XenKIMONO

XenKIMONO is a kernel rootkit detector which has been design to run on top of xen virtual machine by taking the benefits of xen.

The existing solutions to identify kernel level rootkits will not work if the observing kernel is compromised, because the detection system is also run on the same kernel.XenKIMONO is try to address this issue by isolating the detection system from observing kernel.

XenKIMONO uses the features of Dom0 in xen virtual machine to isolate detection system from observing kernel.Dom0 is a privileged domain run with other DomUs on top of xen virtual machine which has the access to the DomUs.

So XenKIMONO tries to overcome the issue of compromised kernel by locating the XenKIMONO on Dom0.

XenKIMONO uses several techniques to identify rootkits,

Intergrity checking

Cross-view detection

Monitor critical processes

Detect suspicious activities

White-list based detection

innotek VirtualBox

innotek VirtualBox is a software which enables the virtualization. I have some experience using this. It is very simple to install and configure on linux. I have done this on ubuntu 7.04. I install WindowsXP on the virtual machine I created on virtual box.
Configuration of the virtual machine is,

256 Memory

5 GB Hard disk

It runs smoothly on these configurations.
This is a screenshot of my machine.It has both ubuntu and windows menu bars.


Download innotek VirtualBox and enjoy with virtualization.

Virtualization

In computing virtualization means lot.Simply it is the method of showing single physical resource(processor,storage devices) as multiple resources or vice versa.Nowadays virtual machines are getting very famous, because lot of computing problems can be solve using virtual machines.One well known virtual machine is Xen which is open source one.
The platforms that allows multiple operating systems to run on one machine is called Virtual Machine Monitor(VMM) or Hypervisor.

There are two types of hypervisors.

Type 1 hypervisor - Software that runs directly on hardware.So the guest OS run as 2nd level above hardware. E:g - Xen,Vmware's ESX server

Type 2 hypervisor - Software that runs within host's OS.So the guest OS runs as 3rd level of hardware. E:g - swsoft,VMware server

There are number of advantages of virtualization. It is very good method to resource sharing.There are lot of applications built with the help of virtualization.One such example is intruder detection systems(IDS).

Attificial Immune Systems

Human immune system is the system which is responsible for protect the body from harmful foreign attacks. These attacks come as viruses, bacteria, fungi and other parasites.
The system is,
• Distributed
• No central place to monitor
• Adaptive
• Very complex

The system identifies harmful foreign attacks by using its detectors as well as it is capable of storing details of those intruders for future use.

The main functionalities of human immune system are,

• Randomly generate detectors.
• Maturate those detectors.
• Distribute the identified detectors across the body.
• Identify anomalies.
• Discriminate them with body cells.
• Take relevant actions on anomaly cells.
• Maintain memory about selected anomalies.


Artificial Immune Systems is the system which is aim to solve some computational problems using the techniques use by human immune systems to detect anomalies.
These techniques are use to solve following computational problems.
• Computer virus attacks
• Network intruder detection systems
• Mining data patterns
• Data clustering

Apply SSL between SQL sever & Application

Most of systems are not consider about security between database server and application.But it is a critical factor since most of the attacks are coming from inside the organization.
So in this article I try to explain how to enable SSL channel between SQL server and your application.

Main Steps:

Install IIS server.

Install certificate server.

Install SQL server.

Prepare Certificate for apply SSL on SQL server.

Prepare SSL channel.

NOTE - First 4 steps should be done in same machine that you are going to install SQL server.
In this document I will explain important points on these steps.

Help on installing certificate server.
Important Steps:

Click install windows components from add or remove programs.

Select certificate authority.

Create root certificate.Fill common name attribute with your machine name.

Prepare Certificate for apply SSL on SQL server.
Important Steps:
Create Request -

Go to http://machineName/certsrv

Select "Request a certificate", and click Next.

Select "Advanced Request", and click Next.

Select "Submit a certificate request to this CA using a form", and click Next.

Fill the form you should use your SQL server name as Name.

Select "Server Authentication Certificate" as Intended Purpose.

Select "Use local machine store" and click Submit.

Now you have request a certificate and your request is in pending state.

Issue Certificate -

Go to Run, type mmc.

Follow the following path

Console -> Add/Remove snap in -> Add -> select Certificate Authority -> Add -> Select Local Computer -> Finish -> Close -> OK -> Expand Certificate Authority -> Pending Requests.

Now you can see your request.

Right click on request and click issue.

Install Certificate -

Go to http://machineName/certsrv

Select "Check on a pending certificate" and click Next.

Select your certificate and click Next.

Click install certificate.

Now you are ready to prepare SSL channel between SQL server and your application.This can be basically done in two ways.

From server side

From client side

Apply SSL from server side.
If you apply SSL on this way, all the client connections will get encrypted.
Steps:

Go to Server Network Utility tool on server machine.

Select "Force protocol encryption", click Apply and OK.

Now restart your SQL server.

Apply SSL from client side.
To do this client should have root certificate of the certification authority that issue certificate to the SQL server.

From server machine export the root certificate as .p7b.
Export root certificate -

Open Internet Explorer and follow the following path:

Tools -> Internet Options -> Content -> Certificates -> Trusted root certificate authorities -> Select your root certificate -> Export -> Next -> Select .p7B format -> Select "Include all certificates in the certification path if possible" -> Select place to save your certificate -> Next -> Finish.

Import certificate to client machine -

Open Internet Explorer on client machine.

Follow the following path:

Tools -> Internet Options -> Content -> Certificates -> Trusted root certificate authorities -> Select your root certificate -> Import -> Next -> Browse to certificate location -> Next -> Accept the certificate.

Now you can configure SSL from client machine.
You can configure SSL from ODBC connection manually or programatically.
Configure SSL programatically.
Sample connection strings:
ODBC
"Driver=SQLServer;Server=Protect-Drive;UID=sa;PWD=123;Network=DBNETLIB.DLL;Encrypt=YES "
OLEDB
"Provider=sqloledb;Data Source=Protect-Drive;Initial Catalog=slt;User Id=sa;Password=123;use encryption for data=true"

Configure SSL manually through ODBC.

Select "Use strong encryption" when you configure ODBC connection.

Note - if you don't have "Use strong encryption" option when you configure ODBC connection.You may need to install SQL client tools on client machine.

Best wishers,
If you have any problem with configuring SSL on SQL server please let me know.

How to install openLDAP

To install openLDAP you need to install BerkeleyDB first
Download latest version of BerkeleyDB
Extract it using tar xvf
cd in to db-version/build_unix
Run following commands in the same order
../dist/configure
make
make install

This should be run without any errors

Now you can install openLDAP
Download openLDAP which is a open source software.
Then do the following

Copy the tar.gz file to your preffered directory.
Extract it using tar xvf command
Change your current working directory in to ectracted openLDAP directory
Run following command in the same order
./configure
make depend
make

Then run 'make install' as root user


My Expierience
I got a error while running configure the openLDAP saying that it can't find the BerkerleyDB, if you also encounted with this error copy the db.h file it is normally located in /usr/local/BerkeleyDB.4.3/include to /usr/include
Then you should be ok.
Best wishers


Next document how to use openLDAP server as digital certificate storage