------------------------------
Signing policy file...
Please enter your site passphrase: ←「サイトパスフレーズ」を入力
Wrote policy file: /etc/tripwire/tw.pol
A clear-text version of the Tripwire policy file:
/etc/tripwire/twpol.txt
～中略～
default values from the current configuration file are used.

----------------------------------------------

The Tripwire site and local passphrases are used to sign a variety of

files, such as the configuration, policy, and database files.

Passphrases should be at least 8 characters in length and contain both

letters and numbers.

See the Tripwire manual for more information.

----------------------------------------------

Creating key files...

(When selecting a passphrase, keep in mind that good passphrases typically

have upper and lower case letters, digits and punctuation marks, and are

at least 8 characters in length.)

Enter the site keyfile passphrase: ←任意の「サイトパスフレーズ」を入力

Verify the site keyfile passphrase: ←再度「サイトパスフレーズ」を入力

Generating key (this may take several minutes)...Key generation complete.

(When selecting a passphrase, keep in mind that good passphrases typically

have upper and lower case letters, digits and punctuation marks, and are

at least 8 characters in length.)

Enter the local keyfile passphrase: ←任意の「ローカルパスフレーズ」を入力

Verify the local keyfile passphrase: ←再度「ローカルパスフレーズ」を入力

Generating key (this may take several minutes)...Key generation complete.

----------------------------------------------

Signing configuration file...

Please enter your site passphrase: ←「サイトパスフレーズ」を入力

Wrote configuration file: /etc/tripwire/tw.cfg

A clear-text version of the Tripwire configuration file:

/etc/tripwire/twcfg.txt

has been preserved for your inspection. It is recommended that you

move this file to a secure location and/or encrypt it in place (using a

tool such as GPG, for example) after you have examined it.

----------------------------------------------

Signing policy file...

Please enter your site passphrase: ←「サイトパスフレーズ」を入力

Wrote policy file: /etc/tripwire/tw.pol

A clear-text version of the Tripwire policy file:

/etc/tripwire/twpol.txt

～中略～

default values from the current configuration file are used.

3.Tripwire の設定

①設定ファイル編集

# vi /etc/tripwire/twcfg.txt

9 行目あたり
行頭に「#」を追加し、その下の行に「LOOSEDIRECTORYCHECKING =true」を追加します。

12 行目あたり
行頭に「#」を追加し、その下の行に「REPORTLEVEL =4」を追加します。
レベル4 にすることで「0 」～「4 」までの5 段階中、最も詳細なレポートが表示されます。
#REPORTLEVEL =3
REPORTLEVEL =4

# vi /etc/tripwire/twcfg.txt

9 行目あたり

行頭に「#」を追加し、その下の行に「LOOSEDIRECTORYCHECKING =true」を追加します。

12 行目あたり

行頭に「#」を追加し、その下の行に「REPORTLEVEL =4」を追加します。

レベル4 にすることで「0 」～「4 」までの5 段階中、最も詳細なレポートが表示されます。

#REPORTLEVEL =3

REPORTLEVEL =4

②Tripwire 設定ファイル(暗号署名版)を作成

# twadmin -m F -c /etc/tripwire/tw.cfg -S /etc/tripwire/site.key /etc/tripwire/twcfg.txt
Please enter your site passphrase: ←サイトパスフレーズを入力
Wrote configuration file: /etc/tripwire/tw.cfg

# twadmin -m F -c /etc/tripwire/tw.cfg -S /etc/tripwire/site.key /etc/tripwire/twcfg.txt

Please enter your site passphrase: ←サイトパスフレーズを入力

Wrote configuration file: /etc/tripwire/tw.cfg

③Tripwire 設定ファイル(テキスト版)削除

# rm -f /etc/tripwire/twcfg.txt

1	# rm -f /etc/tripwire/twcfg.txt

④ポリシーファイル設定

# cd /etc/tripwire/
# vi twpolmake.pl

1 2	# cd /etc/tripwire/ # vi twpolmake.pl

twpolmake.plの内容

#!/usr/bin/perl
# Tripwire Policy File customize tool
#
$POLFILE=$ARGV[0];

