Do you trust your OS? How to make sure that someone hasn’t replaced some system files? A file integrity checker (FIC) creates a trusted database of files; once created, it can be used to verify the integrity of the files.

Problem

Developing a policy for a FIC is, as always, a compromise between usability and security. If you are monitoring all files present in the system, you will receive a lot of false positives: in each system, a large number of files is temporary or must be modified. Alerting when these files are changed may not really be interesting, depending on the file and the change. Example: Given a running system with auditing enabled, a saved time ordered sequence of system events (OS logfile) cannot remain static but at the same time the size of the logfile cannot decrease. You can rotate it (close the file and create a new one), but the audit daemon is not designed to remove events from the file. In this case, an alert is useful only if the FIC notes a negative delta in logfile size (FIC limitation: this still does not assure that the logfile was not externally manipulated and had records removed: the FIC just calculates the delta between the logfile size of current and the previous run. If an intruder removes 30kb of data and the logfile has growth 30Mb since the last run, the delta is 30Mb-30kb, is positive and the alert isn’t set off. To assure that the sequence of events cannot be manipulated, different mechanism must be implemented.)

Creating an efficient and effective policy for FIC monitoring is a challenge. In this Labs, such a policy that has been deployed is being looked at. The policy is a basis and can be adapted to specific needs while it maintains usability as well as security. In addition to that, it’s future proof.

The Policy

After some testing and tuneups, the following policy was developed and implemented:

Variables:

Primitives:

The language follows the AIDE standard but the content can be adapted for other FICs.

Summary

File integrity checkers are important components in a security framework. Developing, tuning and maintain an effective monitoring policy can be complex and time expensive. This policy has been used in large RHEL-server environment and proved to be a good starting point for a solid File Integrity Checker.

About the Author

Rocco Gagliardi has been working in IT since the 1980s and specialized in IT security in the 1990s. His main focus lies in security frameworks, network routing, firewalling and log management.

Links

• http://aide.sourceforge.net/stable/manual.html#config