SCSC 455 Computer Security 2011 Spring

Chapter 4

File Security

Index

File permissions Monitor log files File integrity

File Security Files are crucial asset to protect

contain business and personal data contain system / security configuration data

Unauthorized users may want to: View files

to access data or to see how security settings are configured delete files

to make it unavailable, disrupt business plans, or corrupt system

configurations modify existing files or create new files

either to corrupt data, to cover signs of their activity, or to alter

security settings for future attacks.

Linux File Permissions The first line of defense is careful use of Linux file

permissions For any file or directory, Linux file permissions are …

Each can be assigned to …

Permissions on files and directories

chmod command: change file permissions

Examples …

Examples

E.g 1: In a directory reports,

$ ls –ld

d rwx rwx --- 2 frank faculty 4096 Mar 24 12:20 reports

Means ?

E.g. 2: there’re two data files in the directory reports$ ls –l

- rw- --- --- 2 frank faculty 16350 Mar 25 18:10 private_report

- rw- r-- --- 2 frank faculty 21340 Mar 25 18:10 public_report

Means ?

Examples

E.g. If Bob in student group tires the following command$ cd reports

Result ?

If Alice in faculty group tires the following commands

$ cd reports

$ cat private_report

$ cat public_report

$ cp public_report private_report

Results ?

User Private Groups

Several Linux distributions (such as RH Linux) use a techniques User Private Groups to enhance file security Every file and directory are assigned both a user and

a group, each with separate permissions It is more secure to have a group with only a single

member, then make that the default group for all files created by that user

User Private Group is defined in file /etc/passwd

Example …

Set User ID (SUID) --- Revisit SUID bit

causes the user who executes a program to assume the permissions of the owner of that file.

$ ls -l test- rws r-x r-x 1 frank faculty 3240 Mar 26 11:42 test

SUID bit is necessary for some programs logging in changing passwords low level networking routines control of graphical display functions su

However SUID presents a security hazard If hackers can set SUID bit of other system files, they may gain root

access. SUID is insecure on script files, as script files can be easily modified

Linux kernel does NOT allow a SUID bit when set on a script file.

Set Group ID (SGID)

SGID bit When SGID is set on a file, the user who executes a file to

assume the permissions of the group of that file. not a useful feature rarely used.

When SGID is set on a directory, any file created within that directory is assigned the group of the directory, rather than the group of the user that creates the file.

SGID Example

SGID is a convenient method for creating a working space for a group of users

Example …

Q: what if Tom creates a file in his own directory?

Example 2: another technique w/o using SGID

Deny access to members of a group: the owner has a certain access rights, the members of a group cannot access it, everyone else has a certain access rights.

Example …

Linux file system access control

When a user requests access a directory or fileStep1: System checks whether this user is owner

Yes check owner access privilege access deny / grant

No goto Step 2

Step2: System checks whether this user belongs to the group assigned to the file/directory

Yes check group access privilege access deny / grant

No goto Step 3

Step3: System knows this user belongs to others

check others access privilege access deny / grant

Index

File permissions Monitor log files File integrity

System Log Files

System log files may reveal security problems Log files record the activity of programs such as login, FTP, email

servers … System logging daemons store log messages in several different

files, depending on which type of program generated the message defined in file /etc/syslog.conf

Messages in these log files are important to monitor system/security eventse.g., found a large number of failed login attempted in /var/log/messages

/etc/syslog.conf

# Log all kernel messages to the console.# Logging much else clutters up the screen.#kern.* /dev/console

# Log anything (except mail) of level info or higher.# Don't log private authentication messages!*.info;mail.none;authpriv.none;cron.none

/var/log/messages

# The authpriv file has restricted access.authpriv.* /var/log/secure

# Log all the mail messages in one place.mail.* /var/log/

maillog

# Log cron stuffcron.*

/var/log/cron

Log File Utilities

Log files are important part of system maintenance and security A number of utilities can help watch for log messages

that indicate potential security violations Rotating log files -- logrotate package Tracking log files

shell commands: grep, tail GUI tools: xlogmaster, logcheck

Rotating Log Files Log files require regular attention because they can become very large The logrotate command helps automate the process of compressing and

archiving log files older log data can be stored in another location (CD or backup tape) In RH Linux, logrotate is executed through the cronjob entry stored in

