/usr/share/doc/samhain/manual.html/packing-the-executable.html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN""http://www.w3.org/TR/html4/loose.dtd">
<HTML
><HEAD
><TITLE
>Packing the executable</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.79"><LINK
REL="HOME"
TITLE="The Samhain Host Integrity Monitoring System"
HREF="index.html"><LINK
REL="UP"
TITLE="Additional Features &#8212; Stealth"
HREF="stealthmode.html"><LINK
REL="PREVIOUS"
TITLE="Additional Features &#8212; Stealth"
HREF="stealthmode.html"><LINK
REL="NEXT"
TITLE="Deployment to remote hosts"
HREF="deployment.html"><LINK
REL="STYLESHEET"
TYPE="text/css"
HREF="./docbook.css"></HEAD
><BODY
CLASS="SECT1"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/header.html"--><!--#endif --><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>The Samhain Host Integrity Monitoring System</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="stealthmode.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
>Chapter 9. Additional Features &mdash; Stealth</TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="deployment.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="PACKING-THE-EXECUTABLE"
>9.2. Packing the executable</A
></H1
><P
>  For even more stealthyness, it is possible to pack and encrypt the
  <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> executable. The packer 
  is just moderately effective, but portable.
  Note that the encryption key of course must be present in the 
  packed executable,
  thus this is no secure encryption, but rather is intended for 
  obfuscation of the executable. 
  There is a make target for packing the 
  <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> executable:</P
><P
>  <B
CLASS="COMMAND"
>make samhain.pk</B
></P
><P
>  On execution, <B
CLASS="COMMAND"
>samhain.pk</B
> will unpack into a temporary file
  and execute this, passing along all command line arguments. The
  temporary file is created in <TT
CLASS="FILENAME"
>/tmp</TT
>, 
  if the sticky bit is set on this
  directory, and in <TT
CLASS="FILENAME"
>/usr/bin</TT
> otherwise.
  The filename is chosen at random,
  and the file is only opened if it does not exist already (otherwise a new
  random filename will be tried). The file permission is set to 700.</P
><P
>  The directory entry for the unpacked executable will be deleted after
  executing it, but on systems with a 
  <TT
CLASS="FILENAME"
>/proc</TT
> filesystem,
  the deleted entry may show up there. In particular, this is the case 
  for Linux. You should be aware that this may
  raise suspicion. </P
><P
>  On Linux, the <TT
CLASS="FILENAME"
>/proc</TT
> filesystem is 
  used to call the unpacked
  executable without a race condition, by executing 
  <TT
CLASS="FILENAME"
>/proc/self/fd/NN</TT
>,
  where NN is the file descriptor to which the unpacked executable has been
  written. On other systems, the filename of the unpacked executable must be
  used, which creates a race condition (the file may be modified between
  creation and execution). </P
><P
>  The packed executable will not honour the SUID bit.</P
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="stealthmode.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="deployment.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Additional Features &mdash; Stealth</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="stealthmode.html"
ACCESSKEY="U"
>Up</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Deployment to remote hosts</TD
></TR
></TABLE
></DIV
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/footer.html"--><!--#endif --></BODY
></HTML
>
samhain 3.1.0-5ubuntu1 / usr / share / doc / samhain / manual.html / packing-the-executable.html
