Root Crontab Changes
[posted 1999/12/08]
Last summer, we had a couple of security incidents involving root crontab changes (among other things). Since then, we have been watching the crontabs rather closely. For a time, whenever a root crontab appeared to have changed, because PIKT reported a change in its timestamp or size, the PIKT alert would show the latest crontab in its entirety.
Good, except that on some systems, the timestamp was being updated daily, evidently because some automated process was rewriting the crontab regularly. And on those systems, every day we would have to inspect the crontab. In almost every case, there was no change, else the change was small and hard to discern.
If the timestamp changes, what if instead of dumping the entire crontab we diff it against the previous day's version? A revised CrontabChkWarning was the result:
CrontabChkWarning
init
status active
level warning
task "Check for crontab anomalies"
input proc "=ll =crontabs | =behead"
=lldata
keys $name
rule // initialize for current crontab
set #changed = #false()
rule // changed size?
if #defined(%size)
&& #size != %size
set #changed = #true()
output mail "$name has changed size to $text(#size),
was $text(%size)"
endif
rule // changed timestamp?
if #defined(%time)
&& $time ne %time
set #changed = #true()
output mail "$name has changed timestamp to
$mon $date $time, was %mon %date %time"
endif
rule // if changed, and we have a backup of the previous
// crontab, diff the current against the previous,
// else dump the current crontab
if #changed
if -e "=hstdir/crontabs/$name"
do #popen(DIFF, "=diff =hstdir/crontabs/$name
=crontabs/$name", "r")
while #read(DIFF) > 0
output mail $rdlin
endwhile
do #pclose(DIFF)
output mail =newline
else
do #fopen(CRONTAB, "=crontabs/$name", "r")
while #read(CRONTAB) > 0
output mail $rdlin
endwhile
do #fclose(CRONTAB)
output mail =newline
endif
endif
rule // save current crontab in the histories/crontabs directory
if ! -d "=hstdir/crontabs"
exec wait "=mkdir =hstdir/crontabs;
=chmod 750 =hstdir/crontabs"
endif
exec wait "cp -p =crontabs/$name =hstdir/crontabs"
rule // report if oddly-named
if $command("=egrep " . $squote() . "^?$name:" . $squote() .
" /etc/passwd") eq ""
&& $command("=ypmatch $name passwd 2>/dev/null") eq ""
output mail "no such acct: $inlin=newline"
endif
rule // report if non-root owner
if $owner ne "root"
#ifndef generic
# if db
&& $owner ne "ingres"
# endif
#endifdef
output mail "suspicious ownership: $inlin=newline"
do #fopen(CRONTAB, "=crontabs/$name", "r")
while #read(CRONTAB) > 0
output mail " $rdlin"
endwhile
do #fclose(CRONTAB)
output mail =newline
endif
We added three new rules: the first, where we initialize a new variable, #changed; the fourth, where we diff the current and previous crontab; and the fifth, where we save the current crontab in the histories/crontab directory. Note also the modifications to the second and third rules, where we set #changed to #true() if we detect crontab changes.
So, on a typical system, here are the contents of our /pikt/var/histories:
warsaw 508) find /pikt/var/histories -print /pikt/var/histories /pikt/var/histories/EMERGENCY.hst /pikt/var/histories/Debug.hst /pikt/var/histories/Urgent.hst /pikt/var/histories/Critical.hst /pikt/var/histories/Warning.hst /pikt/var/histories/Info.hst /pikt/var/histories/Notice.hst /pikt/var/histories/crontabs /pikt/var/histories/crontabs/adm /pikt/var/histories/crontabs/lp /pikt/var/histories/crontabs/root /pikt/var/histories/crontabs/sys /pikt/var/histories/crontabs/uucp
So, you see that your var/histories directory is a natural place to store earlier versions of files, not just .hst files, that you want to compare with their current versions.
Now we still get alerts when crontabs change their timestamp or size, but we
just see their diffs, if any.
For more examples, see Developer's Notes.
