![\includegraphics[width=0.80\linewidth]{prelude-overview.eps}](img1.png)
|
Alexandre Launay,
Pierre-Jean Turpeau
January 24, 2002
At the moment, the Prelude [14] system is only working on some UNIX-like operating systems. It's okay for the Prelude Manager which centralize the information but it's a limitation if you have other types of computers running on your local network and if you want to enhance the security of it.
According to this problem, the main goal of our project is to centralize as most as possible all types of logs from any computer connected to a LAN. By all types of computers it means that any host, with a modified version of Syslog running on it, should be able to contact the Prelude Manager in order to emit a security warning or to simply archive the logs. Of course, such host could be a NT/2k system or other _UNIX-like_ system not supported by Prelude.
Our solution is mainly focused on the Win NT/2k architecture by modifying an existing tool called NTSyslog [11] available for free under the GPL license. In the standard distribution of NTSyslog (figure 2), the logs are transmitted from a WinNT/2k system to a syslog host using the UDP protocol which is known to not be secure.
What we want is to add some features to NTSyslog so that it will be able to securely transmit datas to a Prelude Manager with a simple pre-filtering system with the ability to remove useless system warnings (less warnings == less bandwidth used). Other features are also illustrated in our architecture proposal (figure 3). One of them is the IDMEF-binary converter. It will convert the filtered logs into the IDMEF specification in a binary form (C structure) instead of a text form like standard XML documents. It will save network bandwith during transmission and ease the decoding process on the Prelude Manager side.
There are other minor changes we can add to NTSyslog to improve its efficiency. First, it could be interesting to save logs in a text file on each WinNT/2k machine. If the connection to the Prelude Manager is broken we still have a trace of what happened on this machine. We can also secure this local log file by using the PEO protocol [9] as used in Modular Syslog [1]. That prevents any hidden modification from an intruder which has gained the ``root'' account (or the ``Administrator'' account) on the attacked host.
If we have enough time we would like to propose some interesting rules for the regexp filter. A sort of mixed-up between good security and less log interference.
Another nice thing would be to test how NTSyslog react with advanced scanners [5] and IDS testers [2], so that we could tune the filtering rules.
The command line part of NTSyslog have been successfully compiled with cygwin [10] (using the MingW-environment package) under Win2k. We will use this kind of environment to implement the new features on the Windows plateform.
In particular, we will try to use libpcre for the regexp filter and OpenSSL for the secure connection between NTSyslog and a Prelude Manager. They are both provided as a package in the CygWin environment.
![\includegraphics[width=0.80\linewidth]{ntsyslog-overview.eps}](img2.png)
![\includegraphics[width=0.80\linewidth]{solution-overview.eps}](img3.png)