While most people consider Bacula to be a great network backup system, it is not the first thing that comes to mind when discussing Intrusion Detection Systems. However, Bacula’s File Verification feature is very powerful and is a better solution for businesses, especially enterprises that have many workstations and want to centralize the administration and configuration.

Host Based Intrusion Detection Systems monitor the important system files and note when these are changed, as this is one of the warning signs that the host may have been compromised by a virus, rootkit, or other malware. Unlike traditional Host Based IDS system like TripWire, who store their signature databases locally, Bacula stores its file signature database on a remote SQL Server, and the backup/verify process is entirely controlled by the remote ‘Director’. This means that the IDS client (known as the ‘File Daemon’ in a Bacula setup) is more resistant to being tampered with or disabled. If it is disabled, the centralized ‘Director’ will email the administrator a Failure Report, and can be configured to take specific actions.

Bacula breaks the backup and file integrity checking process into multiple services, that can be spread over multiple machines, or run all on a single server. The most important part of the system is the ‘Director’, it is responsible for coordinating and scheduling. All of the records for the files, signatures, jobs, schedules, volumes, media and configuration are stored in the ‘Catalog’, which is an SQL database. All of the file contents that are backed up are sent to the ‘Storage Daemon’, which can write them to File, CD/DVD, Tape, Auto Changer, or any other media you wish to use. It also provides the pool functionality, to maintain multiple copies of each file, while recycling the media when it’s content gets old, to ensure the longest retention period possible with the least amount of media. The last component is the ‘File Daemon’, also know as the Client, this is a small program that runs on each host (there are Linux, FreeBSD, Windows (including VSS), and Mac Versions), and takes requests from the ‘Director’ and then sends the files to backup and signatures to the ‘Storage Daemon’. It supports both MD5 and SHA1 hashing algorithms, and SSL/TLS transport encryption for the communications between the Client and Servers.

Bacula does not require any specific hardware, and can run on most of the operating systems that are supported by the client. However, you will need some type of storage medium, this can be a Disk, a Disk Array, a NAS/SAN, a CD/DVD Burner, or a Tape Drive/Changer. Only certain tapes drives and changers are supported (See the Bacula.org HTML Manual for a list). However, this means that the system requirements are very minimal, and only depend on the number of machines and amount of data you need to backup. If you are using Bacula solely as an IDS, then only the file signature database needs to be stored, and you will not require any special media or drives.

Bacula is open source software, so there is no licensing to purchase. A basic x86 server with a moderately sized hard drive, and an open source operating system such as FreeBSD are all that would be required to run a Bacula ‘Director’, ‘Storage Daemon’, and SQLite backed ‘Catalog’. Basic configuration for a 10 host environment with only the Host Based IDS to very the file signatures daily, would take a moderately experienced unix administrator a mere afternoon to setup, and it can be remotely administered from a windows or linux workstation with the wxConsole application.

Like any system, there are pros and cons to using Bacula as your Host Based IDS. The main problem with any Host Based IDS is that if the host is compromised, the ISD is no longer trustworthy. If for example, the compromise involves altering the kernel, it could easily cause the IDS to fail to detect any changed, and not alert you to the compromise. The only solution in this situation is using a LiveCD to verify the authenticity of the system files, however this can be cumbersome if you have many hosts, or if your system files change on a regular basis, as you would need to recreate the LiveCD. The biggest pro for the Bacula based system, is that it is entirely managed from the ‘Director’ server, and can be managed remotely. The list of clients to monitor, which files to check, how often to check them, running manual scans, can all be done remotely. Reports are emailed to you, and won’t stop because one of the hosts is compromised, you will still get your alerts, so you do not have to watch for the lack of an email confirmation that everything is ok. Becula also has the additional advantage of providing your backup solution as well, killing two birds with a free stone. Bacula is a very mature open source project that is actively developed, it is not like many smaller open source projects that start up, never reach a stable code base, and then suddenly stop development because of the loss of a single developer. Bacula is used and backed by many large enterprises, so you can count on it being around for a long time.

In the end, Bacula can act as a very good Host Based IDS but it is not a network IDS or IPS, it cannot detect or block suspicious traffic on the network, however it provides a much easier to manage solution when you have a large number of hosts, running different operating systems, to monitor. The SQL based ‘Catalog’ also allows you to build custom reporting tools to extract data from the database, such as differences between each host, and duplicate files. Overall Bacula makes a great Host Based IDS for the business that requires centralized management, reporting and administration in a mixed-host environment.

