Ticket #42 (closed improvement: fixed)

Opened 2 years ago

Last modified 1 year ago

Create an initial file checklist for honeyclient integrity checks

Reported by: knwang Assigned to: kindlund
Priority: highest Milestone: 0.9
Component: HoneyClient::Agent::Integrity Version: 0.92
Severity: major Keywords: integrity, checklist
Cc:

Description

Currently, in the honeyclient.xml file, there's no initial checklist for the honeyclient integrity checks to start with. Adding this checklist will help to reduce the false positives with the integrity checks.

Attachments

Change History

11/27/06 15:37:26 changed by kindlund

Created bug branch for starters.

12/17/06 15:55:20 changed by kindlund

  • owner changed from knwang to kindlund.
  • priority changed from high to highest.
  • status changed from new to assigned.
  • severity changed from minor to major.
  • milestone changed from 1.0 to 0.9.

While trying to resolve this issue, we ran into fundamental issues with the current registry parsing code. As a result, we rebuilt the entire registry subsystem, using some of the lessons learned from Xeno's first implementation.

Two new modules were added:

HoneyClient::Agent::Integrity::Registry
HoneyClient::Agent::Integrity::Registry::Parser

The registry parsing code is fast; however, the process of dumping each hive out to disk remains relatively slow (~ 1-6 mins per hive).

I retrofitted Xeno's original patch to include the <file_checklist> parameter within the new implementation of Integrity. Users can specify which directories the Integrity module should explicitly monitor, by editing the etc/file_checklist.txt file.

Currently, in order to add/modify the corresponding registry excludes, the user will need to edit the Registry.pm file, manually. We can include file list support in a future version of the code.

So far, the only downside to using the new parser implementation, is that Parse::Yapp is extremely sensitive to other libraries that make use of the notorious $', $`, and $& variables (as documented in the ParsingRegistry wiki page). This doesn't mean existing libraries need to be abandoned; however, it does mean that some applicable libraries may need to be slightly patched (i.e., XML::XPath).

As it stands, this code is ready for testing inside our VM test environment. I suspect some additional modules will need to be updated/installed, to get this new version to work properly.

12/20/06 13:14:33 changed by kindlund

  • status changed from assigned to closed.
  • resolution set to fixed.

Completed initial testing of codebase; initial stability checks passed. Merged changes back into trunk and have marked a new version for release.

08/29/07 14:04:38 changed by kindlund

  • version changed from none to 0.92.

Add/Change #42 (Create an initial file checklist for honeyclient integrity checks)




Change Properties
Action