Installation Guide. How to install the Active Security monitoring component for int.eu.grid JRA1

Transcription

1 Installation Guide How to install the Active Security monitoring component for int.eu.grid JRA1 Document Filename: Workpackage: Partner(s): Lead Partner: Config ID: Document classification: Installation Guide JRA1 TCD TCD i2g-asi-monitoring-install PUBLIC Abstract: This document describes what you need to know as an installer of the Active Security monitoring component.

2 Delivery Slip Name Partner Date Signature From Stuart Kenny TCD Nov 2006 Verified By Approved By Document Log Version Date Summary of changes Author Nov 2006 First public version Stuart Kenny Jan 2007 Update installation procedure Stuart Kenny 2/11 PUBLIC Installation Guide

3 Contents Contents CopyrightNotice 4 1 About the Software Software Components Dependencies Installation in the int.eu.grid Testbed Manual Post Installation Steps Manual Installation 8 4 Running and Testing 9 5 EDG License Agreement 10 Installation Guide PUBLIC 3/11

4 Contents Copyright Notice Copyright (c) 2006 by Stuart Kenny. All rights reserved. Use of this product is subject to the terms and licenses stated in the EDG license agreement. Please refer to Chapter 5 for details. Snort is a registered trademark of SourceFire, INC. All rights reserved. This research is partly funded by the European Commission IST-RI Project Interactive European Grid. 4/11 PUBLIC Installation Guide

5 1 About the Software The Active Security task proposes to consider security measures for an interactive framework, and subsequently to enhance interactive operation with active security tools. The architecture of the Active Security Infrastructure (ASI), is divided into two layers: Monitoring and control layer Analysis layer Communication between the two layers is provided by R-GMA, a grid monitoring and information system, originally developed by the European DataGrid project, and currently being re-engineered as part of EGEE. R-GMA is a relational implementation of the Global Grid Forums (GGF) Grid Monitoring Architecture. The monitoring and control layer resides at site level, i.e., the components contained in this level are to be installed on the gateway components at all sites within the int.eu.grid testbed. The layer consists of two components, Security Monitoring (SM) and the Control Engine. The purpose of the second layer of the ASI is to filter and analyse the alerts collected by the Security Monitoring component, in order to detect patterns that would signify an attempted attack on the Grid infrastructure. Because it is expected that a significant number of alerts will be generated and logged it is intended to automate this analysis as much as possible. This layer resides at the Operations Centre level, i.e., the services contained in this layer are installed only at the site responsible for grid operations, or the site responsible for overall security of the Grid testbed. This layer is composed of a series of filtering steps, from which the output of each should be a single alert of higher priority, composed from an input of multiple lower priority alerts. The first of these filtering steps is the Alert Analysis; the second is the Alert Correlation Engine. This document describes the installation of the Security Monitoring component. 1.1 Software Components This component is responsible for monitoring the state of security of the site, and for reporting detected security events to the Operations Centre. The monitoring is to be performed by standard security components (e.g., Snort [1], Tripwire [2]), which have been R-GMA-enabled. In the current implementation the initial security component used is Snort, an open-source network-based intrusion detection system. An output-plugin has been provided for Snort that makes use of the R-GMA Producer API to stream any alerts logged by Snort to the R-GMA. This results in each site streaming alerts into the information system In order for the security events detected and published by the Security Monitoring component to be collected at the operations centre a second R-GMA component, a SecondaryProducer is used. A SecondaryProducer aggregates streams from multiple Producers and stores the information into a MySQL database. By running a SecondaryProducer at the Operations Centre that queries for the events being published by the Security Monitoring component, all the events can be aggregated to form a security alert archive. Installation Guide PUBLIC 5/11

6 Chapter 1. About the Software 1.2 Dependencies For the initial deployment of the ASI in the int.eu.grid testbed the SM component is to be deployed on the Computing Element. The following lists the RPMs that should be installed on the CE node: 1. snort-rgma (a) snort (b) snort-rules (c) glite-rgma-api-c i. glite-rgma-base The CE must have a valid host certificate. It must also have access to the ASI secure R-GMA server. 6/11 PUBLIC Installation Guide

7 2 Installation in the int.eu.grid Testbed The int.eu.grid testbed are managed by the YAIM deployment support tool. This tool allows for the automatic installation of the software on all the required node. A YAIM plugin has been provided to configure the component correctly. To install the component the following commands should be executed on the CE node. apt-get install snort-rules apt-get install snort-rgma apt-get install i2g-yaim-snort The YAIM plugin will add the Snort configuration function the node-info.def file for both the CE and glite-ce node types. To execute the configuration manually use the following command: /opt/glite/yaim/scripts/run function path-to-site-config-file config i2g snort 2.1 Manual Post Installation Steps Snort should be correctly configured by the YAIM script. In order to allow the Snort sensor to publish alerts to the Active Security R-GMA server the following information must be sent to the Active Security task team (crossgrid-mgr@cs.tcd.ie). 1. The distinguished name of host certificate of the machine that will be running Snort. This can be obtained using the following command: openssl x509 -in /etc/grid-security/hostcert.pem -noout -subject 2. The fully qualified domain name and IP address of the Snort host. It is also important that the R-GMA server, cagraidsvr09.cs.tcd.ie, is allowed access to the Snort host through any firewalls. Outbound access from the Snort host to the R-GMA server should also be allowed, for at least ports 8443 and Installation Guide PUBLIC 7/11

