1.0 Introduction and Intended Audience
1.1 Project Overview
The HummingBird System developed for Dr. Deborah Frincke is an Intrusion
Detection System for large networks. The System collects activity logs
from local systems and forwards them to managing systems. In this way a
single system administrator could collect misused data about a large network
of computers. The project seeks to augment the current system, in order
to allow for a peer-to-peer management system, an auto-configuration system,
and improve build and control devices from the web page.
The peer management system designed will allow HummingBird Managers
to communicate across the web. Currently, this does not happen.
Managers may only communicate with subordinates within a given network.
The new system will allow managers to communicate with other managers and
make decisions based on information gathered from other peers across the
network.
The configuration system will be web based and allow a manager to configure
its subordinates automatically.
1.2 Product User Characteristics*
The HummingBird User Manual defines its users as:
1. HummingBird Development Team
member of or contributor
to the HummingBird project. Has complete knowledge of HummingBird. Skills
list as follows:
-
Perl
-
HTML
-
Advanced UNIX
-
C++
2. System Administrators
Knowledgeable user with
experience in networks, programming, system tools, and use all the features
of HummingBird, as well as develop new extensions to Hummingbird.
Skills list as follows:
-
HummingBird
-
Intermediate UNIX
-
Web Browser
3. Site Security Officers
HummingBird End-User only need is
administrative data on security status. Skills list as follows:
2 Limitations of Use
This product requires that the user have a level of understanding of their
computer system and network at the level of a system administrator. The
Hummingbird system requires data to be passed into in from a system of
data gathering tools. A limited set of tools will be included with the
Hummingbird system. Some computer systems and some administrators will
wish to monitor information these tools do not. Monitoring additional data
will require writing additional tools that work with the Hummers.*
In addition, the current system only works on UNIX based architecture,
although a HummingBird system is currently being developed for the Windows
NT operating system at Washington State University.
3 Installation Guide
The installation is best described in the "INSTALL" file, which comes with
the HummingBird source code.
3.1 The Contents of the "INSTALL" File
This [section] describes how to install the HummingBird System (hummer).
HummingBird is an Intrusion Detection System for large networks.
The System collects activity logs from local systems and forwards them
to managing systems. In this way a single system administrator could
collect misuse data about a large network of computers.
3.1.1 INSTALLATION
For most machines and configurations, the following is all you need.
./configure
gmake
gmake install
You should also edit /etc/rc.local or equivalent to start hummer at
boot.
The source is written in GNU C++, Perl, and Java, and requires an ANSI
C compiler or GCC, and the JDK 1.0. A copy of GCC is available on
all major FTP sites (e.g., in ftp:/prep.ai.mit.edu/pub/gnu). A copy
of Perl is available at http://language.perl.com/CPAN/src/latest.tar.gz.
A copy of JDK 1.0 is available at http://java.sun.com/products/jdk/1.0.2/index.html.
Optional but further requirements for Hummingbird are PostgreSQL SQL
database system available at ftp://ftp.postgresql.org/pub/postgresql-6.2.1.tar.gz;
CGI.pm Perl library for CGI programs available at http://www.genome.wi.mit.edu/ftp/pub/software/WWW/;
GD.pm Perl library for creating GIF images available at http://www.genome.wi.mit.edu/ftp/distribution/software/WWW/GD.html.
3.1.2 CONFIGURATION OPTIONS
The package comes with an Autoconf-generated configure script.
The script accepts several options
All standard options, including:
--prefix=PREFIX where to
install files (default: subdirs of $HOME/hum)
--exec_prefix=PREFIX where to install executables (default:
same as prefix)
--srcdir=DIR
find sources in DIR (default: where configure is)
Specific options:
--with-postgres=[KRB_PREFIX] Compile in postgres support. (default)
--without-postgres Don't compile in postgres
support.
--with-kerberos5=[KRB_PREFIX] Compile in Kerberos5 support.
