KCLUG

1 participants
3235 discussions

Checking System Utilities - cleaner version
by Don Erickson 07 Mar '05

07 Mar '05

I've cleaned up the testutils.pl script and the instructions, and am re-posting this to get a cleaner copy in the archives. - I've been thinking about this rootkit detection and exposure issue, and here are my thoughts: To me, in determining the integrity of any system, the core question is, have the system utilites been compromised? In the equestrian sporting world there is a saying, "Pretty is as Pretty does." From this philosophy, what do the utilites say, and is there a difference between the output of the utilities on the machine and "known clean" utilities? I can't get completely past the feeling that any other test is just window dressing, and while they are all useful tools, it seems to me that any of them could possibly be compromised with a sophisticated enough rootkit. When you are root, _in theory_ you can rewrite md5sums, dates, and even remote hosts used to retrieve live trusted sums. I know of no rootkits that currently do this, but I can imagine how it might be possible. Anyways, with help from a "Building a live CD" article in this month's Linux Journal, here is the procedure that I have come up with to test system utilities on any machine without a reboot: You need a knoppix cd and about 2 gig of space to use the utilities on the knoppix cd. Here's the recipe: Drop the KNOPPIX cd into the tray. Download the cloop-utils package, on debian this is # apt-get install cloop-utils Mount the Knoppix cd: # mount /dev/cdrom /mnt Extract the compressed knoppix filesystem (this will take a while) # extract_compressed_fs /mnt/KNOPPIX/KNOPPIX > /tmp/knoppix-compressed Then mount the extracted filesystem. # mkdir /tmp/knoppix; mount -o loop /tmp/knoppix-compressed /tmp/knoppix Okay, now you're set. Is there a difference in the output of the current system utilities and that of the knoppix cd utilities? Here's a perl script to check: -------8<------------------------------------------ #!/usr/bin/perl # testutils.pl Don Erickson 2005 ######################################################################## # # This script will test the output of commonly trojaned programs. # # The live Knoppix disc must be cloop mounted at /tmp/knoppix/ # ####################################################################### @testthese = ("ps ax", "df", "netstat", "ifconfig", "ls -R", "iptables -L", #"du / -x --exclude=tmp" ); $i=0; $outfile="/tmp/testresults.txt"; $sysout="/tmp/sysout";$knoppixout="/tmp/knoppixout"; open(OUTFILE,">$outfile") || die "Can't open $outfile"; close(OUTFILE,"$outfile"); open(OUTFILE,">>$outfile"); foreach (@testthese) { $testpath = `which $testthese[$i]`;$testpath =~ s/\n//; $testargs = $testthese[$i];$testargs =~ s/^[^ ]+//; $testthis = $testpath.$testargs; print "Testing output of '$testthis'\n"; print OUTFILE "\n########\nDiff of $testthis :: '<' = system '>' = knoppix\n\n"; print "System..."; system("$testthis > $sysout"); print "done. Knoppix..."; system("env LD_LIBRARY_PATH=/tmp/knoppix/lib /tmp/knoppix$testthis > $knoppixout"); print "done.\n"; system("env LD_LIBRARY_PATH=/tmp/knoppix/lib /tmp/knoppix/usr/bin/diff $sysout $knoppixout >> $outfile") == 0; $i++; } print OUTFILE "Tests concluded.\n"; print "Tests concluded.\n"; print "Read the results in $outfile\n"; exit; --------->8----------------------------- Obviously this script can be edited to test the output of any utility that you wish to check, just add the command to the @testthese array. I'm sure that there are lots of lists of "normally rewritten utilities" for most rootkits on the web. The 'du' test is commented out as this one will take a chunk of time to run. The results will show expected differences, but any seriously funny stuff should reach out and grab you by the throat. If anybody sees any flaws in my thinking here, feel free to point them out. At this point I don't see why this wouldn't work, and while trojaned kernel modules are getting more common in rootkits, I can't think of how a trojaned utility could hide from this type of scrutiny. Regards, -Don

4 5

Checking System Utilities
by Don Erickson 06 Mar '05

06 Mar '05

I've been thinking about this rootkit detection and exposure issue, and here are my thoughts: To me, in determining the integrity of any system, the core question is, have the system utilites been compromised? In the equestrian sporting world there is a saying, "Pretty is as Pretty does." From this philosophy, what do the utilites say, and is there a difference between the output of the utilities on the machine and "known clean" utilities? I can't get completely past the feeling that any other test is just window dressing, and while they are all useful tools, it seems to me that any of them could possibly be compromised with a sophisticated enough rootkit. When you are root, _in theory_ you can rewrite md5sums, dates, and even remote hosts used to retrieve live trusted sums. I know of no rootkits that currently do this, but I can imagine how it might be possible. Anyways, with help from a "Building a live CD" article in this month's Linux Journal, here is the procedure that I have come up with to test system utilities on any machine without a reboot: You need about 2 gig of space to use the utilites on a knoppix cd, and a knoppix cd. Here's the recipe: Drop a KNOPPIX cd into the tray. Download the cloop-utils package, on debian this is # apt-get install cloop-utils Mount the Knoppix cd: # mount /dev/cdrom /mnt Extract the compressed knoppix filesystem (this will take a while: go bake a cake or something) # extract_compressed_fs /mnt/KNOPPIX/KNOPPIX > /tmp/knoppix-compressed Then mount the extracted filesystem. # mkdir /tmp/knoppix; mount -o loop /tmp/knoppix-compressed /tmp/knoppix Symlink the libraries to the knoppix directory: Okay, now you're all set. Does the output of the utilites match? # ps ax > /tmp/sysout; env LD_LIBRARY_PATH=/tmp/knoppix/lib \ /tmp/knoppix/bin/ps ax > /tmp/knoppixout; \ diff /tmp/sysout /tmp/knoppixout Obviously these commands must be edited for any utility that you wish to check, I'm sure that there are lots of lists of "normally rewritten utilities" for most rootkits on the web and a script could be written check them all. ps ax will show expected differences, but any seriously funny stuff should reach out and grab you by the throat. If anybody sees any flaws in my thinking here, feel free to point them out. At this point I don't see why this wouldn't work, and I can't imagine how a rootkit could hide from this type of scrutiny. Regards, -Don

