SOC2010SergioLigregni [FreeBSD WIKI]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Distributed Audit / Log Shipping Daemon ======

The shipping daemon will deliver the audit trails generated through the network to a master system, that will admin the trails to have the auditing centralized, ease to admin and practical. The admin will have all the trails in one system and can do the security auditing in one system (perhaps a special system to keep the auditing). Some mechanisms as SHA256 checksum and cryptographic features will be implemented to guarantee the integrity of the delivery system.

Working [[SergioLigregni|Sergio Ligregni]] with the mentoring of [[StaceySon|Stacey Son]]

====== Small timeline ======

*May 24th - Jun 6th
<del>Code the shippd daemon</del> <del>and modify auditd to call it when a trail is finalized.</del>
*Jun 7th - Jun 27th
<del>Code the features of shipd daemon that will communicate with the master system, also, code the master daemon that will receive the files. In this phase, SHA256 checksum will be implemented (as well as file listings comparison).</del>
*Jun 28th, Jul 4th
<del>Do the master work, this is, receive the files and perform the appropiate pathing, and the right naming (to prevent duplicates when errors occurs).</del>
*Jul 5th, Jul 16th
<del>Perform the mid-term prep testing.</del>
*Jul 17th, Jul 31st
<del>Implement SSL in the network communication</del>
*Aug 1st, Aug 8th
<del>Perform the final testing.</del>
*Aug 9th, Aug 16th
<del>Document the tool.</del>

===== Status =====

The project is already finished, it includes now:

The shipd daemon is working and has been tested in a small network, this daemon:
  * perform sync based on any of the three "panic levels"
    * when panic level is 2, the daemon only synchronize the latest trails
    * when panic level is 3, the daemon checks for all trails
  * connects with damasterd daemon, ask if there is a trail in master's and send those missing

The damasterd daemon is working and has been tested in a small network, this daemon:
  * checks if the trails are in master's
  * according to the parameters, it either search/creates trails under slave's root directory or create a directory per each host
  * if the SHA256 checksum for a trail isn't equal, the daemon assumes there is no such trail and then the shipd daemon will send it again
  * the naming convention of the trails, in an example:
    * 20100712024237.20100712024244.ligPhenom.20100712025309
    * trail_init    .trail_end     .host     .date/time received

* **SSL encryption**

TO_DO:
  * <del>integrate with current audit (using audit_warn or modifying auditd)</del>
  * <del>implement SSL in network communication</del>
  * <del>define the location of the parameters (maybe audit_control or maybe another config file)</del> and arrange the naming and comments
  * <del>the doc (the file ideas.txt already has a lot of doc about the parameters)</del>

[[http://p4db.freebsd.org/depotTreeBrowser.cgi?FSPC=//depot/projects/soc2010/disaudit&HIDEDEL=NO|Project's Perforce Repository (CODE)]]