You may also want to configure the following variables:
CC=compiler
specify name of the C compiler (default: gcc or cc)
CFLAGS=flags
specify flags to C compiler (default: -O -g or just -O)
LDFLAGS=flags
specify flags to linker (default: none)
Alternate values can be given to configure in the environment, e.g.:
CC=xcc CFLAGS="-O2" LDFLAGS="-L/lib/zzz" ./configure
(Note that if you have already configured, and later decide to give
some values on the command line, you may need to say "make distclean" before
reconfiguring.)
3.1.3 MAKEFILE
The Makefile is generated from Makefile.in by running configure.
It supports the following targets:
all: compile
everything
install: install in $exec_prefix/bin
and $prefix/man/man1.
clean: remove object
files and executables
distclean: remove anything not in the distribution
3.1.4 PORTABILITY
This software has been used at least in the following environments.
FreeBSD 1.x, 2.x; Pentium
HPUX 7.x, 9.x, 10.0; HPPA
Linux 1.2.x, 2.0.x Slackware
2.x, 3.x, RedHat 2.1, 3.0; i486, Sparc
Solaris 2.3, 2.4, 2.5, 2.5.1;
Sparc, i386
Please report back any other environments where you have used HummingBird,
and send back any patches you had to do so that they can be integrated
to the distribution. The proper address is hummer@cs.uidaho.edu.
Always remember to mention the hummer version number and machine type in
your bug reports.
3.1.5 STARTING HUMMINGBIRD
The hummer should be started with the "starthum" shell script.
You can optionally run the Java Console Interface first.
cd $HOME/hum
Interface &
starthum
In a few moments the starthum command will return and the HummingBird
System should start collectin logs.
3.1.6 MODIFYING THE RUNNING HUMMER
To select which data is loged or displayed connect to the host's configuration
web server.
http://localhost:15000/
Follow the Help and HTML forms with your web browser to change the settings.
3.1.7 USING HBVT
HummingBird Visualization Tool is a new addition to HummingBird that
displays the text logs as graphic images. HBVT is extenable for any
sort of log in the database. To use the packaged visualizations connect
to the HBVT web server.
http://localhost:15000/
Select the link at the bottom of the page labeled "Hummer Visualizations".
3.1.8 REPORTING PROBLEMS AND OTHER CONTACTS
Please report any bugs, problems, and enhancements to hummer@cs.uidaho.edu.
The WWW home page for hummer is http://www.cs.uidaho.edu/~hummer.
4 Operational Walk-Through*
-
To start the Hummingbird system, first make sure there is a data directory
for the host you are running on. See above for more detail.
-
Next change to the ./bin directory and type Starthum &
-
This will start the Hummingbird executables and place them in the background.
-
This will open the Java windows used for console alerts.
-
To configure the hummer use a web browser to connect to port 15000 on the
machine you are running the hummer. (ie from netscape connect to http://snake.cs.uidaho.edu:15000
-
if you were running on snake. Replace snake with your machine name if you
are running on another machine.
-
This will bring up the configuration interface. The password to enter is
initially `test'.
-
To set up two hummers with one as a manager and the other as a subordinate
follow these steps:
-
Create two separate directories and copy in the contents of the ./bin directory
into each. This has to be done so the two hummers do not share the same
configuration files.
-
Start two new xterms and log in to the machines you wish to run the hummers
on. On one machine change directory into one of the directories you made.
On the other change directory into the other directory you created.
-
Start the hummers on both machines by following the instructions listed
above.
-
Using netscape connect to the configuration web page of the hummer you
wish to be the manager (instructions above tell you how to do this).
-
Click on the radio button labeled "Add a new Subordinate" and click the
button at the bottom of the page labeled "Configure". This will take you
to a page where you can type in the subordinate.
-
Enter in the hostname of the machine the other hummer is running on and
click the "Configure" button. Return to the main configuration page. The
hostname you entered will appear in the "My Subordinates" pull down. If
it does not, you did something wrong.
