6

I have a file integrity monitoring suite and in it I have to select specific files and folders for it to monitor. There are some obvious services that I want monitored like our web-server.

Is there a list of important OS files (windows/linux) that must be monitored (by best practice)? I am familiar with Linux but not with windows so I can't seem to find what binaries and/or config files to monitor as a best practice.

|improve this question
  • You need to monitor all the files including /proc. – Andrew Smith Jul 17 '12 at 8:07
  • 1
    have a look at what tools like chkrootkit, tiger, rkhunter do -- basically you should check almost everything that is not intended to change – mdo Jul 17 '12 at 10:07
4

You should monitor (nearly) all the files.

Assuming that this system is just a hash database, then there are some files you should skip:

  • everything in /proc (there's a lot of useful stuff in here for root kit hunters though)
  • log files (there are tools will will do heuristic analysis of these files)
  • files which contain filesystems (this would include loop-back filesystems and database files - but you probably want to check the 'files' inside the file).
  • swap space

(the difficult bit is setting up a process for auditing the changes properly)

|improve this answer
  • Thanks, do you know of similar places for Windows systems as well? or do we just monitor everything in C:\windows ? – george_h Jul 17 '12 at 9:18
  • @george_h - Just monitor any system folder, but also user data, if your only interested in Windows suggestions remove the reference to Linux. – Ramhound Jul 17 '12 at 11:39
  • Interested in both, I got good linux examples, was waiting to see for some windows ones. – george_h Jul 17 '12 at 11:50
  • Off the top of my head, the problem with Windows would be that the registry is stored in a database - so you need to maintain hive extracts in order to isolate specific changes. Other than that and swap I don't think there's complications wrt files as handles to data structures (BTW, forgot to mention - do be careful you don't try to get checksum for device files in Linux!) – symcbean Jul 17 '12 at 16:02
2

Not sure what file integrity monitoring system you're using, but most commercial file integrity monitoring systems such as Verisys and Tripwire can be configured to 'automatically' monitor the relevant files.

For example, you tell them you're running Windows Server 2008 and Microsoft SQL Server 2008, and then they monitor applicable files and registry entries.

|improve this answer
1

For windows platform, microsoft provides the sfc utility. It will check the integrity of all or selected system files and repair them if needed. You can check its options by typing in command prompt: sfc /?

|improve this answer
0

There is an open source file integrity monitor called Mugsy that ships with a list of important directories to monitor for Linux:

- /boot
- /lib
- /lib64
- /sys
- /bin
- /sbin
- /usr/bin
- /usr/sbin
- /usr/local/bin
- /usr/local/etc
- /usr/local/sbin
- /etc

I'm the developer of Mugsy, so shameless plug.

I agree that all files should be monitored, but it can be difficult to manage, so you should at least start your monitoring somewhere. I'm hoping we can collaborate on a standard list of what to monitor for Linux and Windows or a list of what to exclude, e.g. temp files that change often.

Also, Mugsy is Linux-specific, but could be built for Windows.

|improve this answer
-3

Speaking as a vendor, we get asked this all the time - of course you want to track as much of the filesystem as you can to get the best visibility of changes, but the more you track, the more 'change noise' you are likely to get. We work with the Center for Internet Security and you can use any of their Benchmark secure configuration guides to establish how best to configure your linux or windows host for maximum protection. All of these files/registry settings should all be tracked for changes.

Then there are program and system files. This gets more dififcult because there are plenty of files that will change regularly during normal operation, for example, log files. So you really need to get a good understanding of how your applications behave in terms of filesystem activity.

The Linux file list above is a good place to start and there is a longer list of paths/files on our website, although bear in mind that command-output monitoring becomes more important on platforms such as Ubuntu (password policy, for example).

|improve this answer
  • Welcome to Information Security Stack Exchange! Despite the length of the answer, it is essentially a link-only answer to a guide on your own site. Please note that overt self-promotion is not allowed here, and that answers should not rely on links. – S.L. Barth - Reinstate Monica Jan 6 '17 at 14:22
  • 3
    NNT Support - as mentioned by various members of the community, self promotion is not welcome here, and in fact your actions have led to an automated answer block. You could improve your posts by editing out self promotion and providing content in the answer itself - this could help you return to normal status. – Rory Alsop♦ Jan 6 '17 at 15:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.