2 - Raspberry PI Community Projects

The chkrootkit and rkhunter packages allow looking for rootkits potentially installed
on the system. As a reminder, these are pieces of soware designed
to hide the compromise of a system while discreetly keeping control of the
machine. The tests are not 100% reliable, but they can usually draw the administrator's
aention to potential problems.
14.3.4. Detecting Intrusion (IDS/NIDS)
BACK TO BASICS
Denial of service
A “denial of service” aack has only one goal: to make a service unavailable.
Whether such an aack involves overloading the server with queries or exploiting
a bug, the end result is the same: the service is no longer operational.
Regular users are unhappy, and the entity hosting the targeted network service
suffers a loss in reputation (and possibly in revenue, for instance if the
service was an e-commerce site).
Such an aack is sometimes “distributed”; this usually involves overloading
the server with large numbers of queries coming from many different sources
so that the server becomes unable to answer the legitimate queries. These
types of aacks have gained well-known acronyms: DoS and DDoS (depending
on whether the denial of service aack is distributed or not).
snort (in the Debian package of the same name) is a NIDS — a Network Intrusion Detection System.
Its function is to listen to the network and try to detect infiltration attempts and/or hostile acts
(including denial of service attacks). All these events are logged, and a daily email is sent to the
administrator with a summary of the past 24 hours.
Its configuration requires describing the range of addresses that the local network covers. In
practice, this means the set of all potential attack targets. Other important parameters can be
configured with dpkg-reconfigure snort, including the network interface to monitor. This
will often be eth0 for an Ethernet connection, but other possibilities exist such as ppp0 for an
ADSL or PSTN (Public Switched Telephone Network, or good old dialup modem), or even wlan0 for
some wireless network cards.
G F
Integration with prelude
Prelude brings centralized monitoring of security information. Its modular
architecture includes a server (the manager in prelude-manager) which gathers
alerts generated by sensors of various types.
Snort can be configured as such a sensor. Other possibilities include preludelml
(Log Monitor Lackey) which monitors log files (in a manner similar to logch
eck, described in Section 14.3.1, “Monitoring Logs with logcheck” (page 382)).
The snort configuration file (/etc/snort/snort.conf) is very long, and the abundant comments
describe each directive with much detail. Getting the most out of it requires reading it in
full and adapting it to the local situation. For instance, indicating which machine hosts which
service can limit the number of incidents snort will report, since a denial of service attack on
Chapter 14 — Security
387