check-ps FAQ version 0.1

1. What is check ps?
2. How to I make sure I have got the proper version?
3. Where can I get the latest version? What is the URL?
4. How do I fix files.md5 problems?
5. I tun check ps in the background mode and it disappears. Why?
6. Should I continue to use other security tools?
7. I see strange UDP packets with port numbers of anout 10000. Are
they hostile?
8. How do I test check ps?

1. What is check ps?

Check ps is a simple program that runs ps and compares it with its own
list. It currently requires /proc but other scanning methods can be
implemented. The program will run in the background or one-shot mode.
In the old days it was a small, simple program. These days it has
grown rather to better resist and increasingly sophisticated attacks,
generate more useful reports and detection methods; this also makes
its size closer to real web servers. The program is designed to attack
less skillful r00tshell kids, more skillful that mine, and those whose
powers of observation are too slow. [My r00tshell kid tried to install
a r00tkit and goofed it up so that netstat segfaulted repeatably;
strace showed bad things happening and I spent all night and some of
next morning recompiling from known clean sources. Apparently only
netstat was falsified when I discovered the problem (I did use echo *,
find, etc instead of more standard commands).]

A considerable amount of code is devoted to preventing races causing
false alarms. Paranoid checks against hostile races using stat, lstat,
fstat and statfs add quite a lot of code too. At least one of these
tests is raceable but is worth something anyway.

The background mode devotes a large amount of effort to changing the
name information to something innocent, the default being httpd. You
can also supply a fake argument list if your real httpd server takes
one. Crackers can detect and then arbitrarily hack ps if they notice
quickly enough. There are three flavours of reaction; mild, moderate
and lethal. Mild reaction is to log a report via the current methods
(choice of dedicated log files, syslog and email). Moderate reaction
does everything mild reaction does and sends all suspect processes
SIGSTOP, freezing them. Lethal reaction is moderate reaction plus
killing the processes with SIGKILL.

If you are using linux then there is a built-in fd explorer that tells
you about all the fds, command lines, etc that suspect processes and
their relatives have. This includes local and remote IP addresses and
port numbers (in particular this means you know which services the
cracker is using to connect, barring kernel back doors and
lies). Porting linux.c requires good documentation on /proc but
otherwise should not be too hard.

Since the program detects cracker's process itself it can tell you
about them if it knows enough about your system. Tripwire scans will
not tell you which services were compromised and boot crackers off the
system automatically, which check ps might manage. Given a system it
understands, currently only linux, it will report both ends of all
connections (the code includes untested IPX support), what files are
open, etc.


2. How do I make sure I have got the proper version?

Starting with 1.2alpha4 check the separate signature. Starting with
1.2alpha6 the configure script has a list of MD5 sums in the archive
(see question 4).


3. Where can I get the latest version?

The latest version is available by http from checkps.alcom.co.uk or
from sourceforge (visit the checkps project).  Mirroring check-ps (and
word2x) is encouraged. word2x seems to have migrated quite rapidly and
check ps is largely confined to its present home at the moment.

The up to the minute version is available via anonymous CVS from
sourceforge. This version could contain features that need testing or
are plain buggy and there are obviously no signatures. A quick review
of at least diffs is recommended instead of placing blind faith in
this version.


4. How do I fix files.md5 problems?

If you delete files.md5 then the configure script will notice and not
verify any MD5 signatures, which is very useful if make feels the need
to execute the configure script again. make files.md5 will generate a
list of MD5 sums, assuming your MD5 program is compatible with
mine. If not then I do not consider this a bug, as the rule was
written for maintainers rather than all and sundry. In particular if
you download a copy with MD5 problems be suspicious and contact
<dps@io.stargate.co.uk>.


5. I run check ps in the background mode and it disappears. Why?

It is possible that this really happens, but this probably means you
disabled execution of setuid stuff inside /tmp; if you have done this
then you will have to hack prog.c and spoof.c to use a different
location for its temporary copy of itself, which it uses for spoofing
purposes. At least some of the files on linux seem to record the names
of executables, so fixing this to the right thing is worthwhile.

Most people who detect this problem probably acquire another httpd
process, assuming they do not change the defaults. This process is
really check ps, disguised to stop crackers noticing. The biggest
downside is that this makes it hard for administrators to check it is
running as well. Adding flag waving to make this easy is not a good
idea because this will draw the attention of crackers.

News: You can now pass check_ps the --confirm option that will log the
daemon stating, *inlcuding the pid*. Email logging is *strongly*
recommended because otherwise crackers might notice checkps easily
(obviously a bad idea).


6. Should I continue to use other security tools?

Yes, definitely! checkps is NOT a replacement for proper security
measures, including regular tripwire scans, up to date software,
secure logs via a serial line, replacing telnet with ssh, tcp
wrappers, tiger, etc. A few low performance hit alarms are worth
having too because inept crackers might fall over one of them. If
check_ps reveals a cracker's IP address you can take action to protect
yourself, finding out who can boot them off the internet, etc.

FYI: Booting people off the internet without serious evidence is
unlikely to happen. Given serious evidence action is likely (spammers
lose their accounts, websites, etc very quickly :-)


7. I see strange UDP packets with port numbers of about 10000. Are
they hostile?

No. The content is probably "checkps test packet\0\0" (without the
quotes) and they are used to determine whether an IP is remote or
not. They should not manage to propagate across routers, because
rotuing is disbaled when the packets are sent[*], and can safely be
killed off once they hit the network (replying to them is a bad idea).

Using a non remote host for mail transport of the cracked system
reports is bad because it generates logs and opportunities to incept
the mail on the cracked host. (If the attacker has cracked the mail
routing host you still lose, but that requires him/her to crack two
machines instead of just one).

[*] To the extent that MSG_DONTROUTE manages this trick. On linux
things not on directly connected network numbers register as
unreachable, even if there is a default route avialable. You can see
the code in libdetail/thishost.c


8. How do I test check ps?

You can use the test programs. Hard core developers can test a few of
the bits separately (in particular libdetail/thishost.c and
linux/sockl_proc.c both build test versions when compiled with TEST
defined). Most people will want to run check_ps_test, which is the
real version of check_ps with the following differences:
  - The ps program is called ./fake_ps_2 (which omits fgrep -v's out sleep)
  - Resource limits for ps are not set
  - The uid is not changed.

See the checkps-demo for an example of playing with this program. The
build procedure builds special test versions of some
things. Developers will also find that test_log.c is useful for
developing code that calls log().
