OSSEC HIDS, Host Based Intrusion Detection System

1
OSSEC HIDS, Host Based Intrusion Detection System

• Aurora Mazzone, INFN Sezione di Torino
• Parte Terza

2
Analisi dei log file di configurazione

• decoder
• /var/ossec/etc/decoder.xml
• /var/ossec/etc/local_decoder.xml
• rules
• /var/ossec/rules/.xml
• /var/ossec/rules/local_rules.xml

3
Analisi dei log file di configurazione

• ossec.conf
• ltrulesgt
• ltincludegtrules_config.xmllt/includegt
• ltincludegtpam_rules.xmllt/includegt
• ltincludegtsshd_rules.xmllt/includegt
• ltincludegttelnetd_rules.xmllt/includegt
• ...
• lt/rulesgt

4
Analisi dei log

• Tre fasi
• pre-decoding
• decoding
• rules

5
Pre-decoding

• Informazioni statiche
• hostname
• program_name
• data/timestamp
• log

6
Pre-decoding

• Oct 28 142139 atropo sshd855 Accepted
  password for jack from 192.135.19.13 port 45018
  ssh2

7
Pre-decoding

• Phase 1 Completed pre-decoding.
• full event 'Oct 28 142139 atropo
  sshd855 Accepted password for jack from
  192.135.19.13 port 45018 ssh2'
• hostname 'atropo'
• program_name 'sshd'
• log 'Accepted password for jack from
  192.135.19.13 port 45018 ssh2'
• La parte di log analizzata in questa fase è
• Oct 28 142139 atropo sshd855

8
Decoding

• Informazioni dinamiche
• user
• protocol
• source/destination port
• source/destination ip
• action
• id
• url
• ...

9
Decoding

• Oct 28 142139 atropo sshd855 Accepted
  password for jack from 192.135.19.13 port 45018
  ssh2

10
Decoding

• Phase 2 Completed decoding.
• decoder 'sshd'
• dstuser 'jack'
• srcip '192.135.19.13'

11
Decoding

• Sshd parent decoder
• ltdecoder name"sshd"gt
• ltprogram_namegtsshdlt/program_namegt
• lt/decodergt
• Dal pre-decoding
• program_name 'sshd'

12
Decoding

• Sshd child decoder
• ltdecoder name"sshd-success"gt
• ltparentgtsshdlt/parentgt
• ltprematchgtAcceptedlt/prematchgt
• ltregex offset"after_prematch"gt \S for (\S)
  from (\S) port lt/regexgt
• ltordergtuser, srciplt/ordergt
• ltftsgtname, user, locationlt/ftsgt
• lt/decodergt

13
Decoding alcuni tag

• Sshd child decoder
• ltparentgt nome del decoder padre da cui
  dipende.
• ltprematchgt match di una stringa (anche con
  espressioni regolari)? (os_regex)?
• ltregexgt espressioni regolari (os_regex)
  capture groups
• _at_offset punto da cui partire per regex
• ltordergt etichette per le informazioni estratte

14
Decoding os_regex

• espressioni regolari
• non troppe opzioni ma veloci
• utilizzata da tutte le opzioni dei decoder con
  espressioni regolari o match di stringhe
  (ltprematchgt e ltregexgt) e dal tag ltregexgt nelle
  regole?

15
Rules

• Oct 28 142139 atropo sshd855 Accepted
  password for jack from 192.135.19.13 port 45018
  ssh2

16
Rules filtering

• Phase 3 Completed filtering (rules).
• Rule id '5715'
• Level '3'
• Description 'SSHD authentication
  success.'
• Alert to be generated.

17
Rules filtering

• Sshd parent rule
• ltrule id"5700" level"0" noalert"1"gt
• ltdecoded_asgtsshdlt/decoded_asgt
• ltdescriptiongtSSHD messages grouped.lt/descripti
  ongt
• lt/rulegt

18
Rules alcuni tag

• _at_id id univoco che identifica ogni regola (più
  di 800)?
• _at_level da 0 a 15, livello di importanza.
• ltdecoded_asgt nome del decoder che ha già
  decodificato il log (se presente)?

19
Rules filtering

• Sshd child rules
• ltrule id"5715" level"3"gt
• ltif_sidgt5700lt/if_sidgt
• ltmatchgtAcceptedauthenticated.lt/matchgt
• ltdescriptiongtSSHD authentication
  success.lt/descriptiongt
• ltgroupgtauthentication_success,lt/groupgt
• lt/rulegt

20
Rules alcuni tag

• ltif_sidgt id della regola padre da cui questa
  dipende
• ltmatchgt match di una stringa (os_match)?
• ltgroupgt gruppo aggiuntivo assegnato all'evento

21
Rules os_match

• match veloce di una stringa
• non supporta espressioni regolari
• molto semplice ma più veloce di os_regex
• usata nelle regole da tutti i tag che confrontano
  un dato (non da regex)?