-
Make sure the "My Subordinates" pull down is selected on the hostname you
entered as a subordinate, and select the "Configure Selected Subordinate"
radio button. Click the "Configure" button.
-
Notice the URL in the "Location:" window on netscape. It should show that
you are now connected to the subordinate's configuration web page.
-
In a similar fashion as adding a subordinate, you want to configure this
hummer to have the first hummer as its manager. If the first hummer's hostname
appears next to "My Manager:", then you configured the manager correctly.
-
Once this is done, you are ready to create a message filter to pass messages
to the manager. Scrolling down the main configuration page of the subordinate,
click the button that reads "Modify Local Messaging."
-
This will bring up the "Current Expressions Available for Modification"
page. Select the expression "mustang.html" from the pull down and select
the "Modify Selected Expression" radio button. Click the "Configure" button.
-
This will bring up a page showing the message configuration for "mustang.html".
Whenever a message comes into the hummer that matches the regular expression
"mustang.html", it is sent through the filters.
-
If it passes, the actions configured are performed. Make the check box
next to "Alert this Console" NOT be checked. Then add the manager's IP
address to the text box labeled "Forward this Message to:". Now when mustang.html
is hit the message will be forwarded to the manager. Since the manager
is already configured to report this message to the console, you should
see it pop up twice on the manager's alert interface.
-
You can now play with the filters and actions for messages to test the
functionality of the hummer. Also, remember messages and trusts can be
inherited from managers above.
4.1 User Interface Concepts
The HummingBird user interface is a web page like the one below.
The interface has the usual clicking done everywhere else
on the web, along with some text boxes, radio buttons, and normal buttons
here and there, as shown in the image to the left. Also pictured
here is a selection box in which the user picks from a list of choices
selected from the list. In this case, once a desired configuration
is made, the user clicks on the "configure" button.
4.2 Usage Scenarios
4.2.1 Scenerio 1: Configure Manager-Subordinate Relations
By clicking on "Configure Manager/Subordinate Relations"
from the main menu shown in section 4.1, the user is allowed to make all
configurations for a Hummer running on a network. This includes selecting
a new manager; adding, removing and configuring a subordinate; and adding
or removing local or inherited message filtering. The Manager/Subordinate
Configuration interface looks like this:
-
Help
-
By clicking on the "Help" link just below the title, the
user will be taken to a helpful screen describing the functionality and
methodology of this page.
-
My Manager
-
Configure My Manager
-
This option takes you to the main configuration page for
the current manager.
-
Change My Manager
-
This option will allow you to change the current manager.
1.Click on
Change My Manager.
2.You will
go to a screen with a prompt for a new manager.
3.Enter a
new manager (this can be done in IP or name format.)
4.Press the
Change button when done.
5.A confirmation
or error screen will display.
-
Delete My Manager
-
This option will allow you to delete your current manager.
-
My Subordinates
-
Configure Selected Subordinate
-
This option will allow you to configure a subordinate.
1.Choose a
subordinate from the pull-down subordinate list.
2.Click on
this option.
3.Press the
Configure button to go to the Main Configuration page for the specified
subordinate.
-
Remove Selected Subordinate
-
This option will allow you to remove a subordinate.
1.Choose a
subordinate from the pull-down subordinate list.
2.Click on
this option.
3.Press the
Configure button.
4.A confirmation
or error screen will display.
-
Incoming Message Configuration
-
Modify Local Message Filters
-
This option will allow you to modify the current local message
filters.
-
These are the filters that are passed down the immediate
subordinates.
-
For more information on this option, click on Modify Local
Message Filters and read the accompanying help.
-
Modify Inherited Message Filters
-
This option will allow a subordinate to modify inherited
filters.
-
These are the filters that are pushed down from the manager.
-
For more information on this option, click on Modify Inherited
Message Filters and read the accompanying Help.
-
Reread and Push Configuration to Subordinates
-
This option rereads the configuration and pushes it to the
subordinates.
