1 | <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
|
---|
2 | <html>
|
---|
3 | <head>
|
---|
4 | <title>HOWTO Samhain on Windows</title>
|
---|
5 | <style type="text/css">
|
---|
6 | <!--
|
---|
7 |
|
---|
8 | html { background: #eee; color: #000; }
|
---|
9 |
|
---|
10 | body { background: #eee; color: #000; margin: 0; padding: 0;}
|
---|
11 |
|
---|
12 | div.body {
|
---|
13 | background: #fff; color: #000;
|
---|
14 | margin: 0 1em 0 1em; padding: 1em;
|
---|
15 | font-family: serif;
|
---|
16 | font-size: 1em; line-height: 1.2em;
|
---|
17 | border-width: 0 1px 0 1px;
|
---|
18 | border-style: solid;
|
---|
19 | border-color: #aaa;
|
---|
20 | }
|
---|
21 |
|
---|
22 | div.block {
|
---|
23 | background: #b6c5f2; color: #000;
|
---|
24 | margin: 1em; padding: 0 1em 0 1em;
|
---|
25 | border-width: 1px;
|
---|
26 | border-style: solid;
|
---|
27 | border-color: #2d4488;
|
---|
28 | }
|
---|
29 |
|
---|
30 | div.warnblock {
|
---|
31 | background: #b6c5f2; color: #000;
|
---|
32 | margin: 1em; padding: 0 1em 0 1em;
|
---|
33 | border-width: 1px;
|
---|
34 | border-style: solid;
|
---|
35 | border-color: #FF9900;
|
---|
36 | }
|
---|
37 |
|
---|
38 | table {
|
---|
39 | background: #F8F8F8; color: #000;
|
---|
40 | margin: 1em;
|
---|
41 | border-width: 0 0 0 1px;
|
---|
42 | border-style: solid;
|
---|
43 | border-color: #C0C0C0;
|
---|
44 | }
|
---|
45 |
|
---|
46 | td {
|
---|
47 | border-width: 0 1px 1px 0;
|
---|
48 | border-style: solid;
|
---|
49 | border-color: #C0C0C0;
|
---|
50 | }
|
---|
51 |
|
---|
52 | th {
|
---|
53 | background: #F8F8FF;
|
---|
54 | border-width: 1px 1px 2px 0;
|
---|
55 | border-style: solid;
|
---|
56 | border-color: #C0C0C0;
|
---|
57 | }
|
---|
58 |
|
---|
59 |
|
---|
60 | /* body text, headings, and rules */
|
---|
61 |
|
---|
62 | p { margin: 0; text-indent: 0em; margin: 0 0 0.5em 0 }
|
---|
63 |
|
---|
64 | h1, h2, h3, h4, h5, h6 {
|
---|
65 | color: #206020; background: transparent;
|
---|
66 | font-family: Optima, Arial, Helvetica, sans-serif;
|
---|
67 | font-weight: normal;
|
---|
68 | }
|
---|
69 |
|
---|
70 | h1 { font-size: 1.69em; margin: 1.4em 0 0.4em 0; }
|
---|
71 | h2 { font-size: 1.44em; margin: 1.4em 0 0.4em 0; }
|
---|
72 | h3 { font-size: 1.21em; margin: 1.4em 0 0.4em 0; }
|
---|
73 | h4 { font-size: 1.00em; margin: 1.4em 0 0.4em 0; }
|
---|
74 | h5 { font-size: 0.81em; margin: 1.4em 0 0.4em 0; }
|
---|
75 | h6 { font-size: 0.64em; margin: 1.4em 0 0.4em 0; }
|
---|
76 |
|
---|
77 | hr {
|
---|
78 | color: transparent; background: transparent;
|
---|
79 | height: 0px; margin: 0.6em 0;
|
---|
80 | border-width: 1px ;
|
---|
81 | border-style: solid;
|
---|
82 | border-color: #999;
|
---|
83 | }
|
---|
84 |
|
---|
85 | /* bulleted lists and definition lists */
|
---|
