Better security auditing with Auditd and the Integrity Measurement Architecture

Gotcha

© Photo by Kit Ishimatsu on Unsplash

© Photo by Kit Ishimatsu on Unsplash

Article from Issue 250/2021
Author(s):

The Integrity Measurement Architecture adds important details to your audit logs, making it easier to track an intruder's footprints.

Sometimes event logs are not enough, and you need to supply your security systems with something more. For instance, you might want to improve the detection of anomalies or facilitate the hunt for an intruder on your network. Many commercial solutions are available for file integrity monitoring in Linux. However, some budgets don't allow for a large investment. The good news is that Linux systems have a great selection of open source tools for securing systems, and these tools provide a means for maintaining file integrity at low cost. The Integrity Measurement Architecture comes in handy.

Integrity Measurement Architecture (IMA) [1] is a component of the Linux kernel's integrity subsystem (see the "Components of the Integrity Subsystem" box.) IMA is responsible for calculating hashes of files before loading them, and it supports reporting on the hashes. The integrity subsystem also consists of an Extended Verification Module (EVM) that detects tampering with offline security attribute extensions (e.g., SELinux), which are the basis for clearance decisions of the Linux Security Modules (LSM) framework.

Components of the Integrity Subsystem

Components of the Linux integrity subsystem include:

  • IMA-measurement – part of the integrity architecture based on the open standards of the Trusted Computing Group, including TPM, Trusted Boot, Trusted Software Stack (TSS), Trusted Network Connect (TNC), and Platform Trust Services (PTS)
  • IMA-appraisal – a component that extends the concept of "secure boot," checking file integrity before transferring control or allowing access to a file by the operating system
  • IMA-audit – a component that contains hashes of files in the system audit logs that can be used to extend the system security analysis

The IMA measurement subsystem was added in Linux 2.6.30. Appraisal came later, in Linux 3.7.

What Is IMA?

The main purpose of IMA is to detect if files have been accidentally or intentionally changed, evaluate the measurement of a file against a value stored as an extension attribute, and enforce the integrity of local files. These objectives are complemented by Mandatory Access Control (MAC) protections provided by LSM modules such as SELinux and Smack.

To ensure file integrity, IMA can work with the Trusted Platform Module (TPM) chip [2] to protect the collected hashes from tampering.

IMA provides the following functions:

  • Collect – measure a file before it is accessed.
  • Store – add the measurement to a kernel resident list, and if a hardware TPM is present, extend the IMA PCR.
  • Attest – use the TPM (if it is present) to sign the IMA PCR value, allowing a remote validation of the measurement list.
  • Appraise – enforce local validation of a measurement against a known value stored in an extended attribute of the file.
  • Protect – protect a file's security/extended attributes (including appraisal hash) against offline attack.
  • Audit – audit the file hashes.

Enabling IMA

The first step for enabling IMA is to open and replace some lines in the kernel configuration file. Listing 1 shows an example of the changes for kernel version 4.15.0.

Listing 1

Enabling IMA

$ vi /boot/config-4.15.0-126-generic
CONFIG_INTEGRITY=y
CONFIG_IMA=y
CONFIG_IMA_MEASURE_PCR_IDX=10
CONFIG_IMA_LSM_RULES=y
CONFIG_INTEGRITY_SIGNATURE=y
CONFIG_IMA_APPRAISE=y
--
# Since 4.13
IMA_APPRAISE_BOOTPARAM=y
--

The next step is to update the bootloader configuration. Add the following line to the /etc/default/grub file:

GRUB_CMDLINE_LINUX="ima_tcb lsm=integrity ima_appraise=enforce ima_policy=tcb ima_policy=appraise_tcb ima_hash=sha256"

lsm=integrity enables integration with LSM, and ima_appraise = enforce causes IMA to evaluate files according to policy.

Update Grub with:

$ sudo update-grub

The integrity log registered by IMA is located in the directory /sys/kernel/security/ima/ascii_runtime_measurements.

The next task is to create an IMA Policy configuration file in the /etc/ima directory:

$ vi /etc/ima/policy.conf

Add the following line:

audit func=BPRM_CHECK mask=MAY_EXEC

The rules you define in the policy file apply to auditing all executable files.

To load an IMA policy, enter:

$ cat /etc/ima/policy.conf > /sys/kernel/security/ima/policy

Some policies might be too general for the system. Therefore, in the future, you should adapt according to your needs.

Restart for the changes to take effect.

Auditd

Auditd is a userspace component that receives and logs information from the underlying Linux auditing system. The auditd userspace tool is a good example of an application that uses information from IMA.

The first step is to install the necessary packages. In Ubuntu:

$ sudo apt-get install auditd audispd-plugins

Or in Centos:

$ sudo yum install audit audit-libs

Once the packages are installed, you can start and enable the service with:

$ sudo systemctl start auditd
$ sudo systemctl enable auditd

All auditd events are located in:

/var/log/audit/audit.log

Each entry in the log contains a collection of values that will provide a roadmap for auditing the event. For the INTEGRITY_RULE policy, the log includes an SHA-256 hash to establish the integrity of the file, along with other settings (see Listing 2).

Listing 2

Integrity Rule Event

type=INTEGRITY_RULE msg=audit(1619631954.633.430): file="/root/script.sh"
hash="sha256:7fa8f6dae6e81358308eee2a7a77a7d71d40e8f9cadbb3e266ea39371041f8fd"
ppid=1897 pid=2007 auid=1000 uid=0 gid=0 euid=0

The auditd syntax is as follows:

-w path-to-file -p permissions (r,w,x,a) -k keyname

where -w is the path to the file or directory. -p describes the permission access type that a file system watch will trigger on (r=read, w=write, x=execute, and a=attribute). -k is the "keyname" switch, which describes what the alert is about, thus making it easier to interpret and filter the logs. The key value can be searched from SIEM or Log Management systems, so that no matter which rule triggered an event, you can find the results.

Auditd lets you create and customize rules. To make your own rules, you should add them to the file /etc/audit/rules.d/audit.rules or use the auditctl command.

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

SINGLE ISSUES
 
SUBSCRIPTIONS
 
TABLET & SMARTPHONE APPS
Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • Security Lessons: auditd

    The auditd tool can provide system logging capabilities to satisfy even the most paranoid users.

  • MITRE ATT&CK Workshop

    The MITRE ATT&CK website keeps information on attackers and intrusion techniques. We'll show you how to use that information to look for evidence of an attack.

  • System Hardening with Lynis

    The Lynis testing tool looks for potential security problems and even suggests possibly remedies.

  • Lynis

    The complexity of modern distributions offers many potential attack vectors for malware. Lynis lets you find these vulnerabilities before an attacker does.

  • Tripwire

    The simple but effective Tripwire HIDS provides its service quietly and discreetly, preventing attackers from infecting computers with trojans, backdoors, or modified files by identifying anomalies unnoticed by the user.

comments powered by Disqus