S-38.153 exercise: Advanced Intrusion Detection Environment
Teemu Vainio
48353V
04.10.2002
Table of contents
1 Introduction
2 Operation
3 Installation
4 Configuration
5 Usage
6 Exercise
7 Solution
1 Introduction
Advanced Intrusion Detection System (AIDE) is a system which is designed to check the system for possible intrusions. This document focuses on how to use AIDE and configure it for intrusion prevention. Firstly the operation of AIDE is explained and then the installation and usage. Finally, an exercise and a solution is documented.
2 Operation
There are several different approaches to intrusion detection. Network IDSes follow the network traffic and try to make educated guesses of possible intrusions. Then there are intrusion detection systems based on file system integrity. These store the initial state of the files and then later on allow checks for possible changes in the system.
These intrusion detection systems usually work by allowing administrator to take snapshots of the system. Practically this means that before a system is put online, everything (or almost everything) concerning the state of files is logged to a database for possible future comparison.
If at some point administrator speculates possible intrusion he can check the current state of the files against the initial snapshot. This makes it easy to see if some core files have been hacked or replaced altogether.
AIDE works exactly like this and it is easy to use. It also offers an easy way of configuration and rule customization . AIDE works by creating a snapshot of the files of the system. It will take timestamps, permissions, sizes and checksums of the wanted files. Since AIDE offers md5, sha1, rmd160 and tiger checksums it makes it quite hard to mess up with the file database.
Figures 1. and 2. show the operation of AIDE.
Figure 1
Figure 2
3 Installation
Before you install AIDE make sure you have the following tools: GCC (or some other ANSI C compiler), GNU Flex, Bison, Make. These are usually installed on every system. You also need mhash which you can download from
Use gunzip and tar to unpack the mhash package and install it. Here are the steps
1)gunzip mhash-0.8.17.tar.gz
2)tar –xvf mhash-0.8.17.tar
3)su –
4)go to mhash directory
5)./configure
6)make
7)make install
AIDE is easy to install. Follow these steps to perform installation:
1)Download the latest version. (0.9 was the newest when writing this document) It can be downloaded from ftp://ftp.cs.tut.fi/pub/src/gnu/aide-0.9.tar.gz
2)Unpack the package (gunzip aide-0.9.tar.gz & tar –xvf aide-0.9.tar)
3)su to root, ie: su –
4)Go to the main AIDE directory
5)Compile AIDE with
- ./configure
- make
- make install
4 Configuration
AIDE is configured using aide.conf file. AIDE offers three types of configuration lines. Namely these are:
-Configuration lines
-Selection lines
-Macro lines
Configuration files are used to set configuration parameters and variables. Selection lines are used to name the files included in the database and macro lines to define and undefine variables.
AIDE can check the following things (first the actual configuration command, then the explanation):
p: permissions
i: inode
n: number of links
u: user
g: group
s: size
b: block count
m: mtime
a: atime
c: ctime
S: check for growing size
md5: md5 checksum
sha1: sha1 checksum
rmd160: rmd160 checksum
tiger: tiger checksum
R: p+i+n+u+g+s+m+c+md5
L: p+i+n+u+g
E: Empty group
>: Growing logfile p+u+g+i+n+S
(# Means comment)
In the configuration files you can also create custom rules such as:
ToughRule = p+i+n+u+g+m+c+s+b+tiger+md5+sha1
Then you have to decide what you want to include in the database:
/etc p+u+g #check permissions, user and group for etc
!/var/log/.* # don’t check the log dir
Usually you want to include files which are critical for the system, are most often replaced by hacked version or are most prone for worms and trojans etc.
What you probably don’t want to include in the configuration files are files which are changed often like log files etc.
5 Usage
AIDE is very easy and straightforward to use. To get the AIDE database (=snapshot of the system as specified in the configuration file) type:
/> aide --init
The created database, AIDE binaries and configuration files SHOULD be then placed on some secure media, in case a hacker manages to change the database and/or the binaries of the AIDE system.