open(POL,"$POLFILE") or die "open error: $POLFILE" ;
my($myhost,$thost) ;
my($sharp,$tpath,$cond) ;
my($INRULE) = 0 ;

while (<POL>) {
chomp;
if (($thost) = /^HOSTNAME\s*=\s*(.*)\s*;/) {
$myhost = `hostname` ; chomp($myhost) ;
if ($thost ne $myhost) {
$_="HOSTNAME=\"$myhost\";" ;
}
}
elsif ( /^{/ ) {
$INRULE=1 ;
}
elsif ( /^}/ ) {
$INRULE=0 ;
}
elsif ($INRULE == 1 and ($sharp,$tpath,$cond) = /^(\s*\#?\s*)(\/\S+)\b(\s+->\s+.+)$/) {
$ret = ($sharp =~ s/\#//g) ;
if ($tpath eq '/sbin/e2fsadm' ) {
$cond =~ s/;\s+(tune2fs.*)$/; \#$1/ ;
}
if (! -s $tpath) {
$_ = "$sharp#$tpath$cond" if ($ret == 0) ;
}
else {
$_ = "$sharp$tpath$cond" ;
}
}
print "$_\n" ;
}
close(POL) ;

#!/usr/bin/perl

# Tripwire Policy File customize tool

$POLFILE=$ARGV[0];

open(POL,"$POLFILE") or die "open error: $POLFILE" ;

my($myhost,$thost) ;

my($sharp,$tpath,$cond) ;

my($INRULE) = 0 ;

while (<POL>) {

chomp;

if (($thost) = /^HOSTNAME\s*=\s*(.*)\s*;/) {

$myhost = `hostname` ; chomp($myhost) ;

if ($thost ne $myhost) {

$_="HOSTNAME=\"$myhost\";" ;

}

elsif ( /^{/ ) {

$INRULE=1 ;

}

elsif ( /^}/ ) {

$INRULE=0 ;

}

elsif ($INRULE == 1 and ($sharp,$tpath,$cond) = /^(\s*\#?\s*)(\/\S+)\b(\s+->\s+.+)$/) {

$ret = ($sharp =~ s/\#//g) ;

if ($tpath eq '/sbin/e2fsadm' ) {

$cond =~ s/;\s+(tune2fs.*)$/; \#$1/ ;

}

if (! -s $tpath) {

$_ = "$sharp#$tpath$cond" if ($ret == 0) ;

}

else {

$_ = "$sharp$tpath$cond" ;

}

print "$_\n" ;

}

close(POL) ;

⑤ポリシーファイル最適化

# perl /etc/tripwire/twpolmake.pl /etc/tripwire/twpol.txt > /etc/tripwire/twpol.txt.new

1	# perl /etc/tripwire/twpolmake.pl /etc/tripwire/twpol.txt > /etc/tripwire/twpol.txt.new

⑥最適化済ポリシーファイルを元に、ポリシーファイル(暗号署名版)作成

# twadmin -m P -c /etc/tripwire/tw.cfg -p /etc/tripwire/tw.pol -S /etc/tripwire/site.key /etc/tripwire/twpol.txt.new
Please enter your site passphrase: ←サイトパスフレーズを入力
Wrote policy file: /etc/tripwire/tw.pol

# twadmin -m P -c /etc/tripwire/tw.cfg -p /etc/tripwire/tw.pol -S /etc/tripwire/site.key /etc/tripwire/twpol.txt.new

Please enter your site passphrase: ←サイトパスフレーズを入力

Wrote policy file: /etc/tripwire/tw.pol

⑦データベースを作成、動作確認

# tripwire -m i -s -c /etc/tripwire/tw.cfg
Please enter your local passphrase: ←ローカルパスフレーズを入力

1 2	# tripwire -m i -s -c /etc/tripwire/tw.cfg Please enter your local passphrase: ←ローカルパスフレーズを入力

テスト用ファイルを作成

# echo test > /root/test.txt

1	# echo test > /root/test.txt

Tripwire の動作確認
# tripwire -m c -s -c /etc/tripwire/tw.cfg
下記のように表示されればOK
Open Source Tripwire(R) 2.4.3.7 Integrity Check Report

