IDS background

An intrusion detection system (IDS) is a set of programs which keeps an eye on the system in order to enhance the detection of intrusions. Its main goal is to detect malicious attacks and send complete reports to the computer analyst of the company. Note that ID tools can also change the behaviour of the system in order to block the attacker in the future, but it should not be capital. After all : " Prevention is better than cure. "

Nowadays ID systems are numerous and fundamentally different, this is why analysts tend to divide them into two categories :

• "host-oriented" : detect local intrusions (on the machine where the sensor is started), by auditing system logs and monitoring system calls;

• "network-oriented" : capture network packets on a targeted network (like a sniffer), and analyze them afterward in order to detect network attacks.

What is KISS ?

KISS is a host-based security improvement for BSD operating systems. KISS can be compared as a host intrusion detection system, but I personally think it is rather more than that. The more interesting quality of KISS is probably its highly flexible configuration.

KISS was designed and implemented during my training period at Datarescue . This project was part of my thesis at the Haute Ecole de la Province de Liege Rennequin Sualem .

KISS is a young, open-source project. You are free to add your own improvements, correct bugs...

What can I do with KISS ?

Here are the features that KISS is able to bring you :

• Checking the integrity of your binary files upon execution by computing digest MD5 signatures;

• Hiding files and processes to a list of untrusted users, using a rule-based interface like a network firewall;

• Handling actions on a few interesting internal kernel events, according to a set of processes, users or groups in the system using a tiny scripting language;

• Exchanging alarms from one or more remote KISS systems, using either plain-text or SSL connections;

• Loading plugins dynamically into gateways, and storing your alarms wherever you want. You can also write your own plugins, using the provided development kit for the C language. KISS comes with a MySQL plugin.

Installation prerequisites

Here is the list of things you will need to build KISS on your system :

• A supported BSD-based operating system :

  • OpenBSD since the 2.9 release;

  • FreeBSD since the 4.4 release;

• Perl , without specific modules (should be already installed) *

• Lex & Yacc (should be already installed)

• If you plan to build and use the KISS MySQL plugin :

  • The libmysqlclient.a library to link with (normally build with the MySQL distribution) *

  • A MySQL server (to host the KISS database) *

  • Eventually, a Web server (try Apache *) configured to support a PHP engine * is required if you want to test the provided PHP front-head

• If you plan to build the SSL support for the gateway, OpenSSL libraries and binaries are required (should be already installed) *

• If you plan to build the documentation (which is not obligatory), you will need the following applications :

  • TeX / LaTeX *

  • Doxygen *

  • Jade and the Docbook DTD *

Getting the sources

KISS is released under the BSD license. Actually the only way to get KISS on your system is to build it from the sources. I don't really like releasing binaries, and I hope the project will stick to the sources.

There are several ways to retrieve them :

• HTTP : Unixtech (BE)

• CVS : soon on sourceforge...

Build KISS into your system

The user-friendly installation script is still in construction. Meanwhile, you will have to do the stuff by yourself. If you are familiar with other open-source projects, it should not be a problem... Here are the distinct steps :

The core, kissmod

The KISS core is provided under the form of a shared kernel object :

• /modules/kiss.ko on FreeBSD systems;

• /usr/lkm/kiss.o on OpenBSD systems.

The module should not be loaded and unloaded manually, unless for debugging purposes. Instead you should use the kissctl program to do that.

The manager, kissctl

kissctl is a multipurpose management tool, which accepts the following command-line options :

• start : loads the KISS core within the kernel with the password provided at the passwd: prompt, and create a session for the current process;

• stop (*) : unloads the KISS core;

• login : requests a session, identified by the password provided at the passwd: prompt. If you already have a valid session, the prompt won't be displayed;

• logout (*) : revokes a session;

• fw (*) : manages the file / process filter, also called as the internal host-firewall. Here are the sub-options :

  • add {show|hide} {file|proc} filename... for username... [log] : inserts a rule in the internal firewall;

  • del rule_id : removes a rule, using its unique identifier;

  • list : prints all rules;

  • flush : removes all existing rules.

• ids (*) : manages the IDS subsystem, which is dedicated to the scripting language. Here are the sub-options :

  • load filename : loads an event script in the KISS IDS subsystem;

  • flush : flushes the IDS subsystem.

