インターネット上にサーバーを公開すると、ローカル環境で使用していた時とは違い、たくさんの人がサーバーにアクセスできるようになります。大切なサーバーを守るためにセキュリティ対策は必ず実施するようにしましょう!!
色んな方のサイトの情報を基に調べたことをまとめておきます。ただし、ここにまとめた設定をすれば絶対にセキュリティを突破されない事を保障するものではありません。あくまで、自己責任でお願いします。
- 特権ユーザーに関する設定
- sshに関する設定
- サービスに関する設定
- ポートに関する設定
- ファイル改竄の検知
- アンチウィルス
- rootkit検出
今回は、5.ファイル改竄の検知についてです。
5.ファイル改竄の検知
5.1.ファイル改竄検知システムインストール
ファイルが変更されたことを検知してくれるシステムをファイル改竄検知システム(Tripwire)といいます。検知されたファイルの変更が意図しないものである場合には、悪意あるユーザーにログインされファイルを書き換えられたとか、ウィルスに感染したとかということを知るためにインストールすることをお勧めします。
Tripwireのインストール
yum -y install tripwire
5.2.Tripwireの初期設定
tripwire-setup-keyfiles
---------------------------------------------- The Tripwire site and local passphrases are used to sign a variety offiles, such as the configuration, policy, and database files. Passphrases should be at least 8 characters in length and contain both letters and numbers. See the Tripwire manual for more information. ---------------------------------------------- Creating key files... (When selecting a passphrase, keep in mind that good passphrase typically have upper and lower case letters, digits and punctuation marks, and are at least 8 characters in length.) Enter the site keyfile passphrase:サイトパスフレーズ設定 Verify the site keyfile passphrase:サイトパスフレーズ再入力 Generating key (this may take several minutes)...Key generation complete. (When selecting a passphrase, keep in mind that good passphrase typically have upper and lower case letters, digits and punctuation marks, and are at least 8 characters in length.) Enter the local keyfile passphrase:ローカルパスフレーズ設定 Verify the local keyfile passphrase:ローカルパスフレーズ再入力 Generating key (this may take several minutes)...Key generation complete. ---------------------------------------------- Signing configuration file... Please enter your site passphrase:サイトパスフレーズ入力 Wrote configuration file: /etc/tripwire/tw.cfg A clear-text version of the Tripwire configuration file: /etc/tripwire/twcfg.txt has been preserved for your inspection. It is recommended that you move this file to a secure location and/or encrypt it in place (using a tool such as GPG, for example) after you have examined it. ---------------------------------------------- Signing policy file... Please enter your site passphrase: ← サイトパスフレーズを入力 Wrote policy file: /etc/tripwire/tw.pol A clear-text version of the Tripwire policy file: /etc/tripwire/twpol.txt has been preserved for your inspection. This implements a minimal policy, intended only to test essential Tripwire functionality. You should edit the policy file to describe your system, and then use twadmin to generate a new signed copy of the Tripwire policy. Once you have a satisfactory Tripwire policy file, you should move the clear-text version to a secure location and/or encrypt it in place(using a tool such as GPG, for example). Now run "tripwire --init" to enter Database Initialization Mode. This reads the policy file, generates a database based on its contents, and then cryptographically signs the resulting database. Options can be entered on the command line to specify which policy, configuration, and key files are used to create the database. The filename for the database can be specified as well. If no options are specified, the default values from the current configuration file are used.