86 |
|
---|
87 | ul { margin: 0 1em 0.6em 2em; padding: 0; }
|
---|
88 | li { margin: 0.4em 0 0 0; }
|
---|
89 |
|
---|
90 | dl { margin: 0.6em 1em 0.6em 2em; }
|
---|
91 | dt { color: #285577; }
|
---|
92 |
|
---|
93 | tt { color: #602020; }
|
---|
94 |
|
---|
95 | /* links */
|
---|
96 |
|
---|
97 | a.link {
|
---|
98 | color: #33c; background: transparent;
|
---|
99 | text-decoration: none;
|
---|
100 | }
|
---|
101 |
|
---|
102 | a:hover {
|
---|
103 | color: #000; background: transparent;
|
---|
104 | }
|
---|
105 |
|
---|
106 | body > a {
|
---|
107 | font-family: Optima, Arial, Helvetica, sans-serif;
|
---|
108 | font-size: 0.81em;
|
---|
109 | }
|
---|
110 |
|
---|
111 | h1, h2, h3, h4, h5, h6 {
|
---|
112 | color: #2d5588; background: transparent;
|
---|
113 | font-family: Optima, Arial, Helvetica, sans-serif;
|
---|
114 | font-weight: normal;
|
---|
115 | }
|
---|
116 |
|
---|
117 | -->
|
---|
118 | </style></head>
|
---|
119 | <body>
|
---|
120 | <div class="body">
|
---|
121 | <p style="text-align: center; background: #ccc; border: 1px solid #2d5588;"><a
|
---|
122 | style="text-decoration: none;"
|
---|
123 | href="http://www.la-samhna.de/samhain/">samhain file integrity
|
---|
124 | scanner</a> | <a style="text-decoration: none;"
|
---|
125 | href="http://www.la-samhna.de/samhain/s_documentation.html">online
|
---|
126 | documentation</a></p>
|
---|
127 | <br><center>
|
---|
128 | <h1>Using Samhain on Windows</h1>
|
---|
129 | </center>
|
---|
130 | <br>
|
---|
131 | <hr>
|
---|
132 | <p>
|
---|
133 | This document aims to explain how to compile and run
|
---|
134 | samhain on Windows with the
|
---|
135 | <b>Cygwin</b> POSIX emulation layer, and how to install it as a service.
|
---|
136 | These instructions have been written by Kris Dom,
|
---|
137 | who has tested this on WinXP Professional, with additions by Geries Handal
|
---|
138 | and Jorge Morgado.
|
---|
139 | </p>
|
---|
140 | <div class="block">
|
---|
141 | <h3>Interix / Services For UNIX</h3>
|
---|
142 | <p>
|
---|
143 | Samhain can also be used with Interix/SFU 3.5. Note that in Interix,
|
---|
144 | the Windows
|
---|
145 | filesystem is referred as <tt>/dev/fs/C</tt>, while in Cygwin it
|
---|
146 | is <tt>/cygdrive/c</tt> (both refers to the <tt>C:</tt> drive; other drives
|
---|
147 | are analogous).
|
---|
148 | </p><p>
|
---|
149 | Older versions of samhain would need to be built with
|
---|
150 | <tt>./configure --disable-mail</tt> (i.e. without support for email
|
---|
151 | logging) because Interix does not provide some of the required functionality
|
---|
152 | to build the email module. This issue should be fixed as of samhain
|
---|
153 | version 2.0.7 (not tested).<br />
|
---|
154 | [Based on information kindly provided by Geries Handal].
