Better security auditing with Auditd and the Integrity Measurement Architecture
Gotcha
The Integrity Measurement Architecture adds important details to your audit logs, making it easier to track an intruder's footprints.
Sometimes event logs are not enough, and you need to supply your security systems with something more. For instance, you might want to improve the detection of anomalies or facilitate the hunt for an intruder on your network. Many commercial solutions are available for file integrity monitoring in Linux. However, some budgets don't allow for a large investment. The good news is that Linux systems have a great selection of open source tools for securing systems, and these tools provide a means for maintaining file integrity at low cost. The Integrity Measurement Architecture comes in handy.
Integrity Measurement Architecture (IMA) [1] is a component of the Linux kernel's integrity subsystem (see the "Components of the Integrity Subsystem" box.) IMA is responsible for calculating hashes of files before loading them, and it supports reporting on the hashes. The integrity subsystem also consists of an Extended Verification Module (EVM) that detects tampering with offline security attribute extensions (e.g., SELinux), which are the basis for clearance decisions of the Linux Security Modules (LSM) framework.
Components of the Integrity Subsystem
Components of the Linux integrity subsystem include:
- IMA-measurement – part of the integrity architecture based on the open standards of the Trusted Computing Group, including TPM, Trusted Boot, Trusted Software Stack (TSS), Trusted Network Connect (TNC), and Platform Trust Services (PTS)
- IMA-appraisal – a component that extends the concept of "secure boot," checking file integrity before transferring control or allowing access to a file by the operating system
- IMA-audit – a component that contains hashes of files in the system audit logs that can be used to extend the system security analysis
The IMA measurement subsystem was added in Linux 2.6.30. Appraisal came later, in Linux 3.7.
What Is IMA?
The main purpose of IMA is to detect if files have been accidentally or intentionally changed, evaluate the measurement of a file against a value stored as an extension attribute, and enforce the integrity of local files. These objectives are complemented by Mandatory Access Control (MAC) protections provided by LSM modules such as SELinux and Smack.
To ensure file integrity, IMA can work with the Trusted Platform Module (TPM) chip [2] to protect the collected hashes from tampering.
IMA provides the following functions:
- Collect – measure a file before it is accessed.
- Store – add the measurement to a kernel resident list, and if a hardware TPM is present, extend the IMA PCR.
- Attest – use the TPM (if it is present) to sign the IMA PCR value, allowing a remote validation of the measurement list.
- Appraise – enforce local validation of a measurement against a known value stored in an extended attribute of the file.
- Protect – protect a file's security/extended attributes (including appraisal hash) against offline attack.
- Audit – audit the file hashes.
Enabling IMA
The first step for enabling IMA is to open and replace some lines in the kernel configuration file. Listing 1 shows an example of the changes for kernel version 4.15.0.
Listing 1
Enabling IMA
$ vi /boot/config-4.15.0-126-generic CONFIG_INTEGRITY=y CONFIG_IMA=y CONFIG_IMA_MEASURE_PCR_IDX=10 CONFIG_IMA_LSM_RULES=y CONFIG_INTEGRITY_SIGNATURE=y CONFIG_IMA_APPRAISE=y -- # Since 4.13 IMA_APPRAISE_BOOTPARAM=y --
The next step is to update the bootloader configuration. Add the following line to the /etc/default/grub
file:
GRUB_CMDLINE_LINUX="ima_tcb lsm=integrity ima_appraise=enforce ima_policy=tcb ima_policy=appraise_tcb ima_hash=sha256"
lsm=integrity
enables integration with LSM, and ima_appraise = enforce
causes IMA to evaluate files according to policy.
Update Grub with:
$ sudo update-grub
The integrity log registered by IMA is located in the directory /sys/kernel/security/ima/ascii_runtime_measurements
.
The next task is to create an IMA Policy configuration file in the /etc/ima
directory:
$ vi /etc/ima/policy.conf
Add the following line:
audit func=BPRM_CHECK mask=MAY_EXEC
The rules you define in the policy file apply to auditing all executable files.
To load an IMA policy, enter:
$ cat /etc/ima/policy.conf > /sys/kernel/security/ima/policy
Some policies might be too general for the system. Therefore, in the future, you should adapt according to your needs.
Restart for the changes to take effect.
Auditd
Auditd is a userspace component that receives and logs information from the underlying Linux auditing system. The auditd userspace tool is a good example of an application that uses information from IMA.
The first step is to install the necessary packages. In Ubuntu:
$ sudo apt-get install auditd audispd-plugins
Or in Centos:
$ sudo yum install audit audit-libs
Once the packages are installed, you can start and enable the service with:
$ sudo systemctl start auditd $ sudo systemctl enable auditd
All auditd events are located in:
/var/log/audit/audit.log
Each entry in the log contains a collection of values that will provide a roadmap for auditing the event. For the INTEGRITY_RULE
policy, the log includes an SHA-256 hash to establish the integrity of the file, along with other settings (see Listing 2).
Listing 2
Integrity Rule Event
type=INTEGRITY_RULE msg=audit(1619631954.633.430): file="/root/script.sh" hash="sha256:7fa8f6dae6e81358308eee2a7a77a7d71d40e8f9cadbb3e266ea39371041f8fd" ppid=1897 pid=2007 auid=1000 uid=0 gid=0 euid=0
The auditd syntax is as follows:
-w path-to-file -p permissions (r,w,x,a) -k keyname
where -w
is the path to the file or directory. -p
describes the permission access type that a file system watch will trigger on (r
=read, w=write, x
=execute, and a
=attribute). -k
is the "keyname" switch, which describes what the alert is about, thus making it easier to interpret and filter the logs. The key value can be searched from SIEM or Log Management systems, so that no matter which rule triggered an event, you can find the results.
Auditd lets you create and customize rules. To make your own rules, you should add them to the file /etc/audit/rules.d/audit.rules
or use the auditctl
command.
Buy this article as PDF
(incl. VAT)