When you want to check your system you should type:
/> aide --check
on the command line. This will check the database against the initial database and produce a report of the differences.
6 Exercise
The exercise tries to familiarize user with the AIDE system, its installation, usage and logic by simulating a hacker originated change in the system. In this case only a README file is changed, but in real case this could be some system critical service.
The exercise is to download, install and configure AIDE and to simulate a hacker attack. To summarize, perform the following:
1)Download and install AIDE
2)Configure AIDE to check only the AIDE installation files. So make a configuration file of your own which describes the environment of the snapshot. Also make sure that file changes are checked.
3)Init AIDE database.
4)Change README file found in AIDE main directory to readME.ME (This simulates a change in the system.)
5)Perform check of the database and see the report.
Using the same logic, you could try to init your database of the system critical directories and the place a rootkit in there!
7 Solution
Download the mhash package and AIDE files. Do the ./configure, make and make install commands as root.
This should then be the contents of the aide.conf file (there may be variations) :
#
# AIDE 0.9
#
# example configuration file
#
# IMPORTANT NOTE!! PLEASE READ
#
# This configuration file checks the integrity of the
# AIDE package.
#
# This file is not intended to be used as the primary aide.conf file #for
# your system. This file is intended to be a showcase for different
# features for aide.conf file.
#
# WRITE YOUR OWN CONFIGURATION FILE AND UNDERSTAND WHAT YOU ARE #WRITING
#
#
# Default values for the parameters are in comments before the
# corresponding line.
#
# The location of the database to be read.
database=file:[YOUR CHOSEN DATABASE PATH]/aide.db.new
# The location of the database to be written.
database_out=file:[YOUR CHOSEN DATABASE PATH]/aide.db.new
# Whether to gzip the output to database
# gzip_dbout=no
#verbose=5
verbose=5
#report_url=stdout
#other possibilities
#report_url=stderr
#NOT IMPLEMENTED report_url=mailto:
#report_url=file:/tmp/some_file.txt
#NOT IMPLEMENTED report_url=syslog:LOG_AUTH
report_url=stdout
# read by aide.
#p: permissions
#i:inode
#n:number of links
#u:user
#g:group
#s:size
#b:block count
#m:mtime
#a:atime
#c:ctime
#S:check for growing size
#md5:md5 checksum
#sha1:sha1 checksum
#rmd160: rmd160 checksum
#tiger: tiger checksum
#R:p+i+n+u+g+s+m+c+md5
#L:p+i+n+u+g
#E:Empty group
#>:Growing logfile p+u+g+i+n+S
#The following are available if you have mhash support enabled.
#haval:haval checksum
#gost:gost checksum
#crc32:crc32 checksum
# Rule definition
All=R+a+sha1+rmd160
# ignore_list is a special rule definition
# the attributes listed in it are not displayed in the
# final report
# Quite strict check
Norm=s+n+b+md5+sha1+rmd160
# The commented rules are just examples the rest are used by
# make check
#Selection regexp rule
[PATH OF INSTALLATION]/aide-0.9/*.* Norm
Then by typing:
/> aide --init
and changing README to readME.ME (mv README readME.ME)
and typing
/> aide --check
You should see something like:
[root@mymachine myuser]# aide --check
WARNING:Input and output database urls are the same.
open_dir():No such file or directory: [PATH OF INSTALLATION]/aide-0.9/README
Not implemented in db_readline_file 310
"@@end_db"AIDE found differences between database and filesystem!!
Start timestamp: 2002-10-04 21:01:17
Summary:
Total number of files=130,added files=1,removed files=1,changed files=0
Added files:
added:[PATH OF INSTALLATION]/aide-0.9/readME.ME
Removed files:
removed:[PATH OF INSTALLATION]/aide-0.9/README
[root@mymachine myuser]#