Lecture 16: UNIX Forensics 6/26/2003 CSCE 590 Summer 2003.

Lecture 16: UNIX Forensics

6/26/2003

CSCE 590

Summer 2003

Syslog

• A standard system logging facility– Unix, Windows, routers, switches, blenders, etc

• On UNIX, configuration in /etc/syslog.conf

• Daemon called syslogd

• Can syslog over the network to a dedicated syslog server

• Targeted by intruders

Syslog.conf

• Which messages are sent to which logs

• Each line contains:– Facility field – subsystem that produces the log

file• Auth(security), authpriv, cron, daemon, kern, lpr,

mail, ftp, news, syslog, user, uucp, local0-local7

– Priority field – severity of log (8 levels)• Debug, info, notice, warning, err, crit, alert, emerg

– Action field – name of log file, IP or remote syslog server

Syslog Priority Field

• Debug - all occurrences, everything• Info – usual occurrences (like fyi’s)• Notice – unusual occurrences, investigate• Warning – warning messages• Err – other error conditions• Crit – critical condition or failure• Alert – urgent situation• Emerg (panic) – panic situation (warp core

breach)

Programmer’s interface

• #include <syslog.h>• void openlog(const char *ident, int option,

int facility);– Opens a connection to the system logger for a program

• void syslog(int priority, const char *format, ...);– Generates a log message to be distributed by syslogd

• void closelog(void);– Closes the descriptor to the system logger for a

program

Sample syslog.conf

Shell Histories

• History of all commands you type• In each user’s home directory

– .history– .bash_history– .sh_history– .ksh_history

• Commonly targeted by intruders– Delete it, recreated as directory– Delete it, link it to /dev/null (bit bucket)– Just turn off history function in your shell, delete it

The grep Family• grep – search for string in file

– bzgrep - in a bzip2 compressed file

– zgrep – search possibly compressed files

– zipgrep - search files in a ZIP archive

– grepjar - search files in a jar file for a pattern

• fgrep – search for strings identified within a given file, one pattern per line– bzfgrep - in a bzip2 compressed file

• Egrep – search using extended regular expressions– bzegrep - in a bzip2 compressed file

grep Options

• -r – recursion

• -i – case insensitive

• -a – handle binary files (kind of like piping to strings)

• -v – NOT this string

find

• grep looks in files, find searches other attributes of files (metadata)– File name, including regular expressions, case

insensitive– Time periods for MAC– Belongs to GID or group’s name– Belongs to a UID or user name– Nouser and nogroup – doesn’t have a user or

group defined for its GID or UID

find

– Is on file system of type xxxx– Has a particular inode number– Has a particular number of links to it– Is a symbolic link– Search on permission bits– File size– File type

find Actions

• -print – print what you find

• -printf

• -exec xxx – execute xxx command on a hit

• -ls – list it in “ls –dils” format

• Much more stuff! Good man page to read.

Hiding in the File System

• Hide in a rarely visited or ‘busy’ directory– /dev

• Look for regular files, should be too many

– Font directories– OS source code directories– Man page directories

• Creative naming– …– “. “– “.. “– “ “

Hiding in the File System• Slack space• Deleted files• Unlinked open files• Trojaned system files• Decoy file system mounts

– Mount a file system over existing data in a current file system

– Existing data becomes hidden, could hide an executable being run or a file being written to

– df may show a lot more space used in a file system that you can account for with du

Checking RPMs

• RPM are applications packages (Linux)• Compares info about files in an installed

package with info stored about themin the RPM database

• Simple integrity check– # for i in `rpm –qa`; do rpm –V $i; done

• Error prone and can be subverted• Catches less skilled intruders

Output of Verify RPMs

• S - file Size differs• M - Mode differs, includes permissions, file type• 5 - MD5 sum differs• D - Device major/minor number mis-match• L – (readlink(2)) path mis-match• U - User ownership differs• G - Group ownership differs• T - mtime differs• c – configuration file (expected to change)

