OSSEC Host-Based Intrusion Detection Guide

✍ Scribed by Rory Bray, Daniel Cid, Andrew Hay

• Publisher: Syngress
• Year: 2008
• Tongue: English
• Leaves: 335
• Edition: Pap/Cdr
• Category: Library

✦ Synopsis

This book is the definitive guide on the OSSEC Host-based Intrusion Detection system and frankly, to really use OSSEC you are going to need a definitive guide. Documentation has been available since the start of the OSSEC project but, due to time constraints, no formal book has been created to outline the various features and functions of the OSSEC product. This has left very important and powerful features of the product undocumented...until now! The book you are holding will show you how to install and configure OSSEC on the operating system of your choice and provide detailed examples to help prevent and mitigate attacks on your systems. -- Stephen Northcutt

OSSEC determines if a host has been compromised in this manner by taking the equivalent of a picture of the host machine in its original, unaltered state. This "picture" captures the most relevant information about that machine's configuration. OSSEC saves this "picture" and then constantly compares it to the current state of that machine to identify anything that may have changed from the original configuration. Now, many of these changes are necessary, harmless, and authorized, such as a system administrator installing a new software upgrade, patch, or application. But, then there are the not-so-harmless changes, like the installation of a rootkit, trojan horse, or virus. Differentiating between the harmless and the not-so-harmless changes determines whether the system administrator or security professional is managing a secure, efficient network or a compromised network which might be funneling credit card numbers out to phishing gangs or storing massive amounts of pornography creating significant liability for that organization.

Separating the wheat from the chaff is by no means an easy task. Hence the need for this book. The book is co-authored by Daniel Cid, who is the founder and lead developer of the freely available OSSEC host-based IDS. As such, readers can be certain they are reading the most accurate, timely, and insightful information on OSSEC.

• Nominee for Best Book Bejtlich read in 2008!
• http://taosecurity.blogspot.com/2008/12/best-book-bejtlich-read-in-2008.html

• Get Started with OSSEC
Get an overview of the features of OSSEC including commonly used terminology, pre-install preparation, and deployment considerations.
• Follow Steb-by-Step Installation Instructions
Walk through the installation process for the "local”, “agent”, and "server" install types on some of the most popular operating systems available.
• Master Configuration
Learn the basic configuration options for your install type and learn how to monitor log files, receive remote messages, configure email notification, and configure alert levels.
• Work With Rules
Extract key information from logs using decoders and how you can leverage rules to alert you of strange occurrences on your network.
• Understand System Integrity Check and Rootkit Detection
Monitor binary executable files, system configuration files, and the Microsoft Windows registry.
• Configure Active Response
Configure the active response actions you want and bind the actions to specific rules and sequence of events.
• Use the OSSEC Web User Interface
Install, configure, and use the community-developed, open source web interface available for OSSEC.
• Play in the OSSEC VMware Environment Sandbox
• Dig Deep into Data Log Mining
Take the “high art” of log analysis to the next level by breaking the dependence on the lists of strings or patterns to look for in the logs.