Report generated by:          root
Report created on:            Sat 12 Aug 2023 02:43:38 PM JST
Database last updated on:     Never

===============================================================================
Report Summary:
===============================================================================

Host name:                    Lepard
Host IP address:              192.168.11.83
Host ID:                      None
Policy file used:             /etc/tripwire/tw.pol
Configuration file used:      /etc/tripwire/tw.cfg
Database file used:           /var/lib/tripwire/Lepard.twd
Command line used:            tripwire -m c -s -c /etc/tripwire/tw.cfg

<中略>

-------------------------------------------------------------------------------

Added:
"/root/test.txt"

===============================================================================
Error Report:
===============================================================================

No Errors

-------------------------------------------------------------------------------
*** End of report ***

Open Source Tripwire 2.4 Portions copyright 2000-2018 Tripwire, Inc.  Tripwire is a registered
trademark of Tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY;
for details use --version. This is free software which may be redistributed
or modified only under certain conditions; see COPYING for details.
All rights reserved.

Tripwire の動作確認

# tripwire -m c -s -c /etc/tripwire/tw.cfg

下記のように表示されればOK

Open Source Tripwire(R) 2.4.3.7 Integrity Check Report

Report generated by: root

Report created on: Sat 12 Aug 2023 02:43:38 PM JST

Database last updated on: Never

===============================================================================

Report Summary:

===============================================================================

Host name: Lepard

Host IP address: 192.168.11.83

Host ID: None

Policy file used: /etc/tripwire/tw.pol

Configuration file used: /etc/tripwire/tw.cfg

Database file used: /var/lib/tripwire/Lepard.twd

Command line used: tripwire -m c -s -c /etc/tripwire/tw.cfg

<中略>

-------------------------------------------------------------------------------

Added:

"/root/test.txt"

===============================================================================

Error Report:

===============================================================================

No Errors

-------------------------------------------------------------------------------

*** End of report ***

trademark of Tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY;

for details use --version. This is free software which may be redistributed

or modified only under certain conditions; see COPYING for details.

テスト用ファイルを削除

# rm -f /root/test.txt

1	# rm -f /root/test.txt

⑧Tripwire 定期実行スクリプト

# cd /var/www/system
# vi tripwire.sh

1 2	# cd /var/www/system # vi tripwire.sh

tripwire.shの内容

#!/bin/bash

PATH=/usr/sbin:/usr/bin:/bin:/usr/local/tripwire/sbin

# パスフレーズ設定
LOCALPASS= ←ローカルパスフレーズ
SITEPASS= 　←サイトパスフレーズ

cd /etc/tripwire

# Tripwireチェック実行
tripwire -m c -s -c tw.cfg|mail -s "Tripwire(R) Integrity Check Report in `hostname`" root

# ポリシーファイル最新化
twadmin -m p -c tw.cfg -p tw.pol -S site.key > twpol.txt
perl twpolmake.pl twpol.txt > twpol.txt.new
twadmin -m P -c tw.cfg -p tw.pol -S site.key -Q $SITEPASS twpol.txt.new > /dev/null
rm -f twpol.txt* *.bak

# データベース最新化
rm -f /usr/local/tripwire/lib/tripwire/*.twd*
tripwire -m i -s -c tw.cfg -P $LOCALPASS

#!/bin/bash

PATH=/usr/sbin:/usr/bin:/bin:/usr/local/tripwire/sbin

# パスフレーズ設定

LOCALPASS= ←ローカルパスフレーズ

SITEPASS= 　←サイトパスフレーズ

cd /etc/tripwire

# Tripwireチェック実行

tripwire -m c -s -c tw.cfg|mail -s "Tripwire(R) Integrity Check Report in `hostname`" root