Rpm Verify Example

Inode “Timelines”

• ls –lit | sort |more

• List all inodes

• Looking for entries that seem out of place, very high or very low

• If you find any out of place, look for other inodes around that number to find possible related files

Inode “Timelines” Example

Signals

• Simple interprocess communications– One program sends a message to another– Pre-defined messages– 16 or 32 depending on platform

• Some are useful for terminating a program gracefully

• Might be able to freeze it in memory so as not to lose evidence

Useful Signals

• HUP (1) – Hangup• INT (2) – Interrupt, stop running <ctrl>C• KILL (9) – Stop unconditionally and immediately• TERM (15) – Terminate gracefully if possible• STOP (17) – Stop unconditionally; continue with

CONT• TSTP (18) – Stop executing, ready to continue• CONT (19) – Continue executing after STOP

or TSTP• USR1 (30) – A user defined signal

Startup and Shutdown Scripts

• Usually found in /etc• Can be files like rc.local and rc.shutdown• Can be directories of scripts or links to scripts like

rc0.d-rc6.d, rc.d, and init.d• The kernel boots and first loads

– init – process control initialization– If init dies, the system reboots– Makes sure the system enters the correct run level

(single user, multi-user, etc)

BSD-Like RC Scripts

• Simpler scripts:– rc.conf: configuration variables for what to start,

included in other startup scripts– Rc: starts up a bunch of system services that must be

run before securelevel changes– rc.securelevel: levels –1 through 2– rc.local: run next, local services, network, system

daemons– rc.shutdown: clean up commands when system is going

down• Ex. Gracefully stopping a databse

rc.securelevel

• Run after rc script

• Level –1: Permanently insecure– Init can’t raise securelevel but sysctl can

• Level 0: Insecure mode– During bootstrapping, single user– all devices may be read/written subject to

permissions– system file flags may be cleared

rc.securelevel• Level 1: Secure mode (default multi-user)

– Only init may lower securelevel– /dev/mem and /dev/kmem may not be written to– raw disk devices of mounted file systems are read-only– Can’t remove system immutable and append-only file

flags– kernel modules may not be loaded or unloaded

• Level 2: Highly secure mode (Level 1 still applies)– raw disk devices are always read-only, mounted or not– settimeofday(2) may not set the time backwards– ipf(8) and ipnat(8) rules may not be altered– the ddb.console and ddb.panic sysctl(8) variables may

not be raised (keeps people from using in-kernel debugger ddb(4) to modify securelevel)

System V-ish RC Scripts

• On a Solaris machine:– 8 different run levels, 0-6 and s and S (same thing)– Default runlevel in /etc/inittab

• Level s or S: single user state • Level 0: firmware mode• Level 1: sys admin mode, single user, all

filesystems mounted, limited processes running• Level 2: multi-user mode, all multiuser processes

running

Init Levels (cont.)

• Level 3: extended multiuser mode, level 2 + local resources are available over the network

• Level 4: usually not used, can ber defined as alternative multiuser environment

• Level 5: Shut the machine down, safe to power off• Level 6: stop the OS and reboot to default state

level

Startup Scripts

• There is a directory for each of the 0-6 runlevels.• /etc/rc.d/rc0.d -> /etc/rc.d/rc0.d • Also /etc/rc.d/init.d

– Contains the actual startup/shutdown scripts

– Are shell scripts that take as arguments• start – start up the process

• stop – stop the process

• restart – sometimes a restart

Startup Scripts

• Each of the rcX.d directories contain symbolic links to scripts in the init.d directory

• Format of name of link determines argument to start up script and when it is started– K03nfs

• run script pointed to by this link with the stop option (K=Kill)• Run it “third” in the order of scripts

– S75ntpd• run script pointed to by this link with the start option (S=Start)• Run it “75th” in the order of scripts

References

• Chapters 11,12