Samhain Installation and Implementation in Linux

Samhain is another open source HIDS application especially designed to monitor file integrity of the system. Samhain can be deployed in two different ways either standalone mode or client/server mode. The most important function of samhain HIDS is file integrity monitoring, monitoring SUID and SGUI audits, monitoring mount settings, login and logout events, perform integrity check of kernel to detect possible rootkits and finally, it can monitor integrity of syscall table, syscall functions (Wotring, 2005). “System calls provide interface between user applications and privileged kernel space and are the primary target for most rootkits. The handler for each system call is stored in a system call table (Wotring, 2005).”

The installation process for standalone mode will be discussed rather than client/server mode. As we know, regarding this project each HIDS applications are installed in single server therefore, standalone mode will be discussed. Similarly, like previous OSSEC HIDS installation it can be installed downloading, compiling its binary and installing but we must remember to download the latest version. The latest version is samhain 3.0.1 and it is recommended to verify PGP signature.

So basically, doesn't matter which distro your using either Redhat, Debian, openSuse, Slackware

# wget http://la-samhna.de/samhain/samhain-current.tar.gz

# tar –zxvf samhain-current.tar.gz

# tar –zxvf samhain-3.0.1

# cd samhain-3.0.1

# ./configure

The beauty of Samhain is that it has different types of configuration options and each of this option can be used separately for specific purpose but file integrity monitoring option is installed by default. Unlike other HIDS application samhain certain options can be customised for specific task such as: rootkit kernel monitoring, login monitoring, mount check and SUID check etc (Wotring, 2005). However, these are all optional module provided by samhain. The optional packages required for this project are as follows:

# ./configure --enable-login-watch

# ./configure --enable-mount-check

# ./configure --with-kcheck=[/boot/system.map]

# ./configure --with-checksum=CHKSUM

Once these configurations are over we can proceed further with finalising and finishing the installation process.

# make

# make install

By the help of above methods we can successfully download, compile, build and finally install the latest version of samhain. But there are few things to remember before we proceed. During installation process when we finish running “./configure”, it shows us the list of default configured settings.

Samhain has been configured as follows: System binaries: /usr/local/sbin Configuration file: /etc/samhainrc Manual Page: /usr/local/man Data: /var/lib/samhain PID file: /var/run/samhain.pid Log file: /var/log/samhain_log Base key: 814794596, 541454212

The most important files shown above in table 11 are configuration file (/etc/samhainrc) and log file (/var/log/samhain_log). The samhain init scripts can be installed, which will enable samhain to start monitoring every time it reboots. It can be done easily by using following command:

# make install-boot

Now, we need to tune it like a guitar to so that it can do what it does best, monitor for any intrusion and send alert notification if any detected. For us to begin with samhain configuration, we need to keep in mind that it works only as root therefore, we must shift to root mode.

# vim /etc/samhainrc

The samhain provides brief description on configuration lines which makes it easier to understand and configure. First of all, we need to understand what should be monitored and what should be avoided so that we do not generate excessive false positive. Samhain HIDS supports file and directory monitoring. It not only scans directories but can perform in dept scan. The files and directories are defined in a following ways:

file = /var/log/mail

dir = /etc/network

The most intriguing thing is that it is not necessary to define each and every directory in above shown way. It can be defined with an optional recursive depth (N <= 99), where N is number directories it must check. These are the basic that must be understood before proceeding further.

dir = 99/etc

dir =0/

dir = -1/dev/pts

The configuration sample for samhainrc can be seen below

###Samhain Configuration### [ReadOnly] dir = 99/bin dir = 99/sbin dir = 99/var dir = 99/etc dir = 99/usr [Attributes] file = /etc/mtab file = /etc/adjtime file = /etc/motd file = /etc/lvm/.cache [IgnoreAll] dir = -1/var/mail dir = -1/var/run [GrowingLogFiles] dir = 99/var/log SeverityReadOnly=crit SeverityLogFiles=crit SeverityAttributes=crit [Kernel] KernelCheckActive = True KernelCheckInterval = 300 SeverityKernel = info [Utmp] LoginCheckActive = True SeverityLogin=info SeverityLoginMulti=crit SeverityLogout=info  SetMailAddress=you&me@mail.com  SetMailRelay = 127.0.0.1 MailSeverity=none

When installation and configuration of samhain is over, we need to start focusing on creating a baseline database so that samhain can start monitoring for suspicious activity right away. The baseline database can be created easily with root privilege.

# samhain –t init 

Once this command starts it will take some time to finish up creating a baseline database but it all depends on what we want to scan and how deep. The default configuration setting of samhain takes about 4 to 5 minutes to create a baseline database. The moment samhain is finished creating baseline it will save the database in (/var/lib/samhain/) directory. It is advised that once baseline database is created it should not be created again because it append the database and will ignore subsequent checks, either delete or rename before doing so (Wotring, 2005). The best practise would be to use following update command instead of initialising database.

# samhain –t update –interactive

The interactive update will force the database to acknowledge the current state of system and removing previous baseline database. It should not be performed until unless system or network administrator is aware about the changes being made.

However, once we are done with creating a baseline database it better if we check for any configuration error or intrusions. 

# samhain –t check –p warn –foreground

This command starts scanning the whole system for any threats or suspicious activity. It is very important to keep in mind that samhain can run as daemon in background process therefore, “--foreground” should be used so that we can see the alerts err, warn, crit, info.

Enjoy