/etc/cron.daily/logrotate

#!/bin/sh/usr/sbin/logrotate /etc/logrotate.conf

check logrotate config file$ cat /etc/logrotate.conf

/etc/logrotate.conf# rotate log files weeklyweekly

# keep 4 weeks worth of backlogsrotate 4

# create new (empty) log files after rotating old onescreate

# uncomment this if you want your log files compressed#compress

# RPM packages drop log rotation information into this directoryinclude /etc/logrotate.d

# no packages own wtmp -- we'll rotate them here/var/log/wtmp { monthly create 0664 root utmp rotate 1}

Tracking Log Files

Several log daemons are constantly adding log entries to their corresponding log files this information needs to be tracked

The log file can be viewed by root: opening the log file in a text editor (gedit, vi, …) using the grep or the tail commands

Example …

In graphical desktop, use xlogmaster program to view the system log file

Xlogmaster package View system log file via Xlogmaster

is not part of most Linux distributions can be downloaded http://www.gnu.org/software/xlogmaster/

Logcheck package

The logcheck package does much more than display log entries checks log files hourly for suspicious entries if found, they are emailed to the root user

After being installed, a cron job file is placed in /etc/cron.hourly so that logcheck runs each hour.

is not part of most Linux distributions, but can be obtained http://sourceforge.net/project/showfiles.php?group_id=10096

The commercial version of logcheck is called LogSentry offered by Psionic Technologies

Index

File permissions Monitor log files File integrity

Maintaining File Integrity

It is necessary to keep track of the state of important system files for any unexpected changes sometimes hackers can gain access, but the system log

does NOT indicate a problem

E.g. A hacker replaces your inetd superserver daemon with a bogus inetd, …

Rootkit

Once a cracker has obtained root access, he could install a rootkit Rootkit is a collection of programs and scripts designed to permit

continued access, even if the original break-in is discovered.

Examples: A hacker discovered you were using an outdated DNS server that

permit a hacker to obtain root access. The hacker then installed a rootkit in your system.

Later you updated the DNS server. However, the hacker still has the access to your system.

Rootkit lrk4

One example of rootkit is lrk4 Released in November 1998 Several more recent versions are available (lrk5 and lrk6) It modifies the following programs in your system

chkrootkit package

The chkrootkit package is used to check the system for evidence of a rootkit includes a script that works like a virus checker

Examines system binary files to detect evidence of about 60 different rootkits

chkrootkit reports the presence of a rootkit It cannot eliminate rootkit from the system

chkrootkit package is not included on most Linux distributions, can download www.chkrootkit.org

After a rootkit is discovered

If possible, shut down networking on the server until the problem is cleaned up

Back up the entire system, including all of the operating system files and all data files this data can be reviewed later to assist in tracking

down the cracker

Rebuild the system

either by updating the infected packages, or by reinstalling the entire operating system

Maintaining File Integrity

A broader and more constant approach to file security than checking for rootkits is to watch the integrity of files on the system

Special file integrity utilities can help you track a large number of files on your system Tripwire is the best known integrity checker

is available in a free version included with many Linux distributions

a commercial version is available from Tripwire, Inc.

How to use Tripwire

To use Tripwire, start with a freshly installed system before it is connected to any networks Tripwire creates a baseline of the critical system files Once the baseline is established, Tripwire is run at

regular intervals to see whether the state of the system has changed If the changes are expected, you can update the baseline

in Tripwire so that the changes are not marked as potential problems

To protect the protector: Tripwire configuration files are protected by a cryptographic signature based on a passphrase

Samhain package Samhain is similar to Tripwire with several potential

advantages. comibines a file integrity checker, a log file checker, and a network

monitor.

Key features of Samhain: Runs as a daemon instead of a cron job Can detect kernel modules that were loaded as part of a rootkit Can operate in a client/server environment Report and audit logs are supported Database and configuration files are signed Runs on a number of UNIX and Linux platforms HTML status pages show information about any client system

being monitored

Other File Integrity utilities

For more tools regarding file integrity, consider installing the binutils package

includes more than a dozen utilities useful for exploring the contents of files

Examples …