|
---|
155 | </p>
|
---|
156 | </div>
|
---|
157 |
|
---|
158 | <h2>Cygwin installation procedure to compile samhain</h2>
|
---|
159 |
|
---|
160 | <h3>Cygwin download</h3>
|
---|
161 |
|
---|
162 | <ul>
|
---|
163 | <li>
|
---|
164 | Make a temporary directory to store cygwin installer (e.g. c:\temp\cygwin)
|
---|
165 | </li>
|
---|
166 | <li>
|
---|
167 | Surf to <a href="http://www.cygwin.com">http://www.cygwin.com</a>
|
---|
168 | to download cygwin
|
---|
169 | </li>
|
---|
170 | <li>
|
---|
171 | Use the "install or update now (using setup.exe)" to
|
---|
172 | download the installer in c:\temp\cygwin
|
---|
173 | </li>
|
---|
174 | <li>
|
---|
175 | Execute "setup.exe" in c:\temp\cygwin
|
---|
176 | </li>
|
---|
177 | <li>
|
---|
178 | Choose the "download from the Internet" option
|
---|
179 | </li>
|
---|
180 | <li>
|
---|
181 | Choose "c:\temp\cygwin" as 'Local Package Directory'
|
---|
182 | </li>
|
---|
183 | <li>
|
---|
184 | Choose an FTP site
|
---|
185 | </li>
|
---|
186 | <li>
|
---|
187 | Click on 'Default' just after 'All' to change the installation type
|
---|
188 | from 'Default' to 'Install'. This will most likely install way too much
|
---|
189 | stuff but I am not familiar with Cygwin, so this way I know that all libs and
|
---|
190 | compilers are installed.
|
---|
191 | </li>
|
---|
192 | <li>
|
---|
193 | Let it download the stuff (there is a lot to download so be patient).
|
---|
194 | </li>
|
---|
195 | </ul>
|
---|
196 | <div class="block">
|
---|
197 | <p>
|
---|
198 | You don't need to download and install All packages. It is enough to keep
|
---|
199 | the Default and then add the following additional packages:
|
---|
200 | </p>
|
---|
201 | <p>
|
---|
202 | Category Devel -> gcc: C compiler upgrade helper<br/>
|
---|
203 | Category Devel -> make: The GNU version of the 'make' utility<br/>
|
---|
204 | Category Libs -> minires: A simple synchronous non caching stub resolver<br/>
|
---|
205 | </p>
|
---|
206 | <p>
|
---|
207 | When selecting these packages, Cygwin installer will automatically add
|
---|
208 | other packages based on their dependencies.
|
---|
209 | The package minires is only necessary for a minimal Cygwin installation
|
---|
210 | (below). [Kindly pointed out by Jorge Morgado].
|
---|
211 | </p>
|
---|
212 | </div>
|
---|
213 |
|
---|
214 | <h3>Cygwin installation</h3>
|
---|
215 |
|
---|
216 | <ul>
|
---|
217 | <li>
|
---|
218 | When the download is complete you have the Cygwin software in the
|
---|
219 | temporary directory, however, it still needs to be installed.
|
---|
220 | </li>
|
---|
221 | <li>
|
---|
222 | To install, execute the "setup.exe" in "c:\temp\cygwin"
|
---|
223 | </li>
|
---|
224 | <li>
|
---|
225 | Choose the "Install from local directory" option.
|
---|
226 | </li>
|
---|
227 | <li>
|
---|
228 | Choose "C:\Cygwin" as root directory (this will be the Unix '/')
|
---|
229 | </li>
|
---|
230 | <li>
|
---|
231 | Choose the Local Package Directory: "c:\temp\cygwin"
|
---|
232 | </li>
|
---|
233 | <li>
|
---|
234 | Click on 'Default' just after 'All' to change the installation type
|
---|
235 | from 'Default' to 'Install'.
|
---|
236 | </li>
|
---|
237 | <li>
|
---|
238 | Let it install Cygwin (this will take some time so be patient).
|
---|
239 | </li>
|
---|
240 | </ul>
|
---|
241 |
|
---|
242 | <h3>Samhain install procedure (used 'samhain 1.8.7a' in this procedure)</h3>
|
---|
243 | <p>
|
---|
244 | (in the following procedure I use my personal preferences)
|
---|
245 | </p>
|
---|
246 |
|
---|
247 | <ul>
|
---|
248 | <li>
|
---|
249 | Start up Cygwin using the "Cygwin" icon on the desktop (a classic
|
---|
250 | Unix environment will be started).
