Quest InTrust Preparing for Auditing and Monitoring Linux

Transcription

1 Quest InTrust Preparing fr Auditing and Mnitring Linux

2 2018 Quest Sftware Inc. ALL RIGHTS RESERVED. This guide cntains prprietary infrmatin prtected by cpyright. The sftware described in this guide is furnished under a sftware license r nndisclsure agreement. This sftware may be used r cpied nly in accrdance with the terms f the applicable agreement. N part f this guide may be reprduced r transmitted in any frm r by any means, electrnic r mechanical, including phtcpying and recrding fr any purpse ther than the purchaser s persnal use withut the written permissin f Quest Sftware Inc. The infrmatin in this dcument is prvided in cnnectin with Quest Sftware prducts. N license, express r implied, by estppel r therwise, t any intellectual prperty right is granted by this dcument r in cnnectin with the sale f Quest Sftware prducts. EXCEPT AS SET FORTH IN THE TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, QUEST SOFTWARE ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL QUEST SOFTWARE BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF QUEST SOFTWARE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Quest Sftware makes n representatins r warranties with respect t the accuracy r cmpleteness f the cntents f this dcument and reserves the right t make changes t specificatins and prduct descriptins at any time withut ntice. Quest Sftware des nt make any cmmitment t update the infrmatin cntained in this dcument. If yu have any questins regarding yur ptential use f this material, cntact: Quest Sftware Inc. Attn: LEGAL Dept 4 Plaris Way Alis Viej, CA Refer t ur Web site ( fr reginal and internatinal ffice infrmatin. Patents Quest Sftware is prud f ur advanced technlgy. Patents and pending patents may apply t this prduct. Fr the mst current infrmatin abut applicable patents fr this prduct, please visit ur website at Trademarks Quest, the Quest lg, and Jin the Innvatin are trademarks and registered trademarks f Quest Sftware Inc. Fr a cmplete list f Quest marks, visit All ther trademarks and registered trademarks are prperty f their respective wners. Legend CAUTION: A CAUTION icn indicates ptential damage t hardware r lss f data if instructins are nt fllwed. IMPORTANT, NOTE, TIP, MOBILE, r VIDEO: An infrmatin icn indicates supprting infrmatin. InTrust Preparing fr Auditing and Mnitring Linux Updated - Nvember 2017 Versin

3 Cntents Linux Auditing and Mnitring Overview 4 Requirements 5 Installatin 6 Installing Agents 7 Syslg Cnfiguratin 8 Cnfiguratin Specifics fr Debian 8, Oracle Linux and RedHat Enterprise Linux 6.3 and Later 8 Preventing Skipping f Frwarded Messages 9 InTrust Cnfiguratin 10 Auditing, Reprting, and Real-Time Mnitring 10 Redhat Linux Syslg and SuSE Linux Syslg Data Surces 10 Text File-Mnitring Data Surces 11 External Events Data Surces 12 Script Event Prvider Data Surces 12 Use Scenaris 13 Syslg Cnfiguratin Mnitring 13 Tracking Security Incidents 13 Abut us 14 Cntacting Quest 14 Technical supprt resurces 14 InTrust Preparing fr Auditing and Mnitring Linux 3

4 Linux Auditing and Mnitring Overview The Linux Knwledge Pack expands the auditing and reprting capabilities f InTrust t SuSE Linux Enterprise Server, Red Hat Enterprise Linux, Oracle Linux and Debian GNU/Linux. The Knwledge Pack enables InTrust t wrk with Syslg and text lgs. The fllwing table shws what yu can audit and mnitr n Linux: Data Surce Gathering Real-Time Mnitring Syslg messages X X Text lgs f any frmat X Cnfiguratin file mdificatin X X InTrust Preparing fr Auditing and Mnitring Linux Linux Auditing and Mnitring Overview 4