# ポリシーファイル最新化

twadmin -m p -c tw.cfg -p tw.pol -S site.key > twpol.txt

perl twpolmake.pl twpol.txt > twpol.txt.new

twadmin -m P -c tw.cfg -p tw.pol -S site.key -Q $SITEPASS twpol.txt.new > /dev/null

rm -f twpol.txt* *.bak

# データベース最新化

rm -f /usr/local/tripwire/lib/tripwire/*.twd*

tripwire -m i -s -c tw.cfg -P $LOCALPASS

⑨Tripwire 自動実行スクリプト実行設定

# chmod 700 tripwire.sh

1	# chmod 700 tripwire.sh

cron に追加
# crontab -e
0 3 * * * /var/www/system/tripwire.sh

cron に追加

# crontab -e

0 3 * * * /var/www/system/tripwire.sh

参考: メールで結果報告用スクリプト

#!/bin/bash

PATH=/usr/sbin:/usr/bin:/bin:/usr/local/tripwire/sbin

# パスフレーズ設定
LOCALPASS=xxxxx # ローカルキーパスフレーズ
SITEPASS=xxxxx # サイトキーパスフレーズ

#通知先メールアドレス指定
MAIL="<your mailaddress> "

cd /etc/tripwire

# Tripwireチェック実行
tripwire -m c -s -c tw.cfg|mail -s "Tripwire(R) Integrity Check Report in `hostname`" $MAIL

# ポリシーファイル最新化
twadmin -m p -c tw.cfg -p tw.pol -S site.key > twpol.txt
perl twpolmake.pl twpol.txt > twpol.txt.new
twadmin -m P -c tw.cfg -p tw.pol -S site.key -Q $SITEPASS twpol.txt.new > /dev/null
rm -f twpol.txt* *.bak

# データベース最新化
rm -f /usr/local/tripwire/lib/tripwire/*.twd*
tripwire -m i -s -c tw.cfg -P $LOCALPASS

#!/bin/bash

PATH=/usr/sbin:/usr/bin:/bin:/usr/local/tripwire/sbin

# パスフレーズ設定

LOCALPASS=xxxxx # ローカルキーパスフレーズ

SITEPASS=xxxxx # サイトキーパスフレーズ

#通知先メールアドレス指定

MAIL="<your mailaddress> "

cd /etc/tripwire

# Tripwireチェック実行

tripwire -m c -s -c tw.cfg|mail -s "Tripwire(R) Integrity Check Report in `hostname`" $MAIL

# ポリシーファイル最新化

twadmin -m p -c tw.cfg -p tw.pol -S site.key > twpol.txt

perl twpolmake.pl twpol.txt > twpol.txt.new

twadmin -m P -c tw.cfg -p tw.pol -S site.key -Q $SITEPASS twpol.txt.new > /dev/null

rm -f twpol.txt* *.bak

# データベース最新化

rm -f /usr/local/tripwire/lib/tripwire/*.twd*

tripwire -m i -s -c tw.cfg -P $LOCALPASS

次のコマンドを実行し、メールが届いていることを確認する

# /var/www/system/tripwire.sh

1	# /var/www/system/tripwire.sh

Chkrootkit インストール

①chkrootkit をダウンロード、インストール

# cd /usr/local/src
# wget https://launchpad.net/chkrootkit/main/0.55/+download/chkrootkit-0.55.tar.gz
# tar xvf chkrootkit-0.55.tar.gz

# cd /usr/local/src

# wget https://launchpad.net/chkrootkit/main/0.55/+download/chkrootkit-0.55.tar.gz

# tar xvf chkrootkit-0.55.tar.gz

➁/root/bin ディレクトリを作成し、そのディレクトリにchkrootkit コマンドを移動

# mkdir -p /root/bin
# mv chkrootkit-0.55/chkrootkit /root/bin

1 2	# mkdir -p /root/bin # mv chkrootkit-0.55/chkrootkit /root/bin

➂chkrootkit を確認

# chkrootkit | grep INFECTED

1	# chkrootkit \| grep INFECTED

何も表示されなければ問題ありませんが
Searching for Linux.Xor.DDoS … INFECTED: Possible Malicious Linux.Xor.DDoS installed
と表示される場合
/tmp 下に、実行可能形式のファイルがあると、それを Linux.Xor.DDoS として検出するようですので
/tmp配下にある実行可能形式のファイルを実行不可にするか問題なければ削除します

