User Guide. How to use the Active Security monitoring component for int.eu.grid JRA1

Transcription

1 User Guide How to use the Active Security monitoring component for int.eu.grid JRA1 Document Filename: Workpackage: Partner(s): Lead Partner: Config ID: Document classification: User Guide JRA1 TCD TCD i2g-asi-monitoring-user PUBLIC Abstract: This document describes what you need to know as a user of the Active Security monitoring component.

2 Delivery Slip Name Partner Date Signature From Stuart Kenny TCD Feb 2007 Verified By Approved By Document Log Version Date Summary of changes Author Feb 2007 First public version Stuart Kenny 2/13 PUBLIC User Guide

3 Contents Contents CopyrightNotice 4 1 About the Software Abbreviations and Acronyms References and Source Code Product Usage Running the Product Basic Operation Advanced Features EDG License Agreement 10 A ASI R-GMA Table Schema 11 A.1 Table: ASIAnalyzer A.2 Table: ASIAlert A.3 Table: ASIService User Guide PUBLIC 3/13

4 Contents Copyright Notice Copyright (c) 2006 by Stuart Kenny. All rights reserved. Use of this product is subject to the terms and licenses stated in the EDG license agreement. Please refer to Chapter 3 for details. Snort is a registered trademark of SourceFire, INC. All rights reserved. This research is partly funded by the European Commission IST-RI Project Interactive European Grid. 4/13 PUBLIC User Guide

5 1 About the Software The Active Security task proposes to consider security measures for an interactive framework, and subsequently to enhance interactive operation with active security tools. The architecture of the Active Security Infrastructure (ASI), is divided into two layers: Monitoring and control layer Analysis layer Communication between the two layers is provided by R-GMA, a grid monitoring and information system, originally developed by the European DataGrid project (EDG), and currently being re-engineered as part of EGEE. R-GMA is a relational implementation of the Global Grid Forums (GGF) Grid Monitoring Architecture. The monitoring and control layer resides at site level, i.e., the components contained in this level are to be installed on the gateway components at all sites within the int.eu.grid testbed. The layer consists of two components, Security Monitoring (SM) and the Control Engine. The purpose of the second layer of the ASI is to filter and analyse the alerts collected by the Security Monitoring component, in order to detect patterns that would signify an attempted attack on the Grid infrastructure. Because it is expected that a significant number of alerts will be generated and logged it is intended to automate this analysis as much as possible. This layer resides at the Operations Centre level, i.e., the services contained in this layer are installed only at the site responsible for grid operations, or the site responsible for overall security of the Grid testbed. This layer is composed of a series of filtering steps, from which the output of each should be a single alert of higher priority, composed from an input of multiple lower priority alerts. The first of these filtering steps is the Alert Analysis; the second is the Alert Correlation Engine. Installation of the Security Monitoring component is described in the installation guide [3]. 1.1 Abbreviations and Acronyms API DN EDG EGEE GMA RDBMS R-GMA SQL Application Programming Interface Distinguished Name European DataGrid Enabling Grids for e-science in Europe Grid Monitoring Architecture Relational Database Management System Relational Grid Monitoring Architecture Structured Query Language 1.2 References and Source Code The full source code for the Security Monitoring component can be found in the int.eu.grid repository. Please refer to for details on how to obtain it. The source code can also be browsed at the following address: References can be found in the bibliography. User Guide PUBLIC 5/13

6 Chapter 2. Product Usage 2 Product Usage The Security Monitoring component (SM) is responsible for monitoring the state of security of the site, and for reporting detected security events to the Operations Centre. The monitoring is performed by standard security tools (e.g., Snort [5], Tripwire [6]), which have been R-GMA-enabled. In the current implementation the security tool used is Snort, an open-source network-based intrusion detection system. An output-plugin has been provided for Snort that makes use of the R-GMA Producer API to stream any alerts logged by Snort to the R-GMA. In order for the security events detected and published by the SM to be collected at the operations centre a second R-GMA component, a SecondaryProducer is used. A SecondaryProducer aggregates streams from multiple Producers and stores the information into a MySQL database. By running a SecondaryProducer at the Operations Centre that queries for the events being published by the SM, all the events can be aggregated to form a security alert archive. 2.1 Running the Product Operating Requirements Local Software Requirements A full dependency list for the SM is given in the installation guide. RPMs have currently only been tested on Scientific Linux v3.0.x and v4.3. Grid Infrastructure Requirements In order to operate the SM access is required to an R-GMA server. Currently a centralised R-GMA server is hosted at TCD for the int.eu.grid testbed. This hosts the R-GMA Registry (used to store the locations of the producers of information). It also hosts the producer servlets needed by the producers. If the SM is being setup outside the int.eu.grid testbed then an R-GMA server must be available for it to use. The machine hosting the SM must have a valid host certificate Step-by-Step User Setup This section will describe how to configure the system in order to operate the SM. The SM provides an output plugin for the open-source network intrusion detection system Snort. A detailed description of the usage of Snort can be found in the Snort user guide [4]. To configure the Snort R-GMA output plugin the Snort configuration file /etc/snort/snort.conf should be edited. If Snort has been configured using YAIM, then no modifications should be necessary. The format of the configuration for the R-GMA output module is as follows: output rgma: <log alert>, <site id>, <parameter list> The logging method and site ID must be defined. There are two logging types available, log and alert. Setting the type to log attaches the logging functionality to the log facility within the program. If you set the type to log, the plugin will be called on the log output chain. Setting the type to alert attaches the plugin to the alert output chain within the program. The site ID should be set to the correct value for 6/13 PUBLIC User Guide

