


GABRIEL(8)            MAINTENANCE COMMANDS             GABRIEL(8)



NAME
     gabriel - Network Probe Detector for SATAN

OVERVIEW
     The gabriel software package from  Los  Altos  Technologies,
     Inc.  allows a system administrator to detect network probes
     like the ones generated by SATAN.  The gabriel package gives
     the system administrator an early warning of a possible net-
     work intrusion by detecting  unauthorized  network  probing,
     and it confirms that authorized probing reaches the expected
     network segments.  It identifies the source of  the  probing
     and  can immediately notify the administrator via a pager, a
     phone call, an email message, or a screen display.

     The gabriel package is an enterprise-wide solution.   It  is
     easy  for a single administrator to protect all the networks
     and sub-networks in an entire enterprise.   One  machine  on
     each  network  segment  runs  the gabriel client software in
     addition to that machine's normal  workload.   These  client
     pieces  monitor  all  traffic  on their network segments and
     report excessive network probing to the gabriel  server  via
     the  standard syslog facility.  The server can be configured
     to notify the system administrator in a variety of  built-in
     ways  (e.g.,  calling  a  pager), or via custom notification
     scripts.  The client software DOES NOT need to run on  every
     machine.  For example, even though the software only runs on
     Unix systems (in the initial release), one Unix  system  can
     protect  all the PCs or NT systems attached to the same net-
     work segment.

     The clients also send periodic heart-beat  messages  to  the
     server,  so the administrator can receive daily or weekly e-
     mail to confirm that all clients are still doing their jobs.

     Ease of use is a key design goal for gabriel. It comes  with
     installation  scripts for both the server and client pieces.
     It is a complete package that  includes  all  the  necessary
     software.  The  full  source  code is included for those who
     want to examine or extend the product.  For people who  want
     to  get started quickly, the package comes with pre-compiled
     binaries.  A test script is included so  you  can  test  the
     package  even if you do not have a network prober like SATAN
     or ISS (Internet Security Scanner).

     The package was designed to have a minimal impact on produc-
     tion  systems.   It  does not need to run on production sys-
     tems.  Instead, the client software can simply be  installed
     on  any  machine on the same network segments as the produc-
     tion machines.  These client pieces will detect any  probing
     of  the  production systems.  If some loading is acceptable,
     the client piece can be installed on the production system.




Sun Release 4.1    Last change: 30 March 1995                   1






GABRIEL(8)            MAINTENANCE COMMANDS             GABRIEL(8)



     The gabriel package has only  a  few  dependencies  on  your
     environment.   It  is  a collection of programs written in C
     and sh scripts. You DO NOT need to  install  perl  or  other
     software packages or libraries.  The program uses the exist-
     ing packet filtering  programs  for  each  operating  system
     (e.g., etherfind for Solaris 1).

INSTALLATION AND TESTING
     The gabriel package can be installed and tested on a  single
     machine  before  installing the client pieces to monitor all
     of your network segments.  To do  this,  load  the  software
     onto     the    desired    machine    and    then    execute
     install_gabriel_server. This program will install the server
     reporting    piece    of   gabriel.   You   then   run   the
     install_gabriel_client program to install and start a client
     monitor  program,  either  on  the same machine or on a dif-
     ferent machine.  If you wish to compile the program from its
     source code, see the comments in the READ.ME file.

     After installing the server,  edit  the  configuration  file
     mentioned by the install script.  This file tells the server
     software how you want to receive reports about network prob-
     ing.   Changes to the configuration will take effect immedi-
     ately.  There is no need to  re-install  the  program  after
     changing the configuration file.

     To test gabriel run the gabriel_tester program from  another
     machine  on  the  same  network segment.  The packet monitor
     programs will not detect traffic from a host to  itself,  so
     the tester must be run on another machine.  Due to buffering
     in the Solaris 2.x packet  monitor,  the  Solaris  2  client
     pieces will take longer to notice an attack than the Solaris
     1 clients.

     After running gabriel_tester, run the gabriel_server program
     on  the  server  machine  to  produce  notifications  of the
     attack.