✦ Table of Contents

OSSEC Host-Based Intrusion Detection Guide
Copyright Page
Lead Authors
Contributors
Contents
About this Book
About the DVD
Foreword
Chapter 1: Getting Started with OSSEC
Introduction
Introducing Intrusion Detection
Network Intrusion Detection
Host-Based Intrusion Detection
File Integrity Checking
Registry Monitoring
Rootkit Detection
Active Response
Introducing OSSEC
Planning Your Deployment
Local Installation
Agent Installation
Server Installation
Which Type Is Right For Me?
Identifying OSSEC Pre-installation Considerations
Supported Operating Systems
Special Considerations
Microsoft Windows
Sun Solaris
Ubuntu Linux
Mac OS X
Summary
Solutions Fast Track
Frequently Asked Questions
Chapter 2: Installation
Introduction
Downloading OSSEC HIDS
Getting the Files
Preparing the System
Building and Installing
Performing Local Installation
Performing Server-Agent Installations
Installing the Server
Managing Agents
Installing Agents
Installing the Unix Agent
Installing the Windows Agent
Streamlining the Installations
Install Once, Copy Everywhere
Unix, Linux, and BSD
Push the Keys
Unix, Linux, and BSD
Summary
Solutions Fast Track
Frequently Asked Questions
Chapter 3: OSSEC HIDS Configuration
Introduction
Understanding the OSSEC HIDS Configuration File
Configuring Logging/Alerting Options
Alerting with Email
Configuring Email
Basic Email Configuration
Granular Email Configuration
Receiving Remote Events with Syslog
Configuring Database Output
Declaring Rule Files
Reading Log Files
Configuring Integrity Checking
Configuring an Agent
Configuring Advanced Options
Summary
Solutions Fast Track
Frequently Asked Questions
Chapter 4: Working with Rules
Introduction
Introducing Rules
Understanding the OSSEC HIDS Analysis Process
Predecoding Events
Decoding Events
Decoder Example: sshd Message
Decoder Example: vsftpd Message
Using the Option
Decoder Example: Cisco PIX Message
Decoder Example: Cisco IOS ACL Message
Understanding Rules
Atomic Rules
Writing a Rule
Composite Rules
Working with Real World Examples
Increasing the Severity Level of a Rule
Tuning Rule Frequency
Ignoring Rules
Ignoring IP Addresses
Correlating Multiple Snort Alerts
Ignoring Identity Change Events
Writing Decoders/Rules for Custom Applications
Deciding What Information to Extract
Creating the Decoders
Creating the Rules
Monitoring the Log File
Summary
Solutions Fast Track
Frequently Asked Questions
Chapter 5: System Integrity Check and Rootkit Detection
Introduction
Understanding System Integrity Check (syscheck)
Tuning syscheck
Working with syscheck Rules
Ignoring Specific Directories
Increasing the Alert Severity for Important Files
Increasing the Severity for Changes During the Weekend
Configuring Custom Syscheck Monitoring
Detecting Rootkits and Enforcing/Monitoring Policies
Detecting Rootkits on Linux, Unix, and BSD
Detecting Rootkits with Signatures
Monitoring and Enforcing Policy
Policy Monitoring Rules
The Rootcheck Queue
Summary
Solutions Fast Track
Frequently Asked Questions
Chapter 6: Active Response
Introduction
Introducing Active Response
Examining Active Response
Command
Active Response
Tying It Together
Creating a Simple Response
The Executable
The Command
The Response
Configuring a Response with Timeout
Host-Deny Command
Host-Deny Response
Summary
Solutions Fast Track
Frequently Asked Questions
Chapter 7: Using the OSSEC Web User Interface
Introduction
Introducing the OSSEC HIDS WUI
Identifying WUI Pre-installation Considerations
Downloading the WUI
Installing and Configuring the WUI
Advanced Installation Topics
Using htaccess for Multi-User Access
Enabling SSL Access
Optimizing PHP for Large OSSEC Deployments
Describing the WUI Components
Main
Available Agents
Latest Modified Files
Latest Events
Search
Alert Search Options
Results
Alert List
Integrity Checking
Latest Modified Files (for All Agents)
Dump Database
Stats
Stats Options
OSSEC Stats
OSSEC Stats Snapshot
Aggregate Values by Severity
Aggregate Values by Rule
Total Values per Hour
About
Summary
Solutions Fast Track
Frequently Asked Questions
Epilogue
From the Authors
Appendix A: Log Data Mining
Introduction
Data Mining Intro
Log Mining Intro
Log Mining Requirements
What We Mine For?
Deeper into Interesting
Conclusion
Endnotes
Appendix B: Implementing a Successful OSSEC Policy
The Purpose of Policy
Policy Guides
Your Policy Comes Before Implementation
Policy Drives the Process
Solutions Follow Requirements
Step 1: Pilot Your Policy
Assessing Your Environment
Information
Environment
Risk
Risk Tolerance
Learning about the Tool
Building Effective Requirements
Broad Focus on Availability, Integrity, and Confidentiality
Involve Others
Solve the Business Problem
Pilot Your Way to Success
Step 2: Assess Your Current Policy Framework
Policy Primer
Policy
Standard
Procedure
Guideline
Assessing What You Already Have
Step 3: Build and Implement Your Policies
Build Your Policy
Build Your Standard
Implementation and Adoption
Keep in Mind
About Michael Santarcangelo
Appendix C: Rootkit Detection Using Host-based IDS
Introduction
History
Types of Rootkits
Kernel-Level Rootkits
Application or File-Level
Host-based IDS as a Solution...
Unauthorized Listening Ports and Processes
Files with Permissions that Are Uncommon for the File Type
Files that Match a Predefined List of Rootkit "Fingerprints"
Modification of Key Files
Watch for Network Cards that Are Listening to Network Traffic
Users Who Have UID 0
Network Anomaly Detection
HIDS Advantages
HIDS Disadvantages
Future Developments
Appendix D: The OSSEC VMware Guest Image
Introduction
Using the OSSEC VMware Guest
OSSEC VMware Image Minimum Requirements
VMware Guest Information
Creating Your Own OSSEC VMware Image
Downloading the Ubuntu 7.10 ISO
Preparing the VMware Guest Image
Configuring the Base Operating System
Installing the OSSEC HIDS
Installing the OSSEC HIDS WUI
Conclusion
Index