I stumbled across an interesting security package in the Ubuntu Repositories, Ninja

From the Ninja Home Page

Ninja is a privilege escalation detection and prevention
system for GNU/Linux hosts. While running, it will monitor
process activity on the local host, and keep track of all
processes running as root. If a process is spawned with
UID or GID zero (root), ninja will log necessary informa-
tion about this process, and optionally kill the process
if it was spawned by an unauthorized user.

What this means in “non-geek speak” is that ninja monitors your system for unauthorized root access (ie user privilege escalation) and, if discovered, logs and terminates (kills) the process.

Installation and configuration is fairly straight forward, but I made a few (small) modifications.

Install ninja

sudo apt-get install ninja

Configure ninja

Most important, read the documentation. These are the adjustments I made (for Ubuntu).

1. Move the configuration files into /etc

sudo mkdir /etc/ninja
sudo cp /usr/share/doc/ninja/examples/default.conf /etc/ninja/ninja.conf
sudo cp /usr/share/doc/ninja/examples/simple.wlist /etc/ninja/whitelist
sudo chmod -R o-rwx /etc/ninja

2. Make a log file.

sudo touch /var/log/ninja.log
sudo chmod o-rwx /var/log/ninja.log

3. Add a “magic” group (one allowed root access). Here I called it ninja. Take note of the group id (gid or number).

sudo addgroup ninja
Adding group `ninja’ (GID 1003) …
Done.

Take not of the group id (gid or number), in this example 1003
And add your user (and root) to the “magic” group.

addgroup ninja
usermod -a -G ninja bodhi
usermod -a -G ninja root
usermod -a -G ninja messagebus

4. Using any editor, open /etc/ninja/ninja.conf and make some changes.


group=1003
daemon = yes
interval = 0
logfile = /var/log/ninja.log
whitelist = /etc/ninja/whitelist
external_command = /root/bin/alert

Notes:

1. Change group “0″ to the group you wish to allow root access . In this example I used the group “ninja” which was assigned a gid of 1003.
   • To find the gid, use “grep ninja /etc/groups”
2. interval = 0 – If this option consumes too much CPU, change it to 1.
3. external_command = /root/bin/alert – YOU must write this script if you wish to use it.
   • Examples might include :

     #!/bin/bash
     echo “Ninja attack” | mail -s “Alert” you@secret-service.com
     echo “Ninja attack” > /root/ALERT
     echo “Ninja attack” > /home/bodhi/ALERT

   • Now add this to the end of .bashrc (assuming you have defined the color red in .bashrc)

     #Ninja alert
     if [ -e $HOME/ALERT ]; then
     clear
     echo ”
     echo -e “${RED}NINJA ATTACK”
     echo ”
     fi

5. Edit /etc/ninja/whitelist

Since ubutnu does not use su, remove the su line

on passwd, allow users
add in other normal system processes:

/bin/fusermount:users:
/usr/bin/passwd:users:
/usr/bin/pulseaudio:users:
/usr/sbin/hald:haldaemon:
/usr/lib/hal/hald-runner:haldaemon:

6. Start ninja at boot. I did this with a single line in /etc/rc.local

/usr/sbin/ninja /etc/ninja/ninja.conf

Ninja in action


root@karmic# sudo -u nobody /bin/bash
bash: /root/.bashrc: Permission denied

nobody@karmic$ whoami
nobody

nobody@karmic$ sudo -i
[sudo] password for nobody: Killed
nobody@karmic$ Killed
root@karmic#

Notice how ninja killed not only the sudo attempt, but the bash shell as well.