|
---|
251 | </li>
|
---|
252 | <li>
|
---|
253 | Download the 'samhain' gzip/tar (I always put in my home directory)
|
---|
254 | </li>
|
---|
255 | <li>
|
---|
256 | Make directories to install samhain (taking into account the configure
|
---|
257 | options):<br />
|
---|
258 | <tt>$ mkdir /usr/local/sbin</tt><br />
|
---|
259 | <tt>$ mkdir /usr/local/var</tt><br />
|
---|
260 | <tt>$ mkdir /usr/local/log</tt><br />
|
---|
261 | <tt>$ mkdir /usr/local/tmp</tt><br />
|
---|
262 | </li>
|
---|
263 | <li>Go to the home directory:<br />
|
---|
264 | <tt>$ cd $HOME</tt>
|
---|
265 | </li>
|
---|
266 | <li>Un-gzip and untar the samhain package:<br />
|
---|
267 | <tt>$ gunzip samhain-1.8.7a.tar.gz</tt><br />
|
---|
268 | <tt>$ tar xvf samhain-1.8.7a.tar</tt><br />
|
---|
269 | </li>
|
---|
270 | <li>Go to the samhain directory:<br />
|
---|
271 | <tt>$ cd samhain-1.8.7a</tt><br />
|
---|
272 | </li>
|
---|
273 | <li>Configure:<br />
|
---|
274 | <tt>$ ./configure --enable-xml-log=yes --with-tmp-dir=/usr/local/tmp --with-config-file=/usr/local/etc/samhainrc --with-log-file=/usr/local/log/samhain.log --with-pid-file=/usr/local/var/samhain.pid --with-state-dir=/usr/local/var</tt><br />
|
---|
275 | <div class="block">
|
---|
276 | <p>
|
---|
277 | In my experience, the paths given in the 'configure' command should refer to
|
---|
278 | the Cygwin filesystem view, i.e. <tt>/cygdrive/c/...</tt>, otherwise
|
---|
279 | samhain may not work from a pure DOS shell, and may not run as a Windows
|
---|
280 | service.
|
---|
281 | </p>
|
---|
282 | </div>
|
---|
283 | </li>
|
---|
284 | <li>Make the binary:<br />
|
---|
285 | <tt>$ make</tt><br />
|
---|
286 | </li>
|
---|
287 | <li>Install samhain:<br />
|
---|
288 | <tt>$ make install</tt><br />
|
---|
289 | </li>
|
---|
290 | <li>Now configure the "/usr/local/etc/samhainrc" file.<br />
|
---|
291 | Remember: "C:\" -> "/cygdrive/c/"
|
---|
292 | </li>
|
---|
293 | <li>Initialize the samhain local baseline database:<br />
|
---|
294 | <tt>$ /usr/local/sbin/samhain -t init</tt><br />
|
---|
295 | </li>
|
---|
296 | <li>Start it up:<br />
|
---|
297 | <tt>$ /usr/local/sbin/samhain -t check</tt><br />
|
---|
298 | </li>
|
---|
299 | </ul>
|
---|
300 |
|
---|
301 |
|
---|
302 | <h2>Cygwin minimal installation procedure to run samhain</h2>
|
---|
303 |
|
---|
304 | <ul>
|
---|
305 | <li>
|
---|
306 | Files needed to create a service (from NT/W2K Resource Kit):
|
---|
307 | <ul>
|
---|
308 | <li>
|
---|
309 | instsrv.exe
|
---|
310 | </li>
|
---|
311 | <li>
|
---|
312 | srvany.exe
|
---|
313 | </li>
|
---|
314 | </ul>
|
---|
315 | </li>
|
---|
316 | <li>
|
---|
317 | First copy these files to the "%winnt%\system32" directory.
