1.0 Introduction and Intended Audience

1.1 Project Overview

The HummingBird System developed for Dr. Deborah Frincke is an Intrusion Detection System for large networks. The System collects activity logs from local systems and forwards them to managing systems. In this way a single system administrator could collect misused data about a large network of computers. The project seeks to augment the current system, in order to allow for a peer-to-peer management system, an auto-configuration system, and improve build and control devices from the web page.

The peer management system designed will allow HummingBird Managers to communicate across the web.  Currently, this does not happen.  Managers may only communicate with subordinates within a given network.  The new system will allow managers to communicate with other managers and make decisions based on information gathered from other peers across the network.

The configuration system will be web based and allow a manager to configure its subordinates automatically.

1.2 Product User Characteristics*

The HummingBird User Manual defines its users as:

1. HummingBird Development Team
        member of or contributor to the HummingBird project. Has complete knowledge of HummingBird. Skills list as follows:

2. System Administrators
        Knowledgeable user with experience in networks, programming, system tools, and use all the features of HummingBird, as well as develop new extensions to Hummingbird.
        Skills list as follows: 3. Site Security Officers
      HummingBird End-User only need is administrative data on security status. Skills list as follows:

2 Limitations of Use

This product requires that the user have a level of understanding of their computer system and network at the level of a system administrator. The Hummingbird system requires data to be passed into in from a system of data gathering tools. A limited set of tools will be included with the Hummingbird system. Some computer systems and some administrators will wish to monitor information these tools do not. Monitoring additional data will require writing additional tools that work with the Hummers.*

In addition, the current system only works on UNIX based architecture, although a HummingBird system is currently being developed for the Windows NT operating system at Washington State University.

3 Installation Guide

The installation is best described in the "INSTALL" file, which comes with the HummingBird source code.

3.1  The Contents of the "INSTALL" File

This [section] describes how to install the HummingBird System (hummer).  HummingBird is an Intrusion Detection System for large networks.  The System collects activity logs from local systems and forwards them to managing systems.  In this way a single system administrator could collect misuse data about a large network of computers.
 

3.1.1 INSTALLATION

For most machines and configurations, the following is all you need.

  ./configure
  gmake
  gmake install

You should also edit /etc/rc.local or equivalent to start hummer at boot.

The source is written in GNU C++, Perl, and Java, and requires an ANSI C compiler or GCC, and the JDK 1.0.  A copy of GCC is available on all major FTP sites (e.g., in ftp:/prep.ai.mit.edu/pub/gnu).  A copy of Perl is available at http://language.perl.com/CPAN/src/latest.tar.gz. A copy of JDK 1.0 is available at http://java.sun.com/products/jdk/1.0.2/index.html.

Optional but further requirements for Hummingbird are PostgreSQL SQL database system available at ftp://ftp.postgresql.org/pub/postgresql-6.2.1.tar.gz; CGI.pm Perl library for CGI programs available at http://www.genome.wi.mit.edu/ftp/pub/software/WWW/; GD.pm Perl library for creating GIF images available at http://www.genome.wi.mit.edu/ftp/distribution/software/WWW/GD.html.
 

3.1.2 CONFIGURATION OPTIONS

The package comes with an Autoconf-generated configure script.  The script accepts several options
 All standard options, including:
  --prefix=PREFIX       where to install files (default: subdirs of $HOME/hum)
  --exec_prefix=PREFIX  where to install executables (default: same as prefix)
  --srcdir=DIR          find sources in DIR (default: where configure is)
 Specific options:
  --with-postgres=[KRB_PREFIX] Compile in postgres support. (default)
  --without-postgres    Don't compile in postgres support.
  --with-kerberos5=[KRB_PREFIX] Compile in Kerberos5 support.

You may also want to configure the following variables:
  CC=compiler           specify name of the C compiler (default: gcc or cc)
  CFLAGS=flags          specify flags to C compiler (default: -O -g or just -O)
  LDFLAGS=flags         specify flags to linker (default: none)

Alternate values can be given to configure in the environment, e.g.:
  CC=xcc CFLAGS="-O2" LDFLAGS="-L/lib/zzz" ./configure
(Note that if you have already configured, and later decide to give some values on the command line, you may need to say "make distclean" before reconfiguring.)
 