22
Relazione tra regole e decoder

• Decoder utilizzato solo nel caso in cui sia
  necessario estrarre informazioni dinamiche dal
  log da confrontare successivamente nelle regole,
  da utilizzare per l'fts o nell'active-response.
• Regole possono esserci regole che non fanno
  riferimento a nessun decoder.

23
Regole composite

• Correlazione di eventi
• condizione
• counter
• timeframe
• elementi in comune (stesso utente, stesso ip
  sorgente, ...)?

24
Regole composite

• Correlazione di eventi
• condizione
• ltif_matched_sidgt
• ltif_matched_groupgt
• ltif_matched_regexgt

25
Regole composite

• Correlazione di eventi
• counter
• _at_frequencyrule
• timeframe
• _at_timeframerule

26
Regole composite

• Correlazione di eventi
• elementi in comune
• same_source_ip
• same_src_port
• same_dst_port
• same_user
• same_location
• same_id
• different_url

27
Regole composite

• 10x
• Dec 8 235633 localhost sshd2688 Failed
  password for root from 192.168.108.1 port 57084
  ssh2
• 1x
• Dec 8 235651 localhost sshd2699 Accepted
  password for root from 192.168.108.1 port 57087
  ssh2

28
Regole composite

• Failed login
• Phase 2 Completed decoding.
• decoder 'sshd'
• dstuser 'root'
• srcip '192.168.108.1'
• Phase 3 Completed filtering (rules).
• Rule id '5716'
• Level '5'
• Description 'SSHD authentication failed.'
• Alert to be generated.

29
Regole composite

• Rule 5716
• ltrule id"5716" level"5"gt
• ltif_sidgt5700lt/if_sidgt
• ltmatchgtFailederror PAM
  Authenticationlt/matchgt
• ltdescriptiongtSSHD authentication
  failed.lt/descriptiongt
• ltgroupgtauthentication_failed,lt/groupgt
• lt/rulegt

30
Regole composite

• Authentication success
• Phase 2 Completed decoding.
• decoder 'sshd'
• dstuser 'root'
• srcip '192.168.108.1'
• Phase 3 Completed filtering (rules).
• Rule id '5715'
• Level '3'
• Description 'SSHD authentication
  success.'
• Alert to be generated.

31
Regole composite

• Regola 5715
• ltrule id"5715" level"3"gt
• ltif_sidgt5700lt/if_sidgt
• ltmatchgtAcceptedauthenticated.lt/matchgt
• ltdescriptiongtSSHD authentication
  success.lt/descriptiongt
• ltgroupgtauthentication_success,lt/groupgt
• lt/rulegt

32
Regole composite

• Regola 5720
• ltrule id"5720" level"10" frequency"6"gt
• ltif_matched_sidgt5716lt/if_matched_sidgt
• ltsame_source_ip /gt
• ltdescriptiongtMultiple SSHD authentication
  failures.lt/descriptiongt
• ltgroupgtauthentication_failures,lt/groupgt
• lt/rulegt
• Match dopo 6 login falliti su ssh (5716).

33
Regole composite

• Failed login
• 6 tentativi di accesso falliti 6 match della
  regola 5716 regola 5720
• regola 5720 group authentication_failures
• srcip '192.168.108.1'

34
Regole composite

• Authentication success
• 1 login corretto 1 match della regola 5715
• regola 5715 group authentication_success
• srcip '192.168.108.1'

35
Regole composite

• Regola 40112
• ltrule id"40112" level"12" timeframe"240"gt
  ltif_groupgtauthentication_successlt/if_groupgt
  ltif_matched_groupgtauthentication_failureslt/if_matc
  hed_groupgt
• ltsame_source_ip /gt
• ltdescriptiongtMultiple authentication failures
  followed lt/descriptiongt
• ltdescriptiongtby a success.lt/descriptiongt
• lt/rulegt

36
Regole composite

• 6x 5716 (authentication failed) 5720
  (authentication_failures)?
• 1x 5715 (authentication_success)?
• 40112 (same_source_ip)?

37
Regole composite

• Phase 2 Completed decoding.
• decoder 'sshd'
• dstuser 'root'
• srcip '192.168.108.1'
• Phase 3 Completed filtering (rules).
• Rule id '40112'
• Level '12'
• Description 'Multiple authentication
  failures followed by a success.'
• Alert to be generated.

38
(No Transcript)