I have completed the new front end of tagjag, to be used until the replacement by grazr is completed.

It allows you to search for a tag/keyword, and see the results in 100s of RSS feeds, and quickly browse them. It is the fastest way to search the blogosphere.

Everyone talks about how MAC OS X has no issues with drivers, “you just plug it in, and it works”. This is because Apple strictly control which hardware is included in the ‘closed’ system that is a Macintosh. Linux and BSD also have lists of hardware that they are known to work well with, and when you are building a server, you usually refer to this list to avoid having problems down the road. Microsoft does the same thing for Windows, they publish a HCL (Hardware Compatibility List) which lists all of the hardware that will “just work”, but everyone seems to ignore that, and expect windows to work with whatever they throw at it. It is true that most hardware manufacturers make drivers for windows, but these drivers are not always of very high quality (either beta quality because of rapid feature adoption, as is the case with high end video cards, where the customers demand the bleeding edge, or just low quality due to lack of support from the hardware manufacturer), these low quality drivers tend to cause issues with the entire OS. Microsoft’s attempt at a solution to this is the ‘LOGO’ program, where Microsoft certifies that a driver has been properly tested and should not effect the stability of the system. However, as with most Microsoft initiatives, it has been a resounding failure. Lag times in certification make it impossible for rapidly developed drivers, such as those for video cards, to get certified and meet the release tempo demanded by their customers. Buggy drivers cause system instability and other odd and unwelcome behaviors, this is just as true for vista, as it is for xp, or linux. Therefore it is important that when you are building your own computer, and even more important if you are building the computer for someone else, that you refer to the proper hardware compatibility list, to ensure fewer problems, and greater compatibility and stability. The HCL is not a guarantee, but every step you take to reducing the change of a problem, increases the value of the system to the end user.

Tags: microsoft, linux, os x, mac, freebsd, hcl, hardware, drivers

In the last hours before the start of gnomedex, Chris asked for my help, and I managed to come through for him. Using iOPML.com you can view a live OPML feed of any search. just visit iopml.com and then give it the feed url http://tagjag.com/search_term_here and your iphone will give you a nice interface to view the feed with.

Chris is also working on providing an XSLT style sheet to make the OPML viewable directly from tagjag.com

Tags: tag, tags, tagjag, iphone, opml, iopml

I have been working on the updated version of the IRC Flash Chat Applet used on Chris’ live page, and I was looking for some more feedback on the original, bugs, features, and annoyances people have with it, and what they would like done about it.

the following are some ideas we already have:

• Color support (including bold, underline)
• Prompting for password for registered nicknames
• Emoticons

Anything additional you can add would be great, please post a comment (or two)

Tags: irc, flash, chat, tflash, chris pirillo, live, ustream

Microsoft ofters a free tool that allows you to scan your computer (or via the network, any computer you have administrative authority over) for any security vulnerabilities, these include:

• Administrative Setting Vulnerabilities
• Weak Passwords
• IIS Vulnerabilities
• SQL Vulnerabilities
• Missing Microsoft Updates (Windows, Office, .Net, etc)

You can download it here

Once you scan your computer, it will point out the problems, including the missing updates. You can click the link titled ‘result details’, and it will provide a list of missing updates, with download links. Store all of these missing updates in a folder

The Advantages to this method are:

1. You only need to download each update once
2. We will run the updates with some extra switches to make them faster
3. There is no need to install the Windows Update ActiveX control, so you can keep your browser locked now. This solution also beats ‘Windiz Update’, because you are getting the updates directly from Microsoft, instead of a third party.

The keep to speeding up the install of the updates are the following switches:

1. /passive - so you don’t have to click ok, next, next, next, finish for each update
2. /norestart - so your computer doesn’t reboot until the end
3. /nobackup - this stops the update from creating a restore point, and uninstall information, this saves ALOT of time when you are installing the 70+ updates for a fresh install of windows.

So, here is my little batch file for running the updates on all of the computers on your home network.

@echo on
net use U: \\COMPUTERNAMEsharedupdatefolder /persistent:no
U:
for %%f in (*.exe) do %%f /passive /norestart /nobackup
pause

Tags: windows, xp, vista, security, patch, updates, microsoft, virus, spyware