/usr/share/doc/samhain/manual.html/stealthmode.html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN""http://www.w3.org/TR/html4/loose.dtd">
<HTML
><HEAD
><TITLE
>Additional Features &#8212; Stealth</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.79"><LINK
REL="HOME"
TITLE="The Samhain Host Integrity Monitoring System"
HREF="index.html"><LINK
REL="PREVIOUS"
TITLE="Additional Features &#8212; Signed Configuration/Database Files"
HREF="signed-files.html"><LINK
REL="NEXT"
TITLE="Packing the executable"
HREF="packing-the-executable.html"><LINK
REL="STYLESHEET"
TYPE="text/css"
HREF="./docbook.css"></HEAD
><BODY
CLASS="CHAPTER"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/header.html"--><!--#endif --><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>The Samhain Host Integrity Monitoring System</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="signed-files.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
></TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="packing-the-executable.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="CHAPTER"
><H1
><A
NAME="STEALTHMODE"
></A
>Chapter 9. Additional Features &mdash; Stealth</H1
><P
>  If an intruder does not know that 
  <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> is running, s/he will make
  no attempt to subvert it. Hence, you may consider to 
  run <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> in
  stealth mode, using some of the options discussed in this section.</P
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="HIDING-THE-EXECUTABLE"
>9.1. Hiding the executable</A
></H1
><P
>       <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> may be compiled with 
       support for a stealth mode of
       operation, meaning that the program can be run without any
       obvious trace of its presence on disk. The following 
       compile-time options
       are provided:</P
><P
>  <B
CLASS="COMMAND"
>--enable-stealth=<TT
CLASS="REPLACEABLE"
><I
>xor_val</I
></TT
></B
> 
  provides the following measures:</P
><P
><P
></P
><OL
TYPE="1"
><LI
><P
>  All embedded strings are obfuscated by XORing them with some
  value <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>xor_val</I
></SPAN
> chosen at compile time. 
  The allowed range
  for <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>xor_val</I
></SPAN
> is 128 to 255. 
  </P
></LI
><LI
><P
>  The messages in the log file are obfuscated by XORing them with
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>xor_val</I
></SPAN
>. 
  The built-in routine for validating the log file
  (<B
CLASS="COMMAND"
>samhain -L /path/to/logfile</B
>)
  will handle this transparently. You may specify as path an
  already existing binary file (e.g. an executable, or a JPEG image),
  to which the log will get appended.
  </P
><DIV
CLASS="TIP"
><P
></P
><TABLE
CLASS="TIP"
WIDTH="90%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/tip.gif"
HSPACE="5"
ALT="Tip"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Tip</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  Use 
  <B
CLASS="COMMAND"
>samhain -jL /path/to/logfile</B
> if you just want 
  to view rather 
  than verify the logfile.
  </P
></TD
></TR
></TABLE
></DIV
></LI
><LI
><P
>  Strings in the database file are obfuscated by XORing them with
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>xor_val</I
></SPAN
>. You may append the database file to some
  binary file (e.g. an executable, or a JPEG image), if you like.
  </P
></LI
><LI
><P
>  The configuration file must be steganographically hidden in a
  postscript image file (the image data must be uncompressed).
  To create such a file from an existing  image,  you  may  use
  e.g.   the  program  <B
CLASS="COMMAND"
>convert</B
>,  which  is  part  of  the
  <SPAN
CLASS="APPLICATION"
>ImageMagick</SPAN
> package, such as
  <B
CLASS="COMMAND"
>convert +compress <TT
CLASS="REPLACEABLE"
><I
>ima.jpg ima.ps</I
></TT
></B
>.
  </P
><DIV
CLASS="TIP"
><P
></P
><TABLE
CLASS="TIP"
WIDTH="90%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/tip.gif"
HSPACE="5"
ALT="Tip"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Tip</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  <B
CLASS="COMMAND"
>make install</B
> will do this automatically
  before installation.
  </P
></TD
></TR
></TABLE
></DIV
><P
>  To  hide/extract  the  configuration  data within/from the
  postscript file, a utility program <B
CLASS="COMMAND"
>samhain_stealth</B
> is 
  provided.  Use it without options to get help.
  </P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="90%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Note</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  If <B
CLASS="COMMAND"
>--enable-stealth</B
> is used together with
  <B
CLASS="COMMAND"
>--with-gpg</B
>, then the config file must be signed
  before hiding it (rather than signing the PS image file afterwards).
  </P
></TD
></TR
></TABLE
></DIV
></LI
></OL
></P
><P
>  <B
CLASS="COMMAND"
>--enable-micro-stealth=<TT
CLASS="REPLACEABLE"
><I
>xor_val</I
></TT
></B
> 
  is like <B
CLASS="COMMAND"
>--enable-stealth</B
>, 
  but uses a 'normal'
  configuration file (not hidden steganographically).</P
><P
>  <B
CLASS="COMMAND"
>--enable-nocl[=ARG]</B
> 
  will disables command line parsing. The optional argument is a 'magic'
  word that will enable reading command-line arguments from 
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>stdin</I
></SPAN
>.
