Page 9 of 12
3Log Integrity Checking
When the administrator detects or suspects an attack, he/she usually investigates it by examining the
logs. If the logs are contaminated or removed, it is extremely difficult for the administrator to deal with
the attacks. Even worse, the administrator may not even be aware of the attack(s) if the logs are
fabricated. If the attacker manages to obtain root privileges, they can make changes to every file,
including the logs. We assume the strongest adversary, i.e., one that can obtain root privileges and make
changes to anything they want, including the OS, device drivers, file systems, and applications. Our goal
is to prevent the attacker from modifying or removing the logs, even if they obtain root privileges. The
ultimate goal of the HAIMS log integrity checking is to prevent an attacker from modifying existing logs.
Of course, if the intruder obtains root privileges, they can stop logging, or they can start generating
forged logs after the intrusion. However, they cannot make changes to existing logs that have been
generated before the intrusion. If the attacker obtains root privileges by using some sort of hacking tool,
the history of using the tool will be recorded in the logs and the logs would not be modifiable.
Additionally, the location where the attack originated from will also be traced in the log file. Therefore,
the logs would still hold valuable information for the administrator to investigate, even if the attacker
obtains all-encompassing root privileges.
3.1 Setup
To check the integrity of a log file, a copy of the log file should be stored in the HAIMS device by using
the tail command. For example, if we want to check the integrity of the kernel log,
# tail –F /var/logs/kern.log > /dev/haims1 &
This command makes a copy of kern.log to the HAIMS device. It keeps making a copy whenever new
log is appended. Also, this example shows that the kernel log file is stored in the HAIMS device whose
minor number is one. To protect multiple log files, they can be distinguished by the minor number. For
example,
# tail –F /var/logs/mail.error > /dev/haims2 &
# tail –F /var/logs/sql.log > /dev/haims3 &
# tail –F /var/logs/httpd.log > /dev/haims4 &
Please note that minor number zero is reserved for the HAIMS system log.
To make it easier to set up hooking log files, a script lic_setup.pl is provided. To use this script, the
perl interpreter should have been installed and the first line of the lic_setup.pl should be
updated accordingly.
# vi ../etc/lic.conf
1 /var/log/kern.log
2 /var/log/mail.err
3 /var/log/sql.log
4 /var/log/httpd.log
# vi ../bin/lic_setup.pl