|
---|
318 | </li>
|
---|
319 | <li>
|
---|
320 | Files needed to run the 'samhain.exe'. Copy the following .dll from the
|
---|
321 | Cygwin setup (c:\Cygwin\bin) to the "%winnt%\system32" directory:
|
---|
322 | <ul>
|
---|
323 | <li>
|
---|
324 | cygwin1.dll
|
---|
325 | </li>
|
---|
326 | <li>
|
---|
327 | cygminires.dll
|
---|
328 | </li>
|
---|
329 | </ul>
|
---|
330 | </li>
|
---|
331 | <li>
|
---|
332 | Files needed from c:\Cygwin\bin to create the /etc/passwd and /etc/group files:
|
---|
333 | <ul>
|
---|
334 | <li>
|
---|
335 | mkpasswd.exe
|
---|
336 | </li>
|
---|
337 | <li>
|
---|
338 | mkgroup.exe
|
---|
339 | </li>
|
---|
340 | </ul>
|
---|
341 | <p>
|
---|
342 | To generate these files on a minimal Cygwin installation execute - on a
|
---|
343 | Windows Command Prompt:
|
---|
344 | </p><p>
|
---|
345 | <tt>mkdir c:\etc</tt><br />
|
---|
346 | <tt>path\to\mkpasswd.exe -l > c:\etc\passwd</tt><br />
|
---|
347 | <tt>path\to\mkgroup.exe -l > c:\etc\group</tt>
|
---|
348 | </p><p>
|
---|
349 | IMPORTANT NOTE: You should re-create these two files, each time the
|
---|
350 | Windows users and groups accounts database changes. Failing to do this
|
---|
351 | might generate critical log messages (depending on your configuration
|
---|
352 | file).
|
---|
353 | </p>
|
---|
354 | </li>
|
---|
355 | <li>
|
---|
356 | Create a directory structure for samhain (following the compilation options
|
---|
357 | you used)<br />
|
---|
358 | - in a DOS box (or via Windows Explorer)<br />
|
---|
359 | <tt>mkdir c:\usr</tt><br />
|
---|
360 | <tt>mkdir c:\usr\local</tt><br />
|
---|
361 | <tt>mkdir c:\usr\local\sbin</tt><br />
|
---|
362 | <tt>mkdir c:\usr\local\var</tt><br />
|
---|
363 | <tt>mkdir c:\usr\local\tmp</tt><br />
|
---|
364 | <tt>mkdir c:\usr\local\log</tt><br />
|
---|
365 | <tt>mkdir c:\usr\local\etc</tt><br />
|
---|
366 | </li>
|
---|
367 | <li>
|
---|
368 | Use the "instsrv.exe" binary to create a new service:<br />
|
---|
369 | <tt>instsrv.exe samhain c:\windows\system32\srvany.exe</tt><br />
|
---|
370 | (this will create a service called "Samhain" that will
|
---|
371 | start the "srvany.exe" process).
|
---|
372 | </li>
|
---|
373 | <li>Now edit the registry to change the startup parameters for the newly
|
---|
374 | created service:
|
---|
375 | <ul>
|
---|
376 | <li>regedit</li>
|
---|
377 | <li>HKEY_LOCAL_MACHINE->SYSTEM->CurrentControlSet->Services->Samhain</li>
|
---|
378 | <li>Add a String value (type: REG_SZ called: "Description") under the 'Samhain' key</li>
|
---|
379 | <li>Open the newly created "Description" value and fill in a description for the 'Samhain' service</li>
|
---|
380 | <li>Add a key to specify what file the "srvany.exe" process must start:<br />
|
---|
381 | Edit->New->Key called "Parameters"
|
---|
382 | </li>
|
---|
383 | <li>Under the newly created "Parameters" key, add a new String
|
---|
384 | value called "Application".<br />
|
---|
385 | The value for "Application"
|
---|
386 | should be "c:\usr\local\sbin\samhain.exe".</li>
|
---|
387 | </ul>
|
---|
388 | </li>
|
---|
389 | <li>
|
---|
390 | Make sure that in the "samhainrc" file, you have used
|
---|
391 | "/cygdrive/c" to refer to "c:"
|
---|
392 | </li>
|
---|
393 | <li>
|
---|
394 | Initialize the samhain baseline database first:<br />
|
---|
395 | <tt>c:\usr\local\sbin\samhain -t init</tt><br />
|
---|
396 | </li>
|
---|
397 | <li>
|
---|
398 | Reboot (it is Windows so ...)