5 Requirements InTrust supprts auditing and mnitring f the fllwing Linux distributins: Red Hat Enterprise Linux 7.4, 7.3, 7.2, 7.1, 7, 6.9, 6.8, 6.7, 6.6, 6.5, 6.4, 6.3 SuSE Linux Enterprise Server 11, 10 Oracle Linux 7.4, 7.3, 7.2, 7.1, 7, 6.9, 6.8, 6.7, 6.6, 6.5, 6.4, 6.3 Debian GNU/Linux 8 T prepare a Linux hst, yu need t install an InTrust agent and adjust the cnfiguratin f the Syslg flavr used. Currently, agents must be installed manually n each Linux hst yu want t cver. An alternative agent-free apprach, which is nt cvered in this tpic, is t use Syslg frwarding t an InTrust server. Fr details abut this methd, see Setting Up Gathering f Syslg Data. InTrust Preparing fr Auditing and Mnitring Linux Requirements 5

6 Installatin The Linux Knwledge Pack is installed n tp f an existing InTrust installatin. The fllwing bjects are included: Data surces: Redhat Linux Syslg Redhat Linux Accunts Mnitring Redhat Linux Text Files Mnitring SuSE Linux Accunts Mnitring SuSE Linux Syslg SuSE Linux Text Files Mnitring Gathering plicies: Redhat Enterprise Linux: Cmmn Security Events Redhat Enterprise Linux: All Syslg Messages Redhat Enterprise Linux: Accunts Mnitring Redhat Enterprise Linux: Text files Mnitring SuSE Linux Enterprise Server: Cmmn Security Events SuSE Linux Enterprise Server: All Syslg Messages SuSE Linux Enterprise Server: Accunts Mnitring SuSE Linux Enterprise Server: Text Files Mnitring Imprt plicies: Redhat Enterprise Linux: Cmmn Security Events Redhat Enterprise Linux: All Syslg Messages Redhat Enterprise Linux: Accunts Mnitring Redhat Enterprise Linux: Text Files Mnitring SuSE Linux Enterprise Server: Cmmn Security Events SuSE Linux Enterprise Server: All Syslg Messages SuSE Linux Enterprise Server: Accunts Mnitring SuSE Linux Enterprise Server: Text Files Mnitring InTrust Preparing fr Auditing and Mnitring Linux Installatin 6

7 Cnslidatin plicies: Redhat Linux Lg Cnslidatin Redhat Linux Lg Cnslidatin fr the Last Mnth SuSE Linux Lg Cnslidatin SuSE Linux Lg Cnslidatin fr the Last Mnth Real-time mnitring plicies: Redhat Linux: security SuSE Linux: security Tasks: Redhat Linux daily cllectin f security events Redhat Linux weekly reprting SuSE Linux daily cllectin f security events SuSE Linux weekly reprting Sites: Redhat Linux hsts SuSE Linux hsts NOTE: T wrk with Oracle Linux and Debian GNU/Linux, use the data surces, plicies and sites designed fr Red Hat Enterprise Linux. Installing Agents InTrust agents must be installed manually n Linux hsts. Fr details, see Installing Agents Manually n Linux Cmputers. InTrust Preparing fr Auditing and Mnitring Linux Installatin 7

8 Syslg Cnfiguratin InTrust takes advantage f the Syslg lgging system n Linux cmputers. Syslg prvides data fr auditing and real-time mnitring activities. Syslg functinality is prvided by the syslgd daemn, which accepts messages frm varius surces that supprt lgging, and either writes these messages t files r passes them n t ther hsts in the netwrk. The syslg.cnf file specifies where syslgd sends a message depending n the parameters f the message. Fr a detailed descriptin f this file's frmat, see the syslg.cnf man page. When yu install the InTrust agent n the Linux hst, the necessary entries are autmatically added t syslg.cnf. Yu d nt have t mdify any message redirectin settings manually. Hwever, as lng as yu d nt mdify InTrust-related settings, it is up t yu hw yu cnfigure redirectin f messages t ther destinatins. NOTE: In additin t the syslgd daemn InTrust supprts syslg-ng. In this case the syslg-ng.cnf file needs t be mdified. Cnfiguratin Specifics fr Debian 8, Oracle Linux and RedHat Enterprise Linux 6.3 and Later 1. Create the /etc/syslg.cnf file: tuch /etc/syslg.cnf 2. In the /etc/rsyslg.cnf file, add the fllwing line under #### RULES ####: *.debug /var/lg/intrust_syslg;rsyslog_ TraditinalFileFrmat 3. (On Debian 8, skip this step.) Create the /var/lg/intrust_syslg pipe: mkfif /var/lg/intrust_syslg 4. Restart the rsyslgd daemn using the fllwing cmmand sequence: Fr Oracle and RedHat perating system versins : /etc/rc.d/rc2.d/s12rsyslg stp /etc/rc.d/rc2.d/s12rsyslg start Fr Oracle and RedHat perating system versin 7 and Debian 8: systemctl restart rsyslg InTrust Preparing fr Auditing and Mnitring Linux Syslg Cnfiguratin 8

