up vote 1 down vote favorite
share [g+] share [fb]

Looks like pam_tty_audit in Linux (http://www.slashzero.com/2009/11/shell-session-logging/) could have been a great way to help figure out "what happened!" when one gets rooted.

I say "could have been" because the rootkits do clean logs and kill remote logging before they do anything else.

Say I know that some of my OpenVZ containers get rooted and I trust that my OpenVZ hardware root did not. Could I have audited from the OpenVZ hardware node on all the TTYs of the containers?

link|improve this question
72% accept rate
feedback

1 Answer

up vote 1 down vote

Instead of catching audit logs with auditd, you can configure syslog on the OpenVZ VE to send all logs to a remote server (which could be the OpenVZ HN itself, for example). Thus, all audit events would be safe from a VE compromise.

I'm marking this answer as wiki in case somebody wants to provide further details.

link|improve this answer
I agree. Thank you. I now have 2 more points: (1) The HN has direct access to the TTYs; (2) It would be easier to for the adversary to kill remote logging than to avoid TTYs. I edited my question to reflect your input. – Aleksandr Levchuk Aug 3 '11 at 7:11
As a side note, keep in mind it is not necessary to use a TTY for hacking. A vulnerable service could be used to establish a C&C channel for the attacker without a single blip on TTYs. – joechip Aug 3 '11 at 14:51
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.