  If the first command-line argument is not the 'magic' word, all command
  line arguments will be ignored. This allows to start the program with
  completely arbitrary command-line arguments. </P
><P
>  <B
CLASS="COMMAND"
>--enable-install-name=<TT
CLASS="REPLACEABLE"
><I
>NAME</I
></TT
></B
>
  will rename every installed file from <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>samhain</I
></SPAN
> 
  to <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>NAME</I
></SPAN
> when doing
  a <B
CLASS="COMMAND"
>make install</B
> 
  (standalone/client installation), and likewise 
  rename installed files from <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>yule</I
></SPAN
> to 
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>NAME</I
></SPAN
> when doing
  a <B
CLASS="COMMAND"
>make install</B
> (server installation). Also,
  the boot scripts 
  will be updated accordingly. Files created by
  <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> (e.g. the database) 
  will also have <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>samhain</I
></SPAN
> replaced by 
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>NAME</I
></SPAN
> in
  their filenames. </P
><DIV
CLASS="TIP"
><P
></P
><TABLE
CLASS="TIP"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/tip.gif"
HSPACE="5"
ALT="Tip"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Tip</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  The man pages have far too much specific information enabling an
  intruder to infer the presence of samhain. There is no point in changing
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>samhain</I
></SPAN
> to <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>NAME</I
></SPAN
> there &mdash; this 
  would rather help an intruder to find out
  what <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>NAME</I
></SPAN
> is. 
  You probably want to avoid installing man8/samhain.8 and 
  man5/samhainrc.5. </P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="KHIDE"
>9.1.1. Using kernel modules to hide samhain (Linux/ix86 only)</A
></H2
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Does NOT work on recent kernels</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  This module will not work on Linux 2.6.35 - and probably also not on slightly
  earlier version - because the system call table is now write protected.
  </P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Important</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  These modules modify the running kernel. Please read this section
  carefully (in particular the caveats noted at the end), and test the
  modules before installing. Without proper testing it may happen 
  that you need
  to reboot into single user mode to remove the modules and to 
  make your system useable again ...
  </P
></TD
></TR
></TABLE
></DIV
><P
>  If the configure option <B
CLASS="COMMAND"
>--enable-khide=SYSTEM_MAP</B
>
  is used, two (pre-2.6 kernel) or one (2.6 kernel)  loadable
  kernel module(s) will be built. These are named 
  <TT
CLASS="FILENAME"
>samhain_hide.o / samhain_erase.o</TT
> (pre-2.6) or
  <TT
CLASS="FILENAME"
>samhain_hide.ko</TT
> (2.6).</P
><P
>  SYSTEM_MAP must be the path to the System.map file for your current kernel
  (e.g. <TT
CLASS="FILENAME"
>/boot/System.map-rh-2.4.18-3</TT
>). 
  <TT
CLASS="FILENAME"
>samhain_hide.o</TT
> will hide every 
  file/directory/process with the
  string NAME (from the configure option 
  <B
CLASS="COMMAND"
>--enable-install-name=NAME</B
>).
  If the configure option <B
CLASS="COMMAND"
>--enable-install-name</B
> 
  is not used, 
  NAME is set to <SPAN
CLASS="APPLICATION"
>samhain</SPAN
>.
  To hide the module itself, the second module 
  <TT
CLASS="FILENAME"
>samhain_erase.o</TT
> is 
  provided. Loading and immediately
  thereafter unloading this module will hide any module with the string NAME
  in its name.
  <B
CLASS="COMMAND"
>make install</B
> will install the kernel 
  modules to the appropriate
  place. They will be loaded when booting into runlevel 2, 3, 4, or 5.</P
><P
>  With 2.6 kernels, only one kernel module 
  <TT
CLASS="FILENAME"
>samhain_hide.ko</TT
> will be build. This module is
  self-hiding, i.e. the separate <TT
CLASS="FILENAME"
>samhain_erase</TT
>
  module is not needed anymore. Otherwise it works as described above.
  Self-hiding can be switched off by passing the option
  'removeme=0' to the module: 
  <B
CLASS="COMMAND"
>insmod ./samhain_hide.ko removeme=0</B
></P
><P
>  Building a linux kernel module requires a proper build environment.