• digest (*) : manages the digest database, file integrity checker. Here are the sub-options :

  • add filename... : inserts a set of filenames into the digest list. Only regular files (VREG) will be added;

  • update filename... : updates internal MD5 signatures for a set of filenames;

  • del filename... : removes a set of filenames from the digest list;

  • list : prints the list of entries from the digest list, including the filename, MD5 signature and vnode id;

  • flush : removes all entries of the digest list.

The gateway, kissgw

The KISS gateway is meant to receive alarms from the core and any remote connected gateway which hostname figures by default in the /usr/local/kiss/conf/kissgw.allow file.

Here is the list of command-line options for the kissgw program :

• -d : runs as a daemon, and therefore log through syslogd instead of the standard output;

• -p directory : points to a specified directory which should contain the plugin, instead of the default directory /usr/local/kiss/plugins;

• -n : exchanges alarms over the network, this option is required for the following network related options ;

  • -a : alone mode, doesn't open the KISS core, therefore the gateway will only receive alarms from other gateways;

  • -A filename : specifies another filename which should contain the list of allowed hostnames to connect on the gateway, instead of the default file /usr/local/kiss/conf/kissgw.allow;

  • -m method : specifies the method to exchange alarms over the network. Can be either plaintext or ssl (if supported). By default, all connections will be in plaintext;

  • -r hostname... : configures a colon-separated list of hostnames to relay alarms once they are received;

  • -P port : configures the TCP port to use, which is set to 4000 by default.

The alarm builder, kissalarm

The kissalarm is a tool which allows you, to forge and send, within the command-line, your own KISS alarms to remote gateways.

This tool can be used to test the right functionality of your KISS gateways network, and can be also called from shell script to increase the variety of your alarms.

Here is the list of command-line options :

• -p pid (*) : sets the PID which will identify the process that has caused the alarm;

• -a string (*) : sets the ASCII description of the alarm;

• -l level (*) : sets the level of the alarm, can be at choice low, normal or high;

• -H hostname (*) : sets the hostname of the gateway where the alarm should be sent to;

• -P port : specifies the TCP port to use, which is set to 4000 by default;

• -m method : configures the method to use, either plaintext (specified by default) or ssl (if supported).

File integrity protection

This protection can help you to monitor a list of binary files, and to avoid their execution when they have been modified.

When a binary which is part of the digest list is modified, each execve(2) system call on it will returns the EPERM errno code (permission denied) and send a KISS alarm.

[...]
root@teneriel /tmp> echo "int main(void) { return 0; }" > test.c
root@teneriel /tmp> gcc test.c -o test
root@teneriel /tmp> kissctl digest add /tmp/test
*** 1 file(s) added in the KISS digest database
root@teneriel /tmp> kissctl digest list
MD5 (/tmp/test) : F1E6D25F4E30F2737E5FA8459E0CE183 (vnode id: 0xc7c20)
*** End of digest listing (1 item(s))
root@teneriel /tmp> ./test
root@teneriel /tmp> echo "int main(void) { return 1; }" > test.c
root@teneriel /tmp> gcc test.c -o test
root@teneriel /tmp> ./test
su: ./test: Operation not permitted
root@teneriel /tmp> kissctl digest update /tmp/test
*** 1 file(s) updated from the KISS digest database
root@teneriel /tmp> ./test
[...]

[...]
teneriel /kernel: kiss: Added MD5 (/tmp/test 0xc7c20) = f1e6d25f4e30f2737e5fa8459e0ce183
teneriel /kernel: kiss: MD5 digest matching for /tmp/test
teneriel /kernel: kiss: Reported alarm (HIGH id=0) 
  [uid=0, gid=0, pid=19473] : Attempt to unlink test (which is in the digest list)
teneriel /kernel: kiss: Reported alarm (HIGH id=1) 
  [uid=0, gid=0, pid=19473] : Attempt to open test for  writing (which  is in the digest list)
teneriel /kernel: kiss: Reported alarm (HIGH id=2) 
  [uid=0, gid=0, pid=19474] : MD5 old signature for /tmp/test mismatch !
teneriel /kernel: kiss: Updated MD5 digest for /tmp/test
teneriel /kernel: kiss: MD5 digest matching for /tmp/test
[...]

File and process hiding

This feature can be used in order to hide a list of filenames and processes for a set of users, including the super user root.