|
---|
399 | </li>
|
---|
400 | </ul>
|
---|
401 | <p>
|
---|
402 | Also see <a href="http://support.microsoft.com/kb/q137890/">http://support.microsoft.com/kb/q137890/</a> for information regarding the creation of a
|
---|
403 | user-defined service.
|
---|
404 | </p>
|
---|
405 | <p>
|
---|
406 | Note: the first time I tried to install samhain as an NT service, I first
|
---|
407 | installed a default Cygwin on the system. This however made things much more
|
---|
408 | complex. I think when there is no Cygwin installed, it is more easy to install
|
---|
409 | Samhain as a service.
|
---|
410 | </p>
|
---|
411 |
|
---|
412 |
|
---|
413 | <h2>Troubleshooting samhain</h2>
|
---|
414 |
|
---|
415 | <p>
|
---|
416 | [Rainer Wichmann] I had some problems at first getting it to run as a
|
---|
417 | Windows service. Some tips:
|
---|
418 | <ul>
|
---|
419 | <li>
|
---|
420 | Running samhain from a pure DOS shell (outside the Cygwin environment)
|
---|
421 | helps to identify problems, in particular if it refuses to start
|
---|
422 | as a Windows service.
|
---|
423 | </li>
|
---|
424 | <li>
|
---|
425 | I found it neccessary to put the <tt>cygwin1.dll</tt> DLL into the
|
---|
426 | same directory as the <tt>samhain.exe</tt> executable. Also, you
|
---|
427 | can use the command <tt>ldd ./samhain.exe</tt> to identify further
|
---|
428 | Cygwin-specific DLL that may be required (if any).
|
---|
429 | </li>
|
---|
430 | <li>
|
---|
431 | Also, I found it neccessary to use Cygwin-style paths
|
---|
432 | (<tt>/cygdrive/c/...</tt>) in the './configure ..' command when
|
---|
433 | compiling samhain.
|
---|
434 | </li>
|
---|
435 | </ul>
|
---|
436 | </p>
|
---|
437 |
|
---|
438 | <p>
|
---|
439 | [Tip from Jorge Morgado] If you, like me, have a Windows server not part of any domain and (for
|
---|
440 | security reasons) you even turn off DNS resolution, you might probably get
|
---|
441 | the following error when initializing the baseline database:
|
---|
442 | </p>
|
---|
443 | <pre>
|
---|
444 | --------- sh_unix.c --- 1487 ---------
|
---|
445 | According to uname, your nodename is yourcomputername, but your resolver
|
---|
446 | library cannot resolve this nodename to a FQDN.
|
---|
447 | Rather, it resolves this to yourcomputername.
|
---|
448 | For more information, see the entry about self-resolving under
|
---|
449 | 'Most frequently' in the FAQ that you will find in the docs/ subdirectory
|
---|
450 | ----------------------------------------------
|
---|
451 | </pre>
|
---|
452 | <p>
|
---|
453 | To fix this problem open the Registry Editor and create the following
|
---|
454 | entries under the key
|
---|
455 | HKLM\System\CurrentControlSet\Services\Tcpip\Parameters
|
---|
456 | </p>
|
---|
457 | <p>
|
---|
458 | <tt>
|
---|
459 | Name: Domain<br/>
|
---|
460 | Type: REG_SZ<br/>
|
---|
461 | Data: your.domain.name
|
---|
462 | </tt>
|
---|
463 | </p><p>
|
---|
464 | <tt>
|
---|
465 | Name: NV Domain<br/>
|
---|
466 | Type: REG_SZ<br/>
|
---|
467 | Data: your.domain.name
|
---|
468 | </tt>
|
---|
469 | </p><p>
|
---|
470 | The NV Domain registry value contains the computer's primary DNS suffix
|
---|
471 | while the Domain registry value contains the computer's primary DNS
|
---|
472 | domain. This will make the warning message go away.
|
---|
473 | </p>
|
---|
474 | </div>
|
---|
475 | </body>
|
---|
476 | </html>
|
---|