7 2.2. Basic Operation the site on which the monitoring component is running (e.g., TCD-I2G). The available parameters are described below. The parameter list consists of key value pairs. The proper format is a space separated list of key=value pairs. x509userproxy Specify the location of the proxy file to use for secure connections to R-GMA. trustfile Specify the location of the trustfile to use for secure connections. encoding hex (default) Represent binary data as a hex string. base64 Represent binary data as a base64 string. ascii Represent binary data as an ASCII string. detail full (default) Log all details of a packet that caused an alert (including IP/TCP options and the payload) Example: fast Log only a minimum amount of data. output rgma: log, TCD-I2G, trustfile=/opt/glite/etc/rgma/clientauthentication.props detail=full The value for x509userproxy or trustfile should be set. An example of the format of a trustfile is as follows: sslcertfile=/etc/grid-security/hostcert.pem sslkey=/etc/grid-security/hostkey.pem crlenabled=true crlfiles=/etc/grid-security/certificates/*.r0 sslcafiles=/etc/grid-security/certificates/*.0 It is important that the host certficate and key used can be read by the Snort user. Otherwise Snort must be started as root. 2.2 Basic Operation During installation a link should have been created from /usr/sbin/snort to /usr/sbin/snort-rgma. If this is so, the Snort service can be controlled using the init.d script /etc/init.d/snortd. The usage is as follows: /etc/init.d/snortd {start stop reload restart condrestart status stats (long opt)} Once started Snort will begin publishing any detected alerts to the R-GMA information system. 2.3 Advanced Features This section deals with the more advanced use of the SM, i.e., the addition of new security monitoring tools. In order for a security tool to add its information to the system it must be enabled to publish detected alerts to the ASI R-GMA tables. To do this the R-GMA Producer API must be used. This API is available in a several languages, Java, C, C++, Perl, and Python. Full documentation of the APIs is available on the R-GMA website [2]. Three tables are currently used by the SM to publish alert data: User Guide PUBLIC 7/13

8 Chapter 2. Product Usage ASIAnalyser Stores information about the security tool that detected the alert. ASIAlert Stores details about the alert. ASIService Stores more detailed information about the service involved in the alert. The format of these tables is based on the IDMEF standard [1]. To send an alert to the ASI, the security tool should format its alert output to match the schema of these tables, and then use the Producer API to publish to them. In the case of Snort, an output plugin has been provided that performs these steps. If more application specific information is required that cannot be accommodated by the exisiting table structures, additional tables can be easily added to the system. This is accomplished by declaring the tables using the R-GMA Schema API. In this instance an additional SecondaryProducer would also be required in order to archive the additional tables. The following code shows how to publish an alert to the ASIAlert table using the R-GMA Java API. private void p u b l i s h A l e r t ( ) { ProducerFactory f a c t o r y = new ProducerFactoryStub ( ) ; TimeInterval t i = new TimeInterval (20, Units.MINUTES) ; TimeInterval rp = new TimeInterval ( 5, Units.MINUTES) ; ProducerProperties props = new ProducerProperties ( Storage.MEMORY, 0 ) ; PrimaryProducer pp ; try { pp = f a c t o r y. createprimaryproducer ( t i, props ) ; pp. d e c l a r e T a b l e ( ASIAlert, WHERE ( s i t e i d = TCD I2G ), rp, rp ) ; } S t r i n g a l e r t = INSERT INTO ASIAlert ( s i t e i d, a n a l y z e r i d, ident, createtime, c l a s s i f i c a t i o n, detecttime, analyzertime, source, target, s e v e r i t y ) VALUES ( TCD I2G, Snort Analyzer 1, 1, : 2 3 : , ( portscan ) TCP Portsweep, : 2 3 : , : 2 3 : , , , low ) ; pp. i n s e r t ( i n s e r t ) ; pp. c l o s e ( ) ; } catch ( RemoteException ex ) { System. e r r. p r i n t l n ( Unable to p u b l i s h to R GMA: + ex. getmessage ( ) ) ; } catch ( UnknownResourceException ex ) { System. e r r. p r i n t l n ( Unable to p u b l i s h to R GMA: + ex. getmessage ( ) ) ; } catch ( RGMAException ex ) { System. e r r. p r i n t l n ( Unable to p u b l i s h to R GMA: + ex. getmessage ( ) ) ; } 8/13 PUBLIC User Guide

