samhain file integrity scanner | online documentation

Using Samhain on Windows

---

This document aims to explain how to compile and run samhain on Windows with the Cygwin POSIX emulation layer, and how to install it as a service. These instructions have been written by Kris Dom, who has tested this on WinXP Professional, with additions by Geries Handal and Jorge Morgado.

Cygwin installation procedure to compile samhain

Cygwin download

• Make a temporary directory to store cygwin installer (e.g. c:\temp\cygwin)
• Surf to http://www.cygwin.com to download cygwin
• Use the "install or update now (using setup.exe)" to download the installer in c:\temp\cygwin
• Execute "setup.exe" in c:\temp\cygwin
• Choose the "download from the Internet" option
• Choose "c:\temp\cygwin" as 'Local Package Directory'
• Choose an FTP site
• Click on 'Default' just after 'All' to change the installation type from 'Default' to 'Install'. This will most likely install way too much stuff but I am not familiar with Cygwin, so this way I know that all libs and compilers are installed.
• Let it download the stuff (there is a lot to download so be patient).

Cygwin installation

• When the download is complete you have the Cygwin software in the temporary directory, however, it still needs to be installed.
• To install, execute the "setup.exe" in "c:\temp\cygwin"
• Choose the "Install from local directory" option.
• Choose "C:\Cygwin" as root directory (this will be the Unix '/')
• Choose the Local Package Directory: "c:\temp\cygwin"
• Click on 'Default' just after 'All' to change the installation type from 'Default' to 'Install'.
• Let it install Cygwin (this will take some time so be patient).

Samhain install procedure (used 'samhain 1.8.7a' in this procedure)

(in the following procedure I use my personal preferences)

• Start up Cygwin using the "Cygwin" icon on the desktop (a classic Unix environment will be started).
• Download the 'samhain' gzip/tar (I always put in my home directory)
• Make directories to install samhain (taking into account the configure options):
     $ mkdir /usr/local/sbin
     $ mkdir /usr/local/var
     $ mkdir /usr/local/log
     $ mkdir /usr/local/tmp
  
• Go to the home directory:
     $ cd $HOME
• Un-gzip and untar the samhain package:
     $ gunzip samhain-1.8.7a.tar.gz
     $ tar xvf samhain-1.8.7a.tar
  
• Go to the samhain directory:
     $ cd samhain-1.8.7a
  
• Configure:
     $ ./configure --enable-xml-log=yes --with-tmp-dir=/usr/local/tmp --with-config-file=/usr/local/etc/samhainrc --with-log-file=/usr/local/log/samhain.log --with-pid-file=/usr/local/var/samhain.pid --with-state-dir=/usr/local/var
  

  In my experience, the paths given in the 'configure' command should refer to the Cygwin filesystem view, i.e. /cygdrive/c/..., otherwise samhain may not work from a pure DOS shell, and may not run as a Windows service.

• Make the binary:
     $ make
  
• Install samhain:
     $ make install
  
• Now configure the "/usr/local/etc/samhainrc" file.
  Remember: "C:\" -> "/cygdrive/c/"
• Initialize the samhain local baseline database:
     $ /usr/local/sbin/samhain -t init
  
• Start it up:
     $ /usr/local/sbin/samhain -t check
  

Cygwin minimal installation procedure to run samhain

• Files needed to create a service (from NT/W2K Resource Kit):
  • instsrv.exe
  • srvany.exe
• First copy these files to the "%winnt%\system32" directory.
• Files needed to run the 'samhain.exe'. Copy the following .dll from the Cygwin setup (c:\Cygwin\bin) to the "%winnt%\system32" directory:
  • cygwin1.dll
  • cygminires.dll
• Files needed from c:\Cygwin\bin to create the /etc/passwd and /etc/group files:
  • mkpasswd.exe
  • mkgroup.exe

  To generate these files on a minimal Cygwin installation execute - on a Windows Command Prompt:

     mkdir c:\etc
     path\to\mkpasswd.exe -l > c:\etc\passwd
     path\to\mkgroup.exe -l > c:\etc\group

  IMPORTANT NOTE: You should re-create these two files, each time the Windows users and groups accounts database changes. Failing to do this might generate critical log messages (depending on your configuration file).

• Create a directory structure for samhain (following the compilation options you used)
     - in a DOS box (or via Windows Explorer)
     mkdir c:\usr
     mkdir c:\usr\local
     mkdir c:\usr\local\sbin
     mkdir c:\usr\local\var
     mkdir c:\usr\local\tmp
     mkdir c:\usr\local\log
     mkdir c:\usr\local\etc
  
• Use the "instsrv.exe" binary to create a new service:
     instsrv.exe samhain c:\windows\system32\srvany.exe
     (this will create a service called "Samhain" that will start the "srvany.exe" process).
• Now edit the registry to change the startup parameters for the newly created service:
  • regedit
  • HKEY_LOCAL_MACHINE->SYSTEM->CurrentControlSet->Services->Samhain
  • Add a String value (type: REG_SZ called: "Description") under the 'Samhain' key
  • Open the newly created "Description" value and fill in a description for the 'Samhain' service
  • Add a key to specify what file the "srvany.exe" process must start:
       Edit->New->Key called "Parameters"
  • Under the newly created "Parameters" key, add a new String value called "Application".
       The value for "Application" should be "c:\usr\local\sbin\samhain.exe".
• Make sure that in the "samhainrc" file, you have used "/cygdrive/c" to refer to "c:"
• Initialize the samhain baseline database first:
     c:\usr\local\sbin\samhain -t init
  
• Reboot (it is Windows so ...)

Also see http://support.microsoft.com/kb/q137890/ for information regarding the creation of a user-defined service.

Note: the first time I tried to install samhain as an NT service, I first installed a default Cygwin on the system. This however made things much more complex. I think when there is no Cygwin installed, it is more easy to install Samhain as a service.

Troubleshooting samhain

[Rainer Wichmann] I had some problems at first getting it to run as a Windows service. Some tips:

• Running samhain from a pure DOS shell (outside the Cygwin environment) helps to identify problems, in particular if it refuses to start as a Windows service.
• I found it neccessary to put the cygwin1.dll DLL into the same directory as the samhain.exe executable. Also, you can use the command ldd ./samhain.exe to identify further Cygwin-specific DLL that may be required (if any).
• Also, I found it neccessary to use Cygwin-style paths (/cygdrive/c/...) in the './configure ..' command when compiling samhain.

[Tip from Jorge Morgado] If you, like me, have a Windows server not part of any domain and (for security reasons) you even turn off DNS resolution, you might probably get the following error when initializing the baseline database:

  ---------   sh_unix.c  ---   1487 ---------
  According to uname, your nodename is yourcomputername, but your resolver
  library cannot resolve this nodename to a FQDN.
  Rather, it resolves this to yourcomputername.
  For more information, see the entry about self-resolving under
  'Most frequently' in the FAQ that you will find in the docs/ subdirectory
  ----------------------------------------------

To fix this problem open the Registry Editor and create the following entries under the key HKLM\System\CurrentControlSet\Services\Tcpip\Parameters

Name: Domain
Type: REG_SZ
Data: your.domain.name

Name: NV Domain
Type: REG_SZ
Data: your.domain.name

The NV Domain registry value contains the computer's primary DNS suffix while the Domain registry value contains the computer's primary DNS domain. This will make the warning message go away.