Apache Audit Capability Development

1
Apache Audit CapabilityDevelopment

• Design

2
Overview

• Motivation
• Design Goals
• Challenges
• Architecture
• Design Choices
• Conclusion

3
Motivation

• Auditing (Required for web servers because )
• Web Servers make their own security decisions.
• Detect occurrence of an attack.
• Detect security policy mis-configuration.
• Apache Most popular web server
• Powers 40 million sites,70 of all web sites.
  Source Netcraft Survey Feb 2005.
• BSM De facto standard for audit data.

4
Design Goals

• Short term (This Iteration)
• Identify program flow in Apache.
• Audit basic events using Suns BSM format.
• Long term (Future Iterations)
• Identify the decision points in Apache.
• Capture and Audit all key decision points.

5
Design Challenges

• Interfacing with two complicated systems. (Apache
  and Sun BSM)
• Impact
• Apache Intricate? Steep learning curve.
• Suns BSM Undocumented ? Need for
  experimentation.

6
Architecture

• Audit Index module.
• Collection of Auditors.
• Auditors Collect relevant data for an audit
  event.
• Audit Receptor module.
• Miniature auditing server.
• Receives audit package from auditors and
  transfers to Encoder.
• Audit Encoder module.
• Encodes audit data into conformable format.
• Makes System call to place data into audit trail.

7
The Big Picture
8
Data Flow
9
Design Choices (Why we did it like this?)

• Index module auditors list
• Extendible design.
• Forking child processes (for Encoder module)
• Avoid blocking on system calls.
• Process Vs. Thread model
• Process model conforms with Apaches model.
• UDP (User Datagram Protocol) for audit package
  transfer.
• Less overhead than TCP.

10
Wrapping up

• Our Project augments Apache Web server with audit
  capability.
• Features
• Extendible robust design
• Addition of new audit events.
• Can be fine tuned for performance.
• Maintaining a pool of encoder processes.
• Provision for future configuration.
• E.g.. Certain class of events are audited.

11
Thanks!!!

• Team
• Dr. Antón and Dr. Earp
• Project Sponsors from McAfee
• Mr. Mark Feldman
• Mr. Pete Dinsmore
• Dr. Erik Mettala
• Audience

12
Questions