-
Configuration areas that are reread include:
1.Message
filters
2.Cooperation
3.Trust
4.Integrity
5.Kill files
4.2.2 Scenerio 2: Configure Peer Groups
By clicking on "Configure Peer Groups" from the main menu
shown in section 4.1, the user is allowed to make all configurations for
a Hummer wishing to be a peer moderator or a Hummer wishing to configure
its status, other's status, and to deal with all messaging within a peer
group.
-
Help
-
By clicking on the "Help" link just below the title, the
user will be taken to a helpful screen describing the functionality and
methodology of this page.
-
Peer Tasks
-
Peer Interface
-
This option will take you to the peer interface, where you
can create and send action and data messages to other peers in any group
for which you are subscribed.
-
Subscribe to a Peer Group
-
This option allows you to subscribe to a peer group.
In order to subscribe, the peer group moderator must alread have you in
their database (See "Create a Peer Group" below).
-
Unsubscribe from a Peer Group
-
This option allows you to unsubscribe from a peer group in
which you have already subscribed.
-
Moderator Tasks
-
Create a Peer Group
-
This option will take you to an interface where you will
be allowed to create a peer group and add as many "peers" to it as you
would like. Don't forget, you may add as many peers as you like,
but peers must "subscribe" in order for them to actually be interactive
within a peer group.
-
Edit a Peer Group
-
This option allows you to add peers to or remove peers from
any of the peer groups which you moderate.
-
Peer Group Moderation Interface
-
Here, you may set values pertinent to peer moderation.
For example, you may set communication frequencies for all of the groups
which you moderate.
4.2.3 Scenerio 3: Configure Levels
By clicking on "Configure Levels" from the main menu shown
in section 4.1, the user is allowed to make all configurations for a Hummer
wishing to change inherited and local levels of itself and other hummers.
Specifically, these levels deal with integrity, cooperation, and trust.
In addition, this interface allows for the development of "kill" files,
where you may specify certain Hummers or messages to ignore.
-
Help
-
By clicking on the "Help" link just below the title, the
user will be taken to a helpful screen describing the functionality and
methodology of this page.
-
Levels for Other Hummers
-
Modify Local Trusts, Integrities, and Cooperation Levels
-
This allows you to modify all of the trust, integrity, and
cooperation levels of Hummers to which you may pass these levels.
-
Modify Inherited Trusts, Integrities, and Cooperation
Levels
-
This allows you to modify all of the trust, integrity, and
cooperation levels of Hummers to which you have inherited them from.
-
Kill Files for Other Hummers
-
Modify Local Kill File
-
This allows you to ignore certain Hummers (or un-ignore)
to which you may pass to other subordinate Hummers.
-
Modify Inherited Kill File
-
This allows you to ignore certain Hummers (or un-ignore)
to which you the kill files you have inherited.
4.2.4 Scenerio 4: HummingBird Visualization Tool
See http://www.cs.uidaho.edu/~hummer/hbvt for detailed information
about this portion of the program.
5 Related Documentation
-
Further reference for HBVT is given is the initial proposal
letter [Marconi, 1997d].
-
Details of the HummingBird System as of May 1997 are in [Coltrin
et al., 1997].
-
The most recent and complete text on HummingBird is given
in [Frincke et al., 1997].
-
A plan for completing this software project is in [Marconi,
1997a].
-
A Software Requirements Review Presentation was given on
September 24, 1997 slides are available [Marconi, 1997b].
-
A Software Requirements Specification was produced [Marconi,
1997c].
6 Error Messages
This section will be completely developed towards the end
of the semester. As we test and refine, the final touches of our
finished product will reflect error messages meaningful to the user.
Adding any error messages at this point would be mute, considering that
they are meant for us the programmers.
7 System Maintenance Considerations (e.g., backups)
This section, too, will be further developed in the future.
8 Appendices of Related Materials and Definitions
*Selected items marked with a "*" were taken directly from
the user manual from Team A in Spring of 1997 for CS481 at the University
of Idaho, at: http://www.cs.uidaho.edu/~hummer/hum-A-html/.