I've been asked by some people where I get the "keyword" files for
inclusion in the logcheck package. First, this package was made to be
simple and run on many OS's with little modifications, so the keyword
files are simple and may or may not cause false alarms with the standard
installation. With that said, the included keyword files are based on a
number of sources:

1) Review of daemon, wrapper, and Firewall Toolkit (FWTK) source code.
2) Submissions by testers and users.
3) Guessing.

The first one of course is obvious, I review source code to find key
components that indicate security problems and I record what they show via
syslog (I also put in a tag of "securityalert:" to make these more clear,
this is a FWTK convention that I think is really nice to have).

The second one is a great help for systems I don't have access to. Many of
the system specific files were contributed to by end users and testers.

The third of course is pretty un-scientific, but is based on a few rules:

1) The security event indicates a "negative" or "failed" that will
*probably* be displayed by a system daemon if it is written in English.

2) The security event is typically generated when an automated probe is
made of the host system. I use a variety of freely available tools and
scripts to generate these (strobe, netcat, etc), as well as some custom
tools I've developed for personal use. Don't let the media image
fool you, most hackers you'll run across are not very crafty and make a
lot of noise rattling your system's door knob...then again they can be
as noisy as they want really because there is a %99.99 chance the
sysadmins won't know anyway.

3) Finally, I use events that were seen from past hacking attempts at a
variety of sites by myself (legitimately :) ), or on actual cases where
I've cleaned out intruders from systems. Since I do system penetration
audits for a living, you'll just have to take my word that what I'm
looking for is legitimate.

Of course this is all speculation. I recommend that any system on the
Internet have all code reviewed for any system daemons listening on an
Internet available socket. The logging of errors should have a common word
associated with the failure (ala FWTK's "securityalert:" messages) so that
it can be grep'ed for quickly and reliably. If you are an author of a
network daemon, please consider dropping in a similar notation for
security-relevant events.


A final note...(really and then I'll shutup)..


As it stands now, the majority of the keywords focus on daemon alerts
and bizarre errors that are generated from an *external* system attack.
This is an important distinction! It is vital to catch an intruder
*before* system access is gained. Once a system has been penetrated the
game is pretty much over. You should always assume an intruder has
root access if they gain entry to a host. I don't bother checking for
common exploit syslog messages because they simply don't exist, or
there are too many to find reliably. Therefore, the key to system
security is to not let intruders onto your host to begin with (as if
you needed me to tell you that).

In the case of an actual system intrusion, perhaps logcheck will
have given you enough of a warning to contain the problem quickly.
Since I always assume that any Internet connected host will
eventually be compromised, this is (to me) almost as good as not
letting the hacker on in the first place.

Have fun,

-- Craig