  You should have a link <TT
CLASS="FILENAME"
>/lib/modules/`uname -r`/build</TT
>
  which points to a functional build environment. Usually, you need to
  install the kernel sources for your kernel, and eventually (if 
  compiling the modules fails) you may need to
  configure the kernel source for your kernel:
  </P
><PRE
CLASS="SCREEN"
>  <SAMP
CLASS="PROMPT"
>sh$ </SAMP
><KBD
CLASS="USERINPUT"
>cd /your/kernel/source/directory</KBD
>
  <SAMP
CLASS="PROMPT"
>sh$ </SAMP
><KBD
CLASS="USERINPUT"
>make mrproper</KBD
>
  <SAMP
CLASS="PROMPT"
>sh$ </SAMP
><KBD
CLASS="USERINPUT"
>make cloneconfig</KBD
>
  <SAMP
CLASS="PROMPT"
>sh$ </SAMP
><KBD
CLASS="USERINPUT"
>make dep</KBD
> (obsolete for 2.6)
  <SAMP
CLASS="PROMPT"
>sh$ </SAMP
><KBD
CLASS="USERINPUT"
>make modules</KBD
> (only for 2.6)
  <SAMP
CLASS="PROMPT"
>sh$ </SAMP
><KBD
CLASS="USERINPUT"
>cd /lib/modules/`uname -r`</KBD
>
  <SAMP
CLASS="PROMPT"
>sh$ </SAMP
><KBD
CLASS="USERINPUT"
>ln -s /your/kernel/source/directory build</KBD
>
  </PRE
><DIV
CLASS="WARNING"
><P
></P
><TABLE
CLASS="WARNING"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/warning.gif"
HSPACE="5"
ALT="Warning"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Caveat no. 1</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  The hiding module will hide <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>any process or file</I
></SPAN
>
  containing the name of the <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> executable. 
  This implies that an intruder can hide herself if she can guess that name.
  You are <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>strongly encouraged</I
></SPAN
> to use the 
  <B
CLASS="COMMAND"
>./configure</B
> option 
  <B
CLASS="COMMAND"
>--enable-install-name=NAME</B
> to change the executable name
  to something really difficult to guess.
  </P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="WARNING"
><P
></P
><TABLE
CLASS="WARNING"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/warning.gif"
HSPACE="5"
ALT="Warning"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Caveat no. 2</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  The modules are kernel-specific, and <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>must</I
></SPAN
> be recompiled
  whenever the currently used kernel is recompiled or replaced by another one
  (even if the kernel version is identical). Failure to do so might lead to
  a kernel panic. The same is true if the <TT
CLASS="FILENAME"
>System.map</TT
>
  that you have specified at build time is not the one 
  corresponding to your current kernel.
  </P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="WARNING"
><P
></P
><TABLE
CLASS="WARNING"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/warning.gif"
HSPACE="5"
ALT="Warning"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Caveat no. 3</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  When the <TT
CLASS="FILENAME"
>samhain_hide</TT
> module is hidden, 
  the kernel doesn't know anymore about
  its existence, thus it cannot be removed except by rebooting.
  On pre-2.6 kernels, hiding the <TT
CLASS="FILENAME"
>samhain_hide.o</TT
> module 
  requires loading/unloading the <TT
CLASS="FILENAME"
>samhain_erase.o</TT
> module.
  On 2.6 kernels, the <TT
CLASS="FILENAME"
>samhain_hide.ko</TT
> module will
  automatically hide itself after loading, <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>except</I
></SPAN
> 
  if you pass the option
  'removeme=0' to the module: 
  <B
CLASS="COMMAND"
>insmod ./samhain_hide.ko removeme=0</B
>
  </P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="WARNING"
><P
></P
><TABLE
CLASS="WARNING"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/warning.gif"
HSPACE="5"
ALT="Warning"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Caveat no. 4 - Important Linux 2.6 issue</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  The stealth module builds fine on Linux 2.6 (if the build system is
  properly configured &mdash; see above). It was tested on two systems:
  2.6.5-7.104-smp (SuSE 9.1) and 2.6.6 (no SMP). It only worked on the
  latter system, while the first one was rendered unuseable (ls and ps
  didn't work anymore). Not sure about the reason. 
  </P
><P
>  Because on 2.6 the module will by default automatically hide itself,
  and cannot be removed then (except by rebooting), 
  you should <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>test</I
></SPAN
> the 
  module with the
  option 'removeme=0', like e.g.: 
  <B
CLASS="COMMAND"
>insmod ./samhain_hide.ko removeme=0</B
>
  </P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="TIP"
><P
></P
><TABLE
CLASS="TIP"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/tip.gif"
HSPACE="5"
ALT="Tip"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Tip</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  Hidden files can still be accessed if their names
  are known, thus using the option 
  <B
CLASS="COMMAND"
>--enable-install-name</B
>  
  to rename
  installed files is recommended
  for security (also see caveat no. 1 above).
  </P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="TIP"
><P
></P
><TABLE
CLASS="TIP"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/tip.gif"
HSPACE="5"
ALT="Tip"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Tip</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  Using the modules at system boot may cause problems with
  the GNOME (1.2) <B
CLASS="COMMAND"
>gdm</B
> display manager 
  (seen on SuSE 7.4 with the Ximian desktop; no problems observed with kdm). 
  In case of problems, you may need to reboot into single-user mode and edit
  the boot init script ... 
  </P
></TD
></TR
></TABLE
></DIV
></DIV
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="signed-files.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="packing-the-executable.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Additional Features &mdash; Signed Configuration/Database Files</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
>&nbsp;</TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Packing the executable</TD
></TR
></TABLE
></DIV
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/footer.html"--><!--#endif --></BODY
></HTML
>
samhain 3.1.0-7 / usr / share / doc / samhain / manual.html / stealthmode.html