9 Preventing Skipping f Frwarded Messages Receptin f frwarded Syslg messages relies n named pipes, which have limited capacity. If a pipe pened fr incming messages becmes full, then messages will be skipped. This is a difficult situatin t diagnse, but if yu knw r suspect it is happening n yur message-receiving hst, yu can try increasing the pipe size. The fllwing is a sample Perl script that sets the maximum capacity fr the pipe required by InTrust. Run it (r a variatin f it) n the InTrust agent hst that captures Syslg messages. #!/usr/bin/perl use Fcntl; use cnstant { }; F_SETPIPE_SZ => 1031, F_GETPIPE_SZ => 1032, ################################################################### $MaxPipeBufPath = "/prc/sys/fs/pipe-max-size"; syspen(handle, $MaxPipeBufPath, O_RD) r die "syspen failed: $!"; $MaxPipeBuf = readline(handle) r die "readline failed: $!"; clse Handle; print "\n". "max pipe buffer size = ". $MaxPipeBuf. "\n"; ################################################################### $FilePath = "/var/lg/intrust_syslg"; syspen(handle, $FilePath, O_RD); $CurrBuf = fcntl(handle, F_GETPIPE_SZ, 0) r die "fcntl failed: $!"; print "current pipe buffer size = ". $CurrBuf. "\n"; ################################################################### if( int($currbuf) < int($maxpipebuf) ) { } fcntl(handle, F_SETPIPE_SZ, int($maxpipebuf) ) r die "fcntl failed: $!"; print "new pipe buffer size = ". fcntl(handle, F_GETPIPE_SZ, 0). "\n"; ################################################################### clse Handle; InTrust Preparing fr Auditing and Mnitring Linux Syslg Cnfiguratin 9

10 InTrust Cnfiguratin After yu have taken all the necessary cnfiguratin steps n the target Linux hsts, the InTrust Server takes ver all auditing and real-time mnitring peratins. This sectin describes Linux-specific settings that are nt explained in the ther InTrust dcumentatin. Auditing, Reprting, and Real-Time Mnitring Linux auditing, reprting, and real-time mnitring is similar t wrking with any ther system supprted by InTrust. There is nly ne imprtant difference that refers t active scheduling f the InTrust tasks. Fr infrmatin see the warning nte belw. CAUTION: An active schedule is required t make the agent cache events. If the schedule is disabled, n events are stred. Since all Data Surces described abve use events caching, it is recmmended that yu use at least ne task fr the cache-enabled data surces that run regularly. If yu want t gather data nly n demand, yu must still enable the schedule fr yur task r tasks, but set it t a pint in the future r in the past. The ther Linux auditing, reprting and real-time mnitring peratins d nt have special requirements. The fllwing are details abut the Linux-related data surces in InTrust. Redhat Linux Syslg and SuSE Linux Syslg Data Surces The Redhat Linux Syslg and the SuSE Linux Syslg data surces represent the Syslg audit trails. Syslg auditing and real-time mnitring is based n the flw f data intended fr the syslgd r syslg-ng daemns. The Redhat Linux Syslg ( SuSE Linux Syslg ) data surce is used t analyze the data flw and capture nly the necessary prtins f it. The data surce uses a list f regular expressins. When the data surce is wrking, it applies the expressins, in the rder specified, t each message. The rder f the regular expressins matters because message prcessing stps as sn as the message matches ne f the expressins. When parsing takes place, pairs f parentheses are used in regular expressins t break messages up int numbered fields. Fr example, the fllwing regular expressin: InTrust Preparing fr Auditing and Mnitring Linux InTrust Cnfiguratin 10