[...]
root@teneriel /> kissctl fw add hide file /etc/*passwd* for pinux log
*** Adding rule 1 in the KISS firewall table
root@teneriel /> kissctl fw list
#1 hide file(s) /etc/passwd /etc/master.passwd for user pinux (log = yes)
*** End of fw rules listing (1 item(s))
root@teneriel /> ls /etc/*passwd*
/etc/master.passwd  /etc/passwd
root@teneriel /> su pinux
pinux@teneriel /> ls /etc/*passwd*
ls: /etc/*passwd*: No such file or directory
pinux@teneriel /> exit
root@teneriel /> kissctl fw del 1
*** Removed KISS fw rule number 1
root@teneriel /> kissctl fw list
*** End of fw rules listing (0 item(s))
root@teneriel /> su pinux
pinux@teneriel /> ls /etc/*passwd*
/etc/master.passwd  /etc/passwd
[...]

[...]
teneriel /kernel: kiss: Adding rule 0
teneriel /kernel: kiss: -> make index for /etc/passwd
teneriel /kernel: kiss: -> make index for /etc/master.passwd
teneriel /kernel: kiss: Built 2 entries in the file index
teneriel /kernel: kiss: Reported alarm (LOW id=0) 
  [uid=1001, gid=0, pid=19597] : Attempt to display master.passwd (which is hidden by the fw)
teneriel /kernel: kiss: Reported alarm (LOW id=1) 
  [uid=1001, gid=0, pid=19597] : Attempt to display passwd (which is hidden by the fw)
[...]

The event scripting language

The event scripting allows to handle a set of actions on internal events for a list of actors, which can be processes, users, or user groups.

Here is the semantic of a event scripting rule :

when actor... event {
  action1 ;
  action2 ;
  ... ;
}

# This line is a comment.
#


when proc /usr/sbin/sendmail execve /bin/sh, /bin/csh, /bin/ksh {
  report HIGH, "sendmail wants to start a shell!";
  kill $curproc;
}


when proc /usr/sbin/sendmail bind TCP 1-24 26-65535 {
  report HIGH, "sendmail wants to bind an other tcp port that 25!";
  kill $curproc;
}


when user all connect TCP 6667-7000 {
  message $curuser, "Sorry, IRC is disabled from this box!";
  logout $curuser;
}


when user all unlink /kernel {
  message $curuser, "Sorry, autosuicide is disabled";
  kill $curproc;
}


when user all execve /bin/as, /usr/local/bin/nasm {
  message $curuser, "Well, you are in the right way!";
  message root, "Note: give more money to $curuser";
}


when group guest open /etc/passwd, /etc/master.passwd {
  report NORMAL, "$curuser wants to open a password file";
  kill $curproc;
}


when user all kill /sbin/init {
  message $curuser, "Please remove KISS before killing init!";
  kill $curproc;
}
  

Receiving and sending KISS alarms

root@teneriel ~> kissctl start
You need to enter a password.  This password will be asked each time you want
to open a kiss session.  The security of your system will depend essentially
on this password.  Note that without it, you won't be able to unload kiss.
Finally, do not enter the same password as your root account.
passwd> 
confirm> 
*** Kiss 0.1 alpha is now loaded and operational.
root@teneriel ~> kissgw -v
PID (24953) successfully written in /var/run/kissgw.pid
kissgw: No plugins founded in /usr/local/kiss/plugins..
Handled signals
Sleeping...
Local receiver thread started (TID 0x8051400)
[...]

root@teneriel ~> rm /dev/kiss
rm: /dev/kiss: Operation not permitted
root@teneriel ~> kissctl digest list
kissctl: You don't have a KISS session !
root@teneriel ~> kissctl digest add /bin/ls
kissctl: You don't have a KISS session !

25/5/2002 20:59:11 @ teneriel.teledisnet.be (FreeBSD 4.5-STABLE) 
  user root (0:0) ps rm (24962) => Attempt to unlink /dev/kiss without authentication
(network relay complete)
Relay finished for alarm 1
No more alarms to read...
Sleeping...
25/5/2002 20:59:21 @ teneriel.teledisnet.be (FreeBSD 4.5-STABLE) 
  user root (0:0) ps kissctl (24963) => Attempt to GET without authentication
Relay finished for alarm 2
No more alarms to read...
Sleeping...
25/5/2002 21:0:0 @ teneriel.teledisnet.be (FreeBSD 4.5-STABLE) 
  user root (0:0) ps kissctl (24964) => Attempt to DIGEST_ADD without authentication
Relay finished for alarm 3
No more alarms to read...
Sleeping...
[...]

