Simple intrusion detection using standard UNIX commands

After I'm done with configuring and hardening Linux server I'm doing "reference of the server" by writing output from several crucial commands to my laptop:

ps -x -o user,command

netstat -natuw
find / -uid 0 -perm -4000 -print

find / -size +10000k -print

crontab -u root -l

Then using this simple script on regular basis, I have chance to detect compromised boxes:

#!/bin/bash

function usage
{
    echo "Usage: $0 <hostname>"
}

function getSrvAddr
{
    case $1 in
        'hostname1' ) echo "ssh user@srv1.addr"
            ;;
        'hostname2' ) echo "ssh user@srv2.addr"
            ;;
        * ) echo -n ""
    esac
}

HOSTNAME=$1
REFERENCE_PATH=~/lab/configs/myServers/${HOSTNAME}
SERVER=`getSrvAddr "$HOSTNAME"`
CMDS=(
    "ps -x -o user,command"
    "netstat -natuw"
    "find / -uid 0 -perm -4000 -print"
    "find / -size +10000k -print"
    "crontab -u root -l"
)

if [ -z "$SERVER" ]; then
    usage
    exit 1
fi

i=0
for FILE in ${REFERENCE_PATH}/*; do
    echo
    echo "########################################################################"
    echo  ${SERVER} ${CMDS[$i]}
    echo "########################################################################"
    echo
    diff -w -u <(sort $FILE) <(${SERVER} ${CMDS[$i]} 2> /dev/null | sort)
    i=$((i+1))
done

Basically, what the script does is compare server's initial output from several UNIX commands with it's current output. Using this script I can easily extend it for more commands and more servers. It's very simple method of intrusion detection (and by no mean 100% reliable!) but it's good addition to other mechanisms that should be in place.

Challenge 7 of the Forensic Challenge 2011

Challenge 7 "Forensic analysis of a compromised server" from the Honeynet Project has come to the end. I've got 20 from 23 possible points plus 2 bonus points - not bad at all! Here you can find my answers.

The power of Awk

Recently I've been busy with analyzing results of Challenge 5 of the Honeynet Forensic Challenge. The winner has written nice script for analyzing auth.log file. The script is written in Python and can be found here. I decided to implement such script in Awk. It turned out tha Awk is perfectly suited to this kind of work, here's the script:

cat auth.log | awk '

    $0 !~ /sshd/ {next};

    {ip=$11};

    /invalid/ {ip=$13};

    /Failed/ {

        Fails[ip] += 1;

        if(Fails[ip] == 1)

            StartTime[ip] = $1 " " $2 " " $3;

        EndTime[ip] = $1 " " $2 " " $3;

    };

    /Accepted/ {

        if(Fails[ip] > 0) {

            Accepts[ip] += 1;

            Details[ip] = sprintf("%s %s %s\n", Details[ip], $1 " " $2 " " $3, $9);

        }

    };

    END {

        for(key in Fails) {

            if((Fails[key] > 0) && (Accepts[key]/Fails[key] < 0.1 )) {

                print "Attacker IP: " key

                print "Start time: " StartTime[key]

                print "End time: " EndTime[key]

                print "Login attempts: " Fails[key]

                if(Accepts[key] > 0) {

                    print "Successfull attempts: " Accepts[key];

                    print Details[key];

                }

                printf "\n"

            }

        }

    }'

About 26 lines of code as opposed to 136 lines of Python version!

And here's one-liner (shorter but less verbose) version of the script:

 $ cat auth.log | awk '$0 !~ /sshd/ {next}; {ip=$11}; /invalid/ {ip=$13}; /Failed/ {Fails[ip] += 1 }; /Accepted/ {if(Fails[ip] > 0) Accepts[ip] += 1 }; END { for(key in Fails) {if((Fails[key] > 0) && (Accepts[key]/Fails[key] < 0.1 )) print key": "Fails[key] "\t Successes: " Accepts[key]} }'