11 ^(.{15}) ([-[:alnum:]_.]+) (su)(\([^[]+\)){0,1}(\[[0-9]+\]){0,1}: (sessin pened fr user (.*) by ([^()]*)\(.*\)) matches the fllwing message: Dec 16 12:10:47 es7 su(pam_unix)[23200]: sessin pened fr user rt by jsmith (uid=508) The result is an event with the fllwing fields: Field Name Field Number Field Cntents Cmputer <2> es7 Descriptin <6> sessin pened fr user rt by jsmith(uid=508) Event ID 2 2 Event Surce <3> su Insertin String #1 <6> sessin pened fr user rt by jsmith(uid=508) Insertin String #11 <7> rt Insertin String #12 <8> jsmith The last regular expressin in the predefined data surce is designed t match any message. This ensures that the message is nt lst. The result f this regular expressin is an event where the Descriptin and Insertin String #1 fields bth cntain the descriptive part f the message, if a descriptive part is present. It is nt recmmended that yu mdify predefined regular expressins in the data surce. These expressins are required fr the reprts that cme with the Linux Knwledge Pack. These reprts will ignre any data resulting frm the use f custm regular expressins. If yu create a custm Syslg data surce with yur wn regular expressins, make sure yu use custmized reprts based n the data that these regular expressins help capture. CAUTION: Including a lt f cmplex regular expressins in the data surce may slw dwn Syslg prcessing significantly. Text File-Mnitring Data Surces The Redhat Linux text files mnitring (r SuSE Linux text files mnitring ) and Redhat Linux accunts mnitring (r SuSE Linux accunts mnitring ) scripted data surces are designed t parse specified files. Real-time mnitring rules use these data surces t mnitr the files fr changes. CAUTION: These scripted data surces are nt designed fr general-purpse auditing and mnitring f text-based lgs. They shuld be used nly n cnfiguratin files that preferably d nt exceed 100 kilbytes. T cllect large text-based lgs, use Custm Text Lg Events data surces, as described in the Auditing Custm Lgs with InTrust dcument. T specify the file paths, edit the apprpriate parameters f the data surces. Fr example, t mnitr the /etc/hsts.allw and /etc/hsts.deny files, take the fllwing steps: 1. Open the prperties f the Redhat Linux text files mnitring data surce. 2. On the Parameters tab, select the TextFiles parameter and click Edit. 3. Supply /etc/hsts.allw and /etc/hsts.deny in the dialg bx that appears. InTrust Preparing fr Auditing and Mnitring Linux InTrust Cnfiguratin 11

12 Similarly, yu can edit the UsersFile and GrupsFile parameters f the Redhat Linux accunts mnitring data surce if the lcatin f the passwd and grups files differs frm the default n yur Linux hsts. NOTE: Mnitring the passwd and grups files makes sense if yur Linux envirnment des nt use a directry slutin. With a directry in place, infrmatin in these files is nt imprtant r representative. External Events Data Surces The External Events data surce type is nt represented by any predefined data surces. It is different frm ther data surce types in that it generates event recrds with fields that yu define and hands them ver t the InTrust agent t prcess. Data surces f this type are represented by a cmmand-line utility n the agent side and an InTrust data surce bject n the InTrust server side. This cmmand-line utility frces special events n the InTrust agent running n the same cmputer. The agent stres the events in its backup cache. Frm there, the events can be captured by the gathering r real-time mnitring engine. T create an External Events data surce 1. Right-click the Cnfiguratin Data Surces nde and select New Data Surce. 2. In the New Data Surce Wizard, select the External Events data surce type. 3. Cmplete the remaining steps. Fr details abut External Events data surce settings, see Cnfiguring Data Surces. Script Event Prvider Data Surces InTrust prvides an additinal ptin t create a custm data surce using the Script Event Prvider. This functinality allws t create a script that starts with pre-set frequency. Under sme cnditins that are specified in this script events are generated and then are passed t the InTrust agent. Events are stred in the agent's backup cache. Frm there, the events can be captured by the gathering r real-time mnitring engine. Yu can specify in the certain script: what infrmatin is stred and hw it is rdered in the certain events, what cnditins are required fr event generatin. T create a custm data surce with Script Event Prvider 1. Right-click the Cnfiguratin Data Surces nde and select New Data Surce. 2. In the New Data Surce Wizard, select the Script Event Prvider data surce type. 3. On the Script step select the script language and enter yur script text using XML editr. 4. On the same step specify hw frequently the script shuld run. 5. Cmplete the remaining steps. InTrust Preparing fr Auditing and Mnitring Linux InTrust Cnfiguratin 12