root@arrakis ~> kissgw -navm ssl -P 6000
PID (4856) successfully written in /var/run/kissgw.pid
kissgw: No plugins founded in /usr/local/kiss/plugins..
Adding teneriel (192.168.1.7) to the trusted-hostname list
Enter PEM pass phrase:
Waiting for SSL connections on tcp port 6000
Network gateway thread started (TID 0x8051800)
Connection established with 192.168.1.7
Waiting for SSL connections on tcp port 6000
SSL DES-CBC3-MD5 handshake successfull
Waiting an alarm from 192.168.1.7...
24/5/2002 17:19:28 @ teneriel.teledisnet.be (FreeBSD 4.5-STABLE)
  user pinux (1001:0) ps bash (829) => Hello, World
(network relay complete)
Relay finished for alarm 0
Waiting an alarm from 192.168.1.7...
[...]

root@teneriel ~> kissgw -navm ssl -P 6000 -r arrakis
PID (14720) successfully written in /var/run/kissgw.pid
kissgw: No plugins founded in /usr/local/kiss/plugins..
Adding localhost (127.0.0.1) to the trusted-hostname list
Enter PEM pass phrase:
Waiting for SSL connections on tcp port 6000
Network gateway thread started (TID 0x8051400)
Connection established on 192.168.1.1:6000
SSL DES-CBC3-MD5 connection successfull
Connection established with 127.0.0.1
Waiting for SSL connections on tcp port 6000
SSL DES-CBC3-MD5 handshake successfull
Waiting an alarm from 127.0.0.1...
24/5/2002 17:19:28 @ teneriel.teledisnet.be (FreeBSD 4.5-STABLE)
  user pinux (1001:0) ps bash (829) => Hello, World
Alarm 0 successfully relayed to 192.168.1.1
(network relay complete)
Relay finished for alarm 0
Waiting an alarm from 127.0.0.1...
Thread 0x8071000 is dying (without errors) : killing peer 127.0.0.1
[...]

root@teneriel ~> kissalarm -p 829 -H localhost -m ssl -P 6000
  -a "Hello, World" -l normal
Alarm ID 0 acknowledged

Writing your own KISS plugins

A KISS gateway can load plugins dynamically, and send them each alarm it receives, which can be either from the core or from another remote gateway.

A plugin must be written in the C language, and must give the implementation of the following routines, respecting scrupulously the given prototype:

 int plugin_init(void);
 int plugin_info(struct plugin_info *);
 int plugin_recv(struct kiss_alarm *);
 int plugin_stop(void);
    

#include <kiss-plugin.h>
#include <stdio.h>

#define AUTHOR  "Sansonetti Laurent <laurent@datarescue.be>"
#define VERSION "1.0"
#define COMMENT "Example plugin"

int plugin_init(void) {
    printf("*** example plugin: initialization\n");
    return NULL;
}

int plugin_info(infos)
    struct plugin_info *infos;
{
    printf("*** example plugin: get information\n");
    strcpy(infos->author, AUTHOR);
    strcpy(infos->version, VERSION);
    strcpy(infos->comment, COMMENT);

    return NULL;
}

int plugin_recv(a)
    struct kiss_alarm *a;
{
    printf("*** example plugin: received alarm:\n");
    printf("*** %s\n", a->header.msg);
    return NULL;
}

int plugin_stop(void) {
    printf("*** example plugin: shutdown\n");
    return NULL;
}

root@teneriel ~> kissgw -nav
PID (25129) successfully written in /var/run/kissgw.pid
Successfully linked /usr/local/kiss/plugins/example.so
Initializing KISS plugins in /usr/local/kiss/plugins :
*** example plugin: initialization
*** example plugin: get information
example.so 1.0 by Sansonetti Laurent <laurent@datarescue.be> : Example plugin
(plugins initialization complete)
Adding localhost (127.0.0.1) to the trusted-hostname list
Waiting for PLAINTEXT connections on tcp port 4000
Network gateway thread started (TID 0x8051400)
[...]

root@teneriel ~> kissalarm -p 2 -a "I'm in love with pagedeamon" -H localhost 
  -l low
Alarm ID 0 acknowledged

Connection established with 127.0.0.1
Waiting an alarm from 127.0.0.1...
25/5/2002 22:19:28 @ teneriel.teledisnet.be (FreeBSD 4.5-STABLE) 
  user root (0:0) ps pagedaemon (2) => I'm in love with pagedeamon
(network relay complete)
*** example plugin: received alarm:
*** I'm in love with pagedeamon
Alarm successfully relayed via example.so
Relay finished for alarm 0
[...]