8 Chapter 3. Manual Installation 3 Manual Installation To manually install the Security Monitoring component the following steps should be followed. If the R-GMA API has not been previously installed: apt-get install glite-rgma-api-c Next the following Snort RPMs should be installed: apt-get install snort-rules apt-get install snort-rgma To configure Snort to log to the secure R-GMA provided by the Active Security task the following steps should be followed: 1. Copy the host certificate and key to the Snort configuration directory: cp /etc/grid-security/host*.pem /etc/snort/ chown snort:snort /etc/snort/host*.pem 2. Create the R-GMA authorization configuration file, ClientAuthentication.props in the directory /etc/snort/etc/rgma: Add the following to this file: sslcertfile=/etc/snort/hostcert.pem sslkey=/etc/snort/hostkey.pem crlenabled=true crlfiles=/etc/grid-security/certificates/*.r0 sslcafiles=/etc/grid-security/certificates/*.0 3. Create the R-GMA configuration file rgma.conf in /etc/snort/etc/rgma: Add the following line to this file: PrimaryProducer= 4. Edit the file /etc/sysconfig/snort and add the following two lines: unset X509 USER PROXY export RGMA HOME=/etc/snort Also ensure the line beginning ALERTMODE is commented out. 5. Edit the file /etc/snort/snort.conf: Add the line: output rgma: log, SITE NAME, trustfile=/etc/snort/etc/rgma/clientauthentication.props Where SITE NAME is the name of your site e.g., TCD-I2G Once these steps have been completed the post installation steps given in Section 2.1 should be followed. 8/11 PUBLIC Installation Guide

9 4 Running and Testing The R-GMA Snort monitoring is controlled using the Snort init.d script. To start the monitoring issue the following command: /etc/init.d/snortd start To stop the monitoring: /etc/init.d/snortd stop Aswell as logging to the R-GMA, any detected alerts will also be visible in the Snort log directory, /var/log/snort, by default. Installation Guide PUBLIC 9/11

10 Chapter 5. EDG License Agreement 5 EDG License Agreement Copyright (c) 2005 CrossGrid. All rights reserved. This software includes voluntary contributions made to the CrossGrid Project. For more information on CrossGrid, please see Installation, use, reproduction, display, modification and redistribution of this software, with or without modification, in source and binary forms, are permitted. Any exercise of rights under this license by you or your sub-licensees is subject to the following conditions: 1. Redistributions of this software, with or without modification, must reproduce the above copyright notice and the above license statement as well as this list of conditions, in the software, the user documentation and any other materials provided with the software. 2. The user documentation, if any, included with a redistribution, must include the following notice: This product includes software developed by the CrossGrid Project ( Alternatively, if that is where third-party acknowledgments normally appear, this acknowledgment must be reproduced in the software itself. 3. The names CrossGrid and CG may not be used to endorse or promote software, or products derived therefrom, except with prior written permission by cgoffice@cyfronet.krakow.pl. 4. You are under no obligation to provide anyone with any bug fixes, patches, upgrades or other modifications, enhancements or derivatives of the features, functionality or performance of this software that you may develop. However, if you publish or distribute your modifications, enhancements or derivative works without contemporaneously requiring users to enter into a separate written license agreement, then you are deemed to have granted participants in the CrossGrid Project a worldwide, non-exclusive, royalty-free, perpetual license to install, use, reproduce, display, modify, redistribute and sub-license your modifications, enhancements or derivative works, whether in binary or source code form, under the license conditions stated in this list of conditions. 5. DISCLAIMER THIS SOFTWARE IS PROVIDED BY THE CROSSGRID PROJECT AND CONTRIBUTORS S ISAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, OF SATISFACTORY QUALITY, AND FIT- NESS FOR A PARTICULAR PURPOSE OR USE ARE DISCLAIMED. THE CROSSGRID PROJECT AND CONTRIBUTORS MAKE NO REPRESENTATION THAT THE SOFTWARE, MODIFICA- TIONS, ENHANCEMENTS OR DERIVATIVE WORKS THEREOF, WILL NOT INFRINGE ANY PATENT, COPYRIGHT, TRADE SECRET OR OTHER PROPRIETARY RIGHT. 6. LIMITATION OF LIABILITY THE CROSSGRID PROJECT AND CONTRIBUTORS SHALL HAVE NO LIABILITY TO LICENSEE OR OTHER PERSONS FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES OF ANY CHARACTER INCLUDING, WITHOUT LIM- ITATION, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, LOSS OF USE, DATA OR PROFITS, OR BUSINESS INTERRUPTION, HOWEVER CAUSED AND ON ANY THEORY OF CONTRACT, WARRANTY, TORT (INCLUDING NEGLIGENCE), PRODUCT LIABILITY OR OTH- ERWISE, ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 10/11 PUBLIC Installation Guide

11 Bibliography Bibliography [1] Snort. April [2] Open source Tripwire. April Installation Guide PUBLIC 11/11