3.1.3 MAKEFILE

The Makefile is generated from Makefile.in by running configure.  It supports the following targets:
  all:          compile everything
  install:      install in $exec_prefix/bin and $prefix/man/man1.
  clean:        remove object files and executables
  distclean:    remove anything not in the distribution
 

3.1.4 PORTABILITY

This software has been used at least in the following environments.

        FreeBSD 1.x, 2.x; Pentium
        HPUX 7.x, 9.x, 10.0; HPPA
        Linux 1.2.x, 2.0.x Slackware 2.x, 3.x, RedHat 2.1, 3.0; i486, Sparc
        Solaris 2.3, 2.4, 2.5, 2.5.1; Sparc, i386

Please report back any other environments where you have used HummingBird, and send back any patches you had to do so that they can be integrated to the distribution.  The proper address is hummer@cs.uidaho.edu.  Always remember to mention the hummer version number and machine type in your bug reports.
 

3.1.5 STARTING HUMMINGBIRD

The hummer should be started with the "starthum" shell script.  You can optionally run the Java Console Interface first.

  cd $HOME/hum
  Interface &
  starthum

In a few moments the starthum command will return and the HummingBird System should start collectin logs.
 

3.1.6 MODIFYING THE RUNNING HUMMER

To select which data is loged or displayed connect to the host's configuration web server.

  http://localhost:15000/

Follow the Help and HTML forms with your web browser to change the settings.
 

3.1.7 USING HBVT

HummingBird Visualization Tool is a new addition to HummingBird that displays the text logs as graphic images.  HBVT is extenable for any sort of log in the database.  To use the packaged visualizations connect to the HBVT web server.

  http://localhost:15000/

Select the link at the bottom of the page labeled "Hummer Visualizations".

3.1.8 REPORTING PROBLEMS AND OTHER CONTACTS

Please report any bugs, problems, and enhancements to hummer@cs.uidaho.edu.

The WWW home page for hummer is http://www.cs.uidaho.edu/~hummer.
 
 

4 Operational Walk-Through*

4.1 User Interface Concepts

The HummingBird user interface is a web page like the one below.


 
 
 
 

The interface has the usual clicking done everywhere else on the web, along with some text boxes, radio buttons, and normal buttons here and there, as shown in the image to the left.  Also pictured here is a selection box in which the user picks from a list of choices selected from the list.  In this case, once a desired configuration is made, the user clicks on the "configure" button.
 
 
 
 
 
 
 
 
 
 

4.2 Usage Scenarios

4.2.1 Scenerio 1: Configure Manager-Subordinate Relations

By clicking on "Configure Manager/Subordinate Relations" from the main menu shown in section 4.1, the user is allowed to make all configurations for a Hummer running on a network.  This includes selecting a new manager; adding, removing and configuring a subordinate; and adding or removing local or inherited message filtering.  The Manager/Subordinate Configuration interface looks like this:

4.2.2 Scenerio 2: Configure Peer Groups

By clicking on "Configure Peer Groups" from the main menu shown in section 4.1, the user is allowed to make all configurations for a Hummer wishing to be a peer moderator or a Hummer wishing to configure its status, other's status, and to deal with all messaging within a peer group.

4.2.3 Scenerio 3: Configure Levels

By clicking on "Configure Levels" from the main menu shown in section 4.1, the user is allowed to make all configurations for a Hummer wishing to change inherited and local levels of itself and other hummers.  Specifically, these levels deal with integrity, cooperation, and trust.  In addition, this interface allows for the development of "kill" files, where you may specify certain Hummers or messages to ignore.

4.2.4 Scenerio 4: HummingBird Visualization Tool

See http://www.cs.uidaho.edu/~hummer/hbvt for detailed information about this portion of the program.

5 Related Documentation

6 Error Messages

This section will be completely developed towards the end of the semester.  As we test and refine, the final touches of our finished product will reflect error messages meaningful to the user.  Adding any error messages at this point would be mute, considering that they are meant for us the programmers.

7 System Maintenance Considerations (e.g., backups)

This section, too, will be further developed in the future.

8 Appendices of Related Materials and Definitions

*Selected items marked with a "*" were taken directly from the user manual from Team A in Spring of 1997 for CS481 at the University of Idaho, at:  http://www.cs.uidaho.edu/~hummer/hum-A-html/.