Veritim Veri iletisimi ve Telelomunikasyon.

That's it, you are done. All you have to do is download the latest version and run the installation script. If you want to learn how the script works or modify it, read below.

The whole alerting process works as follows. First, we define the User Defined Alert (shown in the image above) as our alert.sh script.. The User Defined Alert produces a log entry for every connection that it monitors. The log entry looks as follows:

31Dec1997 15:39:59 drop fw1 >elx0 mail proto tcp src evil.example.org dst firewall service domain-tcp s_port 37401 len 44 rule 6

The Firewall then pipes this log entry into our alert.sh script. The script then parses the data and executes various functions we define. The script alert.sh uses the following files to store and track the logs.

alert.uniq - A single, permanent log is added to this file whenever a system scans you. Regardless of how many ports are scanned, there will only be one entry per unique source. This way you can easily track who scanned you when.

alert.log - This file temporarily stores every port scanned for that day. This is how the alert.sh script tracks how many times/ports have been scanned from a single source. Every time the User Defined Alert executes alert.sh, the first thing the script does is count how many times the source ($src) has scanned us for that day by looking in alert.log. When the script alert.sh is done, it adds an entry to the alert.log file. So, the first time a source scans a port, alert.sh will not find anything logged in the alert.log. The second time the sources scans a port, it will find one, and so on. You set a limit on how many ports are scanned before the alert.sh stops reacting (this protects against DOS attacks). At the end of the day, a cronjob (rotate.sh) will clear this file out and add all the entries to archive.log. This way if the same source scans you again at a later date, alert.sh will log the attempt.

alert.archive - This file permanently archives every port scanned and logged. This is an archivial database that can be used for research. This file stores the actual log entries, so it tends to be difficult to read. I find the file alert.uniq to be much easier to read.

rotate.sh - This is a cronjob you need to run every day. It clears the file alert.log, saving all the logged entries to archive.log. This resets the counter for the alert.sh script. If the same source scans you two days in a row, this allows you to log it.

To get a better understanding of how our alert.sh script works, read below. The script is broken down into 6 parts.

1. First, we need to customize our script, which is done in the beginning of the script. This should be self explanatory.

#################################################################
# BEGIN CUSTOMIZING SCRIPT HERE #
#################################################################

# INSTALL DIRECTORY
# Define the directory that this script is in.
# Do NOT put a slash at the end.
# EXAMPLE: dir=/home/fwadmin/alert
dir=

# FW ADMIN
# Define the name of who gets the email alerts
# EXAMPLE: user=fwadmin@example.com
user=

# EMAIL REMOTE SYSTEM
# Define as "true" if you want to automatically email
# the remote admin when you reach your scan limit.
email=false

# SAM
# Define as "true" if you want to autotmatically block
# the source if you reach your scan limit.
sam=false

# SAM TIMEOUT
# How long do you want the source blocked
# Default is 3600 seconds (1 hour).
timeout=3600

#################################################################
# FINISH CUSTOMIZING SCRIPT HERE #
#################################################################

2. We then define our system variables. Also, we check to see if we have met our scan limit. If we have, bail now to save CPU cycles. This is where the speed optimization happens.

### Script variables
message=/tmp/.message_$$
send=/tmp/.send_$$

### Good code is secure code
umask=177
PATH=/usr/bin:/sbin:/usr/sbin:/usr/local/bin
export PATH

if test -a $message
then
        rm $message
fi

if test -a $send
then
	rm $send
fi

### Set trap in case of abrupt exit
trap "rm $send $message ; exit 5" 1 2 15

### Grab User Defined Alert log, pipe to $message.
cat - | tail -1 > $message

### Determine number of scans.
ip=`awk '{print $10}' $message`
number=`grep -c $ip $dir/alert.log`
scan=`expr $number + 1`

### Check number of scans.  If we have reached our limit, lets bail
### now and save CPU cycles.
if [ $scan -gt $limit ];then
	cat $message >> $dir/alert.log
	rm $message
	exit 10
fi

### Parse log file
date=`awk '{print $1}' $message`
time=`awk '{print $2}' $message`
dst=`awk '{print $12}' $message`

### Determine service (check some variables first)
#Determine if "Valid Address" is in log files for NAT
nat_check=`grep -c "(Valid Address)" $message`

#Determine if protocol is icmp
icmp_check=`grep -c " icmp " $message`

if [ "$nat_check" -eq 0 ];then
	if [ "$icmp_check" -eq 0 ];then
		service=`awk '{print $14}' $message`
	else
		service=`awk '{print $15,$16,$17,$18}' $message`
	fi
else
	if [ "$icmp_check" -eq 0 ];then
		service=`awk '{print $16}' $message`
	else
		service=`awk '{print $17,$18,$19,$20}' $message`
	fi
fi

3. We then define all functions / modules used in the script. The script comes with three predifined modules, you can add more of your own.

4. We then build our alert emails. This is the template used for every email alert that is generated.

You have received this message because someone is potentially
scanning your systems. The information below is the packet
that was denied and logged by the Firewall. This is email alert
number $scan, with a limit of $limit from $src.

        Date:        $date
        Time:        $time
        Source:      $src
        Destination: $dst
        Service:     $service

5. Last, we reach the phases part. This is where we define what the script does (in addition to the alert emails) based on how many time the source has probed us. This is broken down into three parts, or phases. Feel free to change/modify these phases as you see fit. I've tried to make this as modular as possible for just that reason. Regardless, once we are done, we send off the email alert.

/usr/bin/mailx -s "#### SCAN ALERT ####" $user < $send
cat $message >> $dir/alert.log

6. Don't forget, at the end of the day, run the cronjob rotate.sh. The purpose of this cronjob is to take all the logged entries from alert.log and move them to the permanent archive file alert.archive. This also clears out the alert.log file, allowing it to start counting new sessions.

Thats it! I hope this does not sound complicated. Once you get it up and running, you will see how simple it is. I hope this helps you in your intrusion detection. While this is not the ultimate end-all solution, it is a great and easy start to automating your intrusion detection. If you have any recommendations or corrections, I would love to hear from you. Please email me at mailto:lance@spitzner.net?Subject=Your Intrusion Detection article.

Author's bio
Lance Spitzner enjoys learning by blowing up his Unix systems athome. Before this, he was an Officer in the Rapid Deployment Force, where he blew up things of a different nature. You can reach him at lance@spitzner.net .