1 1

logrotate problem
by Brian Densmore 05 Mar '05

05 Mar '05

Greetings luggites. I've been getting this error for several days now. Not much of a problem, but I would like to know why and how to fix it. I'm getting a system email with the following text. /etc/cron.daily/logrotate: error running shared postrotate script for /var/log/apache-ssl/*.log run-parts: /etc/cron.daily/logrotate exited with return code 1 Two things of note. First the log.1 files seems to be the active log files. Secondly the current log files have an older date, the same date as when I think the logrotate started failing on the apache-ssl files. I have today manually "rotated" the log files. This I did by: creating a new directory for the old gzipped files, gzipping the very large log files, moving them to version *.log.2.gz, moving the "current" log files to *.log.1, and touching *.log files. Not much else to go on. I thought perhaps it might have something to do with the size of the log files, or the number of old log files. One would expect logrotate to handle both cases. Brian Densmore "Three OS's from corporate-kings in their towers of glass, Seven from valley-lords where orchards used to grow, Nine from dotcoms doomed to die, One from the dark lord Gates on his dark throne In the Land of Redmond where the Shadows lie. One OS to rule them all, one OS to find them, One OS to bring them all and in the darkness bind them, In the Land of Redmond where the Shadows lie." john thrum

3 2

OT: 42
by Richard A. Franklin 04 Mar '05

04 Mar '05

http://hitchhikers.movies.go.com/main.html Plays nicely with the embedded MPlayer in Firefox. Pre-configured, like most goodies in Mepis distro. "have a nice day" Richard

1 0

Re: kclug broadcast
by mike＠handuma.com 03 Mar '05

03 Mar '05

Thanks to everyone who helped make the live broadcast a success and special thanks to Cymor who ran the server and confugured the photo gallery even though he was not fully recovered from the operation to his arm! Michael http://www.handuma.com

1 0

kclug broadcast
by Richard A. Franklin 03 Mar '05

03 Mar '05

listened in with xmms, and saw the pictures at www.kclug.org/gallery Great job!

1 0

Demo CD's
by Bill Cavalieri 02 Mar '05

02 Mar '05

If anyone is interested in checking these out, I'll be bringing 5 full version copies of Novell Linux Desktop 9 (with 60 days of free updates). 2 copies of Suse Linux Enterprise 9 (30 days of free updates). 2 copies of Novell Open Enterpise Server beta on dvd. -Bill

1 0

RE: a simpler Gentoo
by Brian Kelsay 02 Mar '05

02 Mar '05

Yep. Stage 3 install. I only mentioned the article because of someone talking about Gentoo in IRC last night. It's not my bag since I'm getting better with Debian-based distros, but to each their own. Not sure what to tell you on the power saving lib problems on your Mepis. If you bring it in then I could have a look or one of the many Debian gurus could help. JClinton helped me determine that I need a Debian that is not mixed (apt-pinned) stable, unstable and testing in order to compile KISO. I mentioned it before, it's an ISO editor like WinISO that I'd like to have, but there are only RPMs and sometimes not even those. I'm prolly going to see if I can set my Mepis desktop to just unstable in order to compile this small but complex app. You might want to try the new SimplyMepis 3.3 that just was released on the 25th. Download from Mr. Bass' FTP mirror. 1Mb/s! Brian Kelsay >>> "Brian Densmore" <> 03/02/05 11:46AM >>> Gentoo in a straight-jacket, interesting. It looks like they are using the precompiled version of Gentoo, if I'm reading it right.

1 0

RE: a simpler Gentoo
by Brian Densmore 02 Mar '05

02 Mar '05

Gentoo in a straight-jacket, interesting. It looks like they are using the precompiled version of Gentoo, if I'm reading it right. I have three issues with going back to Gentoo. Sometimes they "freeze" an application for whatever reason. I always have trouble finding out how to unfreeze it and can't remember if I've ever successfully done so. Secondly, sometimes I need to install an application that uses a frozen app, because the developer hasn't updated his system or has the app unfrozen on his. Third and last, I've had my gentoo systems actually get fubared more than once from some funky thing I've done with portage. I am now running debian systems all greater than 1 year with no mishaps, no unfixed failed installs, no fubared update systems. I do have one issue with my version of debian, there is some dynamically loaded power saving libraries that I uninstalled that the system sometimes complains about not being able to find. I have looked for where these could be and haven't been able to determine where Mepis configured these items and uninstalling failed to remove these things, which tells me the Mepis people did some custom configuration stuff. I admit, I haven't looked to hard to find it, just in /etc and in the library database. After next week when I'll have lots of free time, maybe I'll hunt it down (anyone want to adopt a soon to be out-of-work programmer?). Brian Densmore > -----Original Message----- > From: Brian Kelsay > > http://madpenguin.org/cms/?m=show&id=3321 > VidaLinux 1.1 > I think he could have done a better review of the free > download version, but have a look. > > Brian Kelsay >

1 0

a simpler Gentoo
by Brian Kelsay 02 Mar '05

02 Mar '05

http://madpenguin.org/cms/?m=show&id=3321 VidaLinux 1.1 I think he could have done a better review of the free download version, but have a look. Brian Kelsay

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

KCLUG