art 1 of this article explained IDS and examined the most popular open source IDS solutions. Part 2 demonstrates some common, practical uses for these solutions.
The first example is application-based IDS, which addresses the problems involved with securing Web sites. Web sites commonly run on the Apache Web server and are written in PHP. Suppose you run such a site (or a number of them) and you want to secure it with IDS. Merely installing the IDS without properly configuring it will not adequately boost your site’s security. To complete the basics for protecting your Web site, you need to ensure the following:
- The site should be able to log all incoming GET and POST queries in a separate text file, which would allow you to use an external HIDS, such a Swatch (Simple Watch Daemon).
You can employ mod_security (the Apache module that works as an internal IDS) to block unwanted actions or call external procedures. Once you’ve downloaded mod_security, you can unzip and untar it for a later build from the Unix shell with the following command:
[email protected]:/usr/local/src>fetch -v http://www.modsecurity.org/download/mod_security-1.8.4.tar.gzlooking up www.modsecurity.orgconnecting to www.modsecurity.org:80requesting http://www.modsecurity.org/download/mod_security-1.8.4.tar.gzremote size / mtime: 351172 / 1091101387mod_security-1.8.4.tar.gz 100% of 342 kB 125 [email protected]:/usr/local/src>tar zxf mod_security-1.8.4.tar.gz
The distribution includes a simple INSTALL text file that explains the two ways of installing this module: as either a dynamic shared object (DSO) module or a static one. For this exercise, use DSO, which you should build with Apache’s APache eXtenSion (apxs) tool. The following output illustrates how to build the DSO module:
[email protected]:/usr/local/src/mod_security-1.8.4/apache1>/usr/local/apache/bin/apxs --cia mod_security.cgcc -DHARD_SERVER_LIMIT=512 -DBUFFERED_LOGS -DDYNAMIC_MODULE_LIMIT=256 -funsigned-
char -DMOD_SSL=208119 -DMOD_ACCEL -DMOD_ACCEL_CACHEMGR -DEAPI -DEAPI_MM -
DUSE_EXPAT -I../lib/expat-lite -O6 -fomit-frame-pointer -fpic -DSHARED_MODULE -
I/usr/local/apache/include -c mod_security.cgcc -shared -o mod_security.so mod_security.o[activating module 'security' in /usr/local/apache/conf/httpd.conf]cp mod_security.so /usr/local/apache/libexec/mod_security.sochmod 755 /usr/local/apache/libexec/mod_security.socp /usr/local/apache/conf/httpd.conf /usr/local/apache/conf/httpd.conf.bakcp /usr/local/apache/conf/httpd.conf.new /usr/local/apache/conf/httpd.confrm /usr/local/apache/conf/httpd.conf.new
Remember to restart Apache server.
Once the installation is complete, you must properly set up Apache configuration files to enable mod_security and to reach your security goals. The distribution includes samples of the httpd.conf configuration file for different configurations: httpd.conf.example-minimal, httpd.conf.regression-v1, and httpd.conf.regression-v2. The following is a simple configuration to include into your /usr/local/apache/conf/httpd.conf:
The DynamicOnly option specifies analysis only of requests generated dynamically at runtime. Using this option prevents your Web server from using precious CPU cycles on checking access to static files.
This option scans the POSTs.
This option checks the URL encoding validation according to the RFC 1738 (www.ietf.org/rfc/rfc1738.txt).
This option enforces a certain byte range on requests. (Null byte attacks try to trick C/C++-based software into thinking that a string ends sooner than it actually does.)
Normally, you don’t need this option, but sometimes the more paranoid system administrators use it to hide their real Web server names with others.
These two options enable very verbose audit logging to logs/audit_log.