13 Use Scenaris This tpic describes typical situatins in a prductin envirnment and hw InTrust helps handle them. Fr infrmatin abut specific prcedures, such as creating tasks and jbs r activating rules, see the Auditing Guide and Real-Time Mnitring Guide. Syslg Cnfiguratin Mnitring Suppse yu use a finely-tuned Syslg audit plicy in yur envirnment. Yur audit cnfiguratin has prven efficient and reliable, and yu d nt want anyne but a few trusted administratrs t be able t change it. Even s, yu want t knw immediately if the audit plicy is mdified in any way. Use InTrust real-time mnitring capabilities t enable immediate ntificatin. Syslg audit cnfiguratin is defined in the syslg.cnf file, s the slutin in this case is t mnitr this file with InTrust and send an alert whenever the file is mdified. Enable the Syslg.cnf file mdified rule and make sure the apprpriate file paths are supplied as the rule s parameter. Tracking Security Incidents Yu want t receive daily infrmatin abut pssible security issues in yur envirnment, such as brute frce attack attempts. Yu can achieve this by scheduling gathering and reprting jbs with InTrust. T view the resulting reprts use the Knwledge Prtal web applicatin. Take the fllwing steps: 1. Make sure that syslgd r syslg-ng is running. 2. Create an InTrust task that gathers Syslg events frm the apprpriate site (gathering jb), builds reprts based n the gathered data (reprting jb).the resulting reprts are stred in the lcal flder that is specified during InTrust installatin. 3. A gd reprt fr this scenari is "Multiple failed lgin attempts". It is up t yu whether yu want t stre the gathered data in an InTrust repsitry. Yu can als include a ntificatin jb t get ntified f task cmpletin. 4. Schedule the task t run every mrning at a cnvenient time. InTrust Preparing fr Auditing and Mnitring Linux Use Scenaris 13

14 Abut us We are mre than just a name We are n a quest t make yur infrmatin technlgy wrk harder fr yu. That is why we build cmmunitydriven sftware slutins that help yu spend less time n IT administratin and mre time n business innvatin. We help yu mdernize yur data center, get yu t the clud quicker and prvide the expertise, security and accessibility yu need t grw yur data-driven business. Cmbined with Quest s invitatin t the glbal cmmunity t be a part f its innvatin, and ur firm cmmitment t ensuring custmer satisfactin, we cntinue t deliver slutins that have a real impact n ur custmers tday and leave a legacy we are prud f. We are challenging the status qu by transfrming int a new sftware cmpany. And as yur partner, we wrk tirelessly t make sure yur infrmatin technlgy is designed fr yu and by yu. This is ur missin, and we are in this tgether. Welcme t a new Quest. Yu are invited t Jin the Innvatin. Our brand, ur visin. Tgether. Our lg reflects ur stry: innvatin, cmmunity and supprt. An imprtant part f this stry begins with the letter Q. It is a perfect circle, representing ur cmmitment t technlgical precisin and strength. The space in the Q itself symblizes ur need t add the missing piece yu t the cmmunity, t the new Quest. Cntacting Quest Fr sales r ther inquiries, visit Technical supprt resurces Technical supprt is available t Quest custmers with a valid maintenance cntract and custmers wh have trial versins. Yu can access the Quest Supprt Prtal at The Supprt Prtal prvides self-help tls yu can use t slve prblems quickly and independently, 24 hurs a day, 365 days a year. The Supprt Prtal enables yu t: Submit and manage a Service Request View Knwledge Base articles Sign up fr prduct ntificatins Dwnlad sftware and technical dcumentatin View hw-t-vides Engage in cmmunity discussins Chat with supprt engineers nline View services t assist yu with yur prduct InTrust Preparing fr Auditing and Mnitring Linux Abut us 14