④chkrootkit 定期実行スクリプトの作成と権限変更

chkrootkit実行スクリプトを毎日自動実行されるディレクトリへ作成

# vi /etc/cron.daily/chkrootkit

1	# vi /etc/cron.daily/chkrootkit

定期実行スクリプトの内容

#!/bin/bash

PATH=/usr/bin:/bin:/root/bin

LOG=/tmp/$(basename ${0})

# chkrootkit実行
chkrootkit > $LOG 2>&1

# ログ出力
cat $LOG | logger -t $(basename ${0})

# SMTPSのbindshell誤検知対応
if [ ! -z "$(grep 465 $LOG)" ] && \
[ -z $(/usr/sbin/lsof -i:465|grep bindshell) ]; then
sed -i '/465/d' $LOG
fi

# upstartパッケージ更新時のSuckit誤検知対応
if [ ! -z "$(grep Suckit $LOG)" ] && \
[ -z "$(rpm -V `rpm -qf /sbin/init`)" ]; then
sed -i '/Suckit/d' $LOG
fi

# rootkit検知時のみroot宛メール送信
[ ! -z "$(grep INFECTED $LOG)" ] && \
grep INFECTED $LOG | mail -s "chkrootkit report in `hostname`" root

#!/bin/bash

PATH=/usr/bin:/bin:/root/bin

LOG=/tmp/$(basename ${0})

# chkrootkit実行

chkrootkit > $LOG 2>&1

# ログ出力

cat $LOG | logger -t $(basename ${0})

# SMTPSのbindshell誤検知対応

if [ ! -z "$(grep 465 $LOG)" ] && \

[ -z $(/usr/sbin/lsof -i:465|grep bindshell) ]; then

sed -i '/465/d' $LOG

# upstartパッケージ更新時のSuckit誤検知対応

if [ ! -z "$(grep Suckit $LOG)" ] && \

[ -z "$(rpm -V `rpm -qf /sbin/init`)" ]; then

sed -i '/Suckit/d' $LOG

# rootkit検知時のみroot宛メール送信

[ ! -z "$(grep INFECTED $LOG)" ] && \

grep INFECTED $LOG | mail -s "chkrootkit report in `hostname`" root

chkrootkit実行スクリプトへ実行権限付加

# chmod 700 /etc/cron.daily/chkrootkit

1	# chmod 700 /etc/cron.daily/chkrootkit

⑥chkrootkit が使用するコマンドをバックアップ
chkrootkit が使用するコマンドが改ざんされた場合、rootkit を検出できなくなるので、
これらのコマンドをバックアップしておきます。
必要な場合は、バックアップしたコマンドを使用してchkrootkit を実行します

# cd /root
# mkdir /root/chkrootkit_cmd
# cp `which --skip-alias awk cut echo egrep find head id ls netstat ps strings sed ssh uname` chkrootkit_cmd/
# ls -l /root/chkrootkit_cmd/
total 2512
-rwxr-xr-x. 1 root root 685712 Aug 19 12:18 awk
-rwxr-xr-x. 1 root root  50784 Aug 19 12:18 cut
-rwxr-xr-x. 1 root root  38328 Aug 19 12:18 echo
-rwxr-xr-x. 1 root root     28 Aug 19 12:18 egrep
-rwxr-xr-x. 1 root root 261712 Aug 19 12:18 find
-rwxr-xr-x. 1 root root  46672 Aug 19 12:18 head
-rwxr-xr-x. 1 root root  46608 Aug 19 12:18 id
-rwxr-xr-x. 1 root root 143328 Aug 19 12:18 ls
-rwxr-xr-x. 1 root root 162416 Aug 19 12:18 netstat
-rwxr-xr-x. 1 root root 137936 Aug 19 12:18 ps
-rwxr-xr-x. 1 root root 118024 Aug 19 12:18 sed
-rwxr-xr-x. 1 root root 775648 Aug 19 12:18 ssh
-rwxr-xr-x. 1 root root  38368 Aug 19 12:18 strings
-rwxr-xr-x. 1 root root  38312 Aug 19 12:18 uname