5.3.Tripwireの設定
vi /etc/tripwire/twcfg.txt
ROOT =/usr/sbin POLFILE =/etc/tripwire/tw.pol DBFILE =/var/lib/tripwire/$(HOSTNAME).twd REPORTFILE =/var/lib/tripwire/report/$(HOSTNAME)-$(DATE).twr SITEKEYFILE =/etc/tripwire/site.key LOCALKEYFILE =/etc/tripwire/$(HOSTNAME)-local.key EDITOR =/bin/vi LATEPROMPTING =false LOOSEDIRECTORYCHECKING =false→ true:ファイル変更時にディレクトリの変更を通知しない MAILNOVIOLATIONS =true EMAILREPORTLEVEL =3→ 4:レポートレベル変更 REPORTLEVEL =3→ 4:レポートレベル変更
5.4.暗号署名設定ファイル作成
twadmin -m F -c /etc/tripwire/tw.cfg -S /etc/tripwire/site.key /etc/tripwire/twcfg.txt
Please enter your site passphrase:サイトパスフレーズ入力 Wrote configuration file: /etc/tripwire/tw.cfg
5.5.セキュリティを確保するため設定ファイルを削除
rm -f /etc/tripwire/twcfg.txt
設定ファイルを復活させる場合のコマンド
twadmin –print-cfgfile > /etc/tripwire/twcfg.txt
5.6.ポリシーファイル設定
ポリシーファイルを最適化するスクリプトを作成します。
vi /etc/tripwire/twpolmake.pl
#!/usr/bin/perl # Tripwire Policy File customize tool # ---------------------------------------------------------------------- # Copyright (C) 2003 Hiroaki Izumi # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; either version 2 # of the License, or (at your option) any later version. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. # ---------------------------------------------------------------------- # Usage: # perl twpolmake.pl {Pol file} # ---------------------------------------------------------------------- # $POLFILE=$ARGV[0]; open(POL,"$POLFILE") or die "open error: $POLFILE" ; my($myhost,$thost) ; my($sharp,$tpath,$cond) ; my($INRULE) = 0 ; while (<POL>) { chomp; if (($thost) = /^HOSTNAME\s*=\s*(.*)\s*;/) { $myhost = `hostname` ; chomp($myhost) ; if ($thost ne $myhost) { $_="HOSTNAME=\"$myhost\";" ; } } elsif ( /^{/ ) { $INRULE=1 ; } elsif ( /^}/ ) { $INRULE=0 ; } elsif ($INRULE == 1 and ($sharp,$tpath,$cond) = /^(\s*\#?\s*)(\/\S+)\b(\s+->\s+.+)$/) { $ret = ($sharp =~ s/\#//g) ; if ($tpath eq '/sbin/e2fsadm' ) { $cond =~ s/;\s+(tune2fs.*)$/; \#$1/ ; } if (! -s $tpath) { $_ = "$sharp#$tpath$cond" if ($ret == 0) ; } else { $_ = "$sharp$tpath$cond" ; } } print "$_\n" ; } close(POL) ;
5.7.ポリシーファイル最適化
perl /etc/tripwire/twpolmake.pl /etc/tripwire/twpol.txt > /etc/tripwire/twpol.txt.new
5.8.暗号署名ポリシーファイル作成
twadmin -m P -c /etc/tripwire/tw.cfg -p /etc/tripwire/tw.pol -S /etc/tripwire/site.key /etc/tripwire/twpol.txt.new
Please enter your site passphrase:サイトパスフレーズ入力 Wrote policy file: /etc/tripwire/tw.pol
5.9.ポリシーファイル削除
rm -f /etc/tripwire/twpol.txt*
ポリシーファイルを復活させるコマンド
twadmin -m p -c /etc/tripwire/tw.cfg -p /etc/tripwire/tw.pol -S /etc/tripwire/site.key > /etc/tripwire/twpol.txt
5.10.Tripwireデータベース作成
ポリシーファイルからデータベースを作成する。
tripwire -m i -s -c /etc/tripwire/tw.cfg
Please enter your local passphrase:ローカルパスフレーズ入力
5.11.Tripwire確認
tripwire -m c -s -c /etc/tripwire/tw.cfg
Open Source Tripwire(R) 2.4.2.2 Integrity Check Report Report generated by: root Report created on: 2016年02月06日 23時08分26秒 Database last updated on: Never =============================================================================== Report Summary: =============================================================================== Host name: server.secstudy.com Host IP address: XXX.XXX.XXX.XXX Host ID: None Policy file used: /etc/tripwire/tw.pol Configuration file used: /etc/tripwire/tw.cfg Database file used: /var/lib/tripwire/server.secstudy.com.twd Command line used: tripwire -m c -s -c /etc/tripwire/tw.cfg =============================================================================== Rule Summary: =============================================================================== ------------------------------------------------------------------------------- Section: Unix File System ------------------------------------------------------------------------------- Rule Name Severity Level Added Removed Modified --------- -------------- ----- ------- -------- User binaries 66 0 0 0 Tripwire Binaries 100 0 0 0 Libraries 66 0 0 0 Operating System Utilities 100 0 0 0 File System and Disk Administraton Programs 100 0 0 0 Kernel Administration Programs 100 0 0 0 Networking Programs 100 0 0 0 System Administration Programs 100 0 0 0 Hardware and Device Control Programs 100 0 0 0 System Information Programs 100 0 0 0 Application Information Programs 100 0 0 0 (/sbin/rtmon) Critical Utility Sym-Links 100 0 0 0 Shell Binaries 100 0 0 0 Critical system boot files 100 0 0 0 * Tripwire Data Files 100 1 0 0 System boot changes 100 0 0 0 OS executables and libraries 100 0 0 0 Critical configuration files 100 0 0 0 Security Control 100 0 0 0 Login Scripts 100 0 0 0 Root config files 100 0 0 0 Invariant Directories 66 0 0 0 Temporary directories 33 0 0 0 Critical devices 100 0 0 0 (/proc/kcore) Total objects scanned: 52987 Total violations found: 1 =============================================================================== Object Summary: =============================================================================== ------------------------------------------------------------------------------- # Section: Unix File System ------------------------------------------------------------------------------- ------------------------------------------------------------------------------- Rule Name: Tripwire Data Files (/var/lib/tripwire) Severity Level: 100 ------------------------------------------------------------------------------- Added: "/var/lib/tripwire/server.secstudy.com.twd": 今回追加したTripwireのデータベースなので問題無し =============================================================================== Error Report: =============================================================================== No Errors ------------------------------------------------------------------------------- *** End of report *** Open Source Tripwire 2.4 Portions copyright 2000 Tripwire, Inc. Tripwire is a registered trademark of Tripwire, Inc. This software comes with ABSOLUTELY NO WARRANTY; for details use --version. This is free software which may be redistributed or modified only under certain conditions; see COPYING for details. All rights reserved.
5.12.Tripwire定期自動実行ファイル設定
インストール時に作成されていたTripwire定期実行ファイルを編集する。
vi /etc/cron.daily/tripwire-check
#!/bin/sh # デフォルト部分をコメントアウト #HOST_NAME=`uname -n` #if [ ! -e /var/lib/tripwire/${HOST_NAME}.twd ] ; then # echo "**** Error: Tripwire database for ${HOST_NAME} not found. ****" # echo "**** Run "/etc/tripwire/twinstall.sh" and/or "tripwire --init". ****" #else # test -f /etc/tripwire/tw.cfg && /usr/sbin/tripwire --check #fi # パスフレーズ設定 LOCALPASS=xxxxxxxx # ローカルパスフレーズ SITEPASS=xxxxxxxx # サイトパスフレーズ cd /etc/tripwire # Tripwireチェック実行 tripwire -m c -s -c tw.cfg|mail -s "Tripwire(R) Integrity Check Report in `hostname`" root # ポリシーファイル最新化 twadmin -m p -c tw.cfg -p tw.pol -S site.key > twpol.txt perl twpolmake.pl twpol.txt > twpol.txt.new twadmin -m P -c tw.cfg -p tw.pol -S site.key -Q $SITEPASS twpol.txt.new > /dev/null rm -f twpol.txt* *.bak # データベース更新 rm -f /usr/local/tripwire/lib/tripwire/*.twd* tripwire -m i -s -c tw.cfg -P $LOCALPASS
Tripwire定期実行ファイルのパーミッションを変更する。
chmod 700 /etc/cron.daily/tripwire-check
コメント