Getting Started with the Linux Intrusion Detection System

Sometimes file permissions aren't enough. LIDS gives you kernel-level access control that goes beyond filesystem settings.
MySQL

For MySQL, we need to deny other applications' access to the mysql binary. We also need to restrict access to the mysql/var directory so that it's append=only, and allow read-only access for the mysqld dæmon to the mysql directory:

lidsconf -A -o /usr/local/mysql/var -j APPEND

lidsconf -A -o /usr/local/mysql -j DENY

lidsconf -A -s /usr/local/mysql/libexec/mysqld -o /usr/local/mysql -j READONLY

lidsconf -A -s /usr/local/mysql/libexec/mysqld -o /usr/local/mysql/var -j WRITE

Bind

Bind needs a lot of capabilities to run:

lidsconf -A -s /usr/sbin/named -o CAP_NET_BIND_SERVICE 53 -j GRANT


lidsconf -A -s /usr/sbin/named -o CAP_SETPCAP -j GRANT

lidsconf -A -s /usr/sbin/named -o CAP_SYS_CHROOT -j GRANT

lidsconf -A -s /usr/sbin/named -o CAP_SYS_RESOURCE -j GRANT

lidsconf -A -s /usr/sbin/named -o CAP_SETUID -j GRANT

lidsconf -A -s /usr/sbin/named -o CAP_SETGID -j GRANT

Login

Login is the program that allows a user to log in to a GNU/Linux system:

lidsconf -A -s /bin/login -o /etc/shadow -j READONLY

lidsconf -A -s /bin/login -o CAP_SETUID -j GRANT

lidsconf -A -s /bin/login -o CAP_SETGID -j GRANT

lidsconf -A -s /bin/login -o CAP_CHOWN -j GRANT

lidsconf -A -s /bin/login -o CAP_FSETID -j GRANT

After having specified the previous commands, we need to seal the kernel, so that the system can take full advantage of LIDS. We add this line to rc.local:

lidsadm -I

Restart the machine to apply all the new access controls. With the previously mentioned access controls, you will not be able to run the X server as it uses raw I/O, but most servers don't run an X server anyway. If you really need it, add the following access control (this command assumes that your X server binary is located in /usr/X11R6/bin/startx):

lidsconf -A -s /usr/X11R6/bin/startx

As we can see, LIDS is a powerful addition to the Linux kernel, which can secure your system completely, even from the root user. LIDS is also very easy to use.

Irfan Habib is a software engineering student at the National University of Science and Technology in Pakistan. He has had great interest in Linux and open-source technology since high school—everything from embedded Linux development to Web services. He has been advocating GNU/Linux in Pakistan for the past two years and has written various articles in local magazines and newspapers on the subject.

______________________

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

Access controls for Jboss server.

Anonymous's picture

Hi Irfan,

Your post had been very useful. Thanks first.

I was given the task of binding port 443 to JBoss server.

i have granted the NET_BIND capability on 443 port to Jboss/bin/run.sh subject. But the problem persists with exception as Permission denied :443

Can u pls help wid this.

More Information on LIDS please

Matt's picture

Hello Irfan.

I liked your article on LIDS, but am a bit confused by the phrase:

"It is recommended that the LIDS patch be applied only to the original kernel source, not to the distribution-specific source".

I use Suse Linux 10. Does your statement mean I must somehow 'retrofit' a vanilla kernel into my distribution? This would be something well beyond my capabilities and I presume Novell wouldn't like it much either.

Where can I find LIDS?

Webinar
One Click, Universal Protection: Implementing Centralized Security Policies on Linux Systems

As Linux continues to play an ever increasing role in corporate data centers and institutions, ensuring the integrity and protection of these systems must be a priority. With 60% of the world's websites and an increasing share of organization's mission-critical workloads running on Linux, failing to stop malware and other advanced threats on Linux can increasingly impact an organization's reputation and bottom line.

Learn More

Sponsored by Bit9

Webinar
Linux Backup and Recovery Webinar

Most companies incorporate backup procedures for critical data, which can be restored quickly if a loss occurs. However, fewer companies are prepared for catastrophic system failures, in which they lose all data, the entire operating system, applications, settings, patches and more, reducing their system(s) to “bare metal.” After all, before data can be restored to a system, there must be a system to restore it to.

In this one hour webinar, learn how to enhance your existing backup strategies for better disaster recovery preparedness using Storix System Backup Administrator (SBAdmin), a highly flexible bare-metal recovery solution for UNIX and Linux systems.

Learn More

Sponsored by Storix