# cd /root

# mkdir /root/chkrootkit_cmd

# cp `which --skip-alias awk cut echo egrep find head id ls netstat ps strings sed ssh uname` chkrootkit_cmd/

# ls -l /root/chkrootkit_cmd/

total 2512

-rwxr-xr-x. 1 root root 685712 Aug 19 12:18 awk

-rwxr-xr-x. 1 root root 50784 Aug 19 12:18 cut

-rwxr-xr-x. 1 root root 38328 Aug 19 12:18 echo

-rwxr-xr-x. 1 root root 28 Aug 19 12:18 egrep

-rwxr-xr-x. 1 root root 261712 Aug 19 12:18 find

-rwxr-xr-x. 1 root root 46672 Aug 19 12:18 head

-rwxr-xr-x. 1 root root 46608 Aug 19 12:18 id

-rwxr-xr-x. 1 root root 143328 Aug 19 12:18 ls

-rwxr-xr-x. 1 root root 162416 Aug 19 12:18 netstat

-rwxr-xr-x. 1 root root 137936 Aug 19 12:18 ps

-rwxr-xr-x. 1 root root 118024 Aug 19 12:18 sed

-rwxr-xr-x. 1 root root 775648 Aug 19 12:18 ssh

-rwxr-xr-x. 1 root root 38368 Aug 19 12:18 strings

-rwxr-xr-x. 1 root root 38312 Aug 19 12:18 uname

⑦コピーしたコマンドにchkrootkit を実行

# chkrootkit -p /root/chkrootkit_cmd | grep INFECTED

1	# chkrootkit -p /root/chkrootkit_cmd \| grep INFECTED

何も表示されなければ問題ありません

⑧バックアップしたコマンドを圧縮

# tar zcvf chkrootkit_cmd.tar.gz chkrootkit_cmd
chkrootkit_cmd/
chkrootkit_cmd/awk
chkrootkit_cmd/cut
chkrootkit_cmd/echo
chkrootkit_cmd/egrep
chkrootkit_cmd/find
chkrootkit_cmd/head
chkrootkit_cmd/id
chkrootkit_cmd/ls
chkrootkit_cmd/netstat
chkrootkit_cmd/ps
chkrootkit_cmd/strings
chkrootkit_cmd/sed
chkrootkit_cmd/ssh
chkrootkit_cmd/uname

# tar zcvf chkrootkit_cmd.tar.gz chkrootkit_cmd

chkrootkit_cmd/

chkrootkit_cmd/awk

chkrootkit_cmd/cut

chkrootkit_cmd/echo

chkrootkit_cmd/egrep

chkrootkit_cmd/find

chkrootkit_cmd/head

chkrootkit_cmd/id

chkrootkit_cmd/ls

chkrootkit_cmd/netstat

chkrootkit_cmd/ps

chkrootkit_cmd/strings

chkrootkit_cmd/sed

chkrootkit_cmd/ssh

chkrootkit_cmd/uname

# ls -l
total 1140
-rw-------. 1 root root    1464 Aug 18 15:00 anaconda-ks.cfg
drwxr-xr-x. 2 root root      24 Aug 19 12:16 bin
drwxr-xr-x. 2 root root     172 Aug 19 12:18 chkrootkit_cmd
-rw-r--r--. 1 root root 1162479 Aug 19 12:19 chkrootkit_cmd.tar.gz

# ls -l

total 1140

-rw-------. 1 root root 1464 Aug 18 15:00 anaconda-ks.cfg

drwxr-xr-x. 2 root root 24 Aug 19 12:16 bin

drwxr-xr-x. 2 root root 172 Aug 19 12:18 chkrootkit_cmd

-rw-r--r--. 1 root root 1162479 Aug 19 12:19 chkrootkit_cmd.tar.gz

⑨chkrootkit使用コマンド(圧縮版)をroot宛にメール送信

# echo|mail -a chkrootkit_cmd.tar.gz -s chkrootkit_cmd.tar.gz root

1	# echo\|mail -a chkrootkit_cmd.tar.gz -s chkrootkit_cmd.tar.gz root

⑩Windows にchkrootkit_cmd.tar.gz ファイルをダウンロードして退避

⑪バックアップしたサーバー上のコマンドを削除

# rm -f chkrootkit_cmd.tar.gz

1	# rm -f chkrootkit_cmd.tar.gz

ページのトップへ