9 2.3. Advanced Features In this code, first a continuous PrimaryProducer is first created. This producer type will stream published tuples to the R-GMA information system. Next the table that we wish to publish to, ASIAlert, is declared. The SQL INSERT statement is then created for the alert, and inserted using the created PrimaryProducer. Once the insert is completed the PrimaryProducer is closed. This alert has now been published to the R-GMA. The SecondaryProducer of the Alert Analysis component, which should be running at the Operations Centre, will now receive and archive this alert in the security alert archive database. The full schema for the current set of ASI R-GMA tables is given in the Appendix A. User Guide PUBLIC 9/13

10 Chapter 3. EDG License Agreement 3 EDG License Agreement Copyright (c) 2005 CrossGrid. All rights reserved. This software includes voluntary contributions made to the CrossGrid Project. For more information on CrossGrid, please see Installation, use, reproduction, display, modification and redistribution of this software, with or without modification, in source and binary forms, are permitted. Any exercise of rights under this license by you or your sub-licensees is subject to the following conditions: 1. Redistributions of this software, with or without modification, must reproduce the above copyright notice and the above license statement as well as this list of conditions, in the software, the user documentation and any other materials provided with the software. 2. The user documentation, if any, included with a redistribution, must include the following notice: This product includes software developed by the CrossGrid Project ( Alternatively, if that is where third-party acknowledgments normally appear, this acknowledgment must be reproduced in the software itself. 3. The names CrossGrid and CG may not be used to endorse or promote software, or products derived therefrom, except with prior written permission by cgoffice@cyfronet.krakow.pl. 4. You are under no obligation to provide anyone with any bug fixes, patches, upgrades or other modifications, enhancements or derivatives of the features, functionality or performance of this software that you may develop. However, if you publish or distribute your modifications, enhancements or derivative works without contemporaneously requiring users to enter into a separate written license agreement, then you are deemed to have granted participants in the CrossGrid Project a worldwide, non-exclusive, royalty-free, perpetual license to install, use, reproduce, display, modify, redistribute and sub-license your modifications, enhancements or derivative works, whether in binary or source code form, under the license conditions stated in this list of conditions. 5. DISCLAIMER THIS SOFTWARE IS PROVIDED BY THE CROSSGRID PROJECT AND CONTRIBUTORS S ISAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, OF SATISFACTORY QUALITY, AND FIT- NESS FOR A PARTICULAR PURPOSE OR USE ARE DISCLAIMED. THE CROSSGRID PROJECT AND CONTRIBUTORS MAKE NO REPRESENTATION THAT THE SOFTWARE, MODIFICA- TIONS, ENHANCEMENTS OR DERIVATIVE WORKS THEREOF, WILL NOT INFRINGE ANY PATENT, COPYRIGHT, TRADE SECRET OR OTHER PROPRIETARY RIGHT. 6. LIMITATION OF LIABILITY THE CROSSGRID PROJECT AND CONTRIBUTORS SHALL HAVE NO LIABILITY TO LICENSEE OR OTHER PERSONS FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES OF ANY CHARACTER INCLUDING, WITHOUT LIM- ITATION, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, LOSS OF USE, DATA OR PROFITS, OR BUSINESS INTERRUPTION, HOWEVER CAUSED AND ON ANY THEORY OF CONTRACT, WARRANTY, TORT (INCLUDING NEGLIGENCE), PRODUCT LIABILITY OR OTH- ERWISE, ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 10/13 PUBLIC User Guide

11 A ASI R-GMA Table Schema A.1 Table: ASIAnalyzer siteid NOT NULL PRIMARY KEY analyzerid NOT NULL PRIMARY KEY name manufacturer model version class ostype osversion MeasurementDate DATE NOT NULL MeasurementTime TIME NOT NULL A.2 Table: ASIAlert siteid NOT NULL PRIMARY KEY analyzerid NOT NULL PRIMARY KEY ident INTEGER createtime classification detecttime analyzertime source target severity additional data VARCHAR(5000) correlation VARCHAR(5000) MeasurementDate DATE NOT NULL MeasurementTime TIME NOT NULL A.3 Table: ASIService siteid analyzerid ident ip addr ip version iana protocol number iana protocol name name port NOT NULL PRIMARY KEY NOT NULL PRIMARY KEY INTEGER VARCHAR(50) INTEGER INTEGER INTEGER User Guide PUBLIC 11/13

12 Appendix A. ASI R-GMA Table Schema MeasurementDate DATE NOT NULL MeasurementTime TIME NOT NULL 12/13 PUBLIC User Guide

13 Bibliography Bibliography [1] IETF Intrusion Detection Exchange Format Working Group. The intrusion detection message exchange format. [2] EGEE JRA1. R-gma. [3] Security monitoring installation guide. [4] Snort. Snort users manual. htmanuals/htmanual 261/. [5] Snort. April [6] Open source Tripwire. April User Guide PUBLIC 13/13