     Once the tester has been run, running  gabriel_tester  again
     will  not  produce any new notifications.  The client pieces
     remember the time when they last told  the  server  about  a
     particular  attacking  host, and they will only make another
     report if the  attack  is  still  underway  fifteen  minutes
     later.   If  you want to run another test, you must kill the
     client programs and restart them.  On a Solaris 1.x machine,
     you  can  locate  the  client processes with the command: ps
     -agx | grep gabriel ; ps  -agx  |  grep  etherfind  .  On  a
     Solaris  2.x  machine,  you  can locate the client processes
     with the command: ps -ef | grep gabriel  ;  ps  -ef  |  grep
     snoop .





Sun Release 4.1    Last change: 30 March 1995                   2






GABRIEL(8)            MAINTENANCE COMMANDS             GABRIEL(8)



HOW IT WORKS
     The gabriel package detects SATAN probing by looking  for  a
     host  that  is probing a large number of different services.
     The gabriel_client program examines all  initial  connection
     packets  sent  over the network attached to the machine run-
     ning the client.  These include ICMP, TCP and  UDP  packets.
     To  avoid  loading the client machine, only the initial con-
     nection packets are examined, not the data transfer packets.
     The  client program records the source host address, service
     type (e.g., PING, FTP, RLOGIN) and probe time in a  database
     of  active  connections.   Connections  are removed from the
     database after a period of inactivity.

     The gabriel_client program is actually a shell  script  that
     invokes  either  gabriel_client.sol1  or gabriel_client.sol2
     based on the operating system type.  This approach makes  it
     easy  to have both Solaris 1 and Solaris 2 machines share an
     NFS mounted file system with the gabriel software.

     The packets are extracted using the packet  monitor  program
     built  into  the OS.  For Solaris 1.x, the etherfind program
     is used.  For Solaris 2.x, the snoop program is  used.   See
     the  section  on  porting  for information about other plat-
     forms.

     Periodically, the connection database is scanned to identify
     hosts  that  are requesting connections to a large number of
     different services.  This is the characteristic footprint of
     a  network  prober  like SATAN.  Based on the number of dif-
     ferent types of probes, the  client  sends  a  high  or  low
     priority report to the server.  The reports are sent as sys-
     log  messages  identified  with  local3.notice.  The  client
     install  script saves and modifies the /etc/syslog.conf file
     to  send  these  messages  to  the  server,  and  then   re-
     initializes  the  syslogd  daemon  with  a  HUP signal.  The
     client pieces also  send  out  periodic  heart-beat  reports
     using syslog messages identified with local3.info.

     You can observe the internal workings of the client piece by
     directly     invoking     the     gabriel_client.sol1     or
     gabriel_client.sol2  program  from  the  command  line.   By
     default,  these  programs generate per-probe status informa-
     tion that is discarded by the parent script gabriel_client.

     The  server  install   script   saves   and   modifies   the
     /etc/syslog.conf  file  to  place all local3 messages into a
     file.  It also sets up a cron job that periodically runs the
     gabriel_server  program,  which  scans  the  log  file.   By
     default, the server looks at all the log  events  that  were
     recorded  since it was last run and notifies the administra-
     tor about these events according to its configuration  file.
     The  notifications  can  include  calling  a  pager, sending



Sun Release 4.1    Last change: 30 March 1995                   3






GABRIEL(8)            MAINTENANCE COMMANDS             GABRIEL(8)



     email, calling a home phone number  to  play  a  distinctive
     touch  tone  pattern, online displays via wall, or arbitrary
     notification via custom scripts.

     The gabriel_server can be invoked directly from the  command
     line.   For  additional help with the server, invoke it with
     the -h option.

PORTING
     The gabriel software can be ported to any platform that sup-
     ports  C and sh programming and has a packet monitoring pro-
     gram either included with the OS, or available from the pub-
     lic  domain  (e.g., tcpdump).  To port the software you need
     to determine how to make the packet monitor  report  on  the
     packet  types described in the gabriel_client.c program, and
     add a parser that extracts the source host name and  service
     type from the output of the packet filter.

LIMITATIONS
     The initial release only runs on Solaris 1 and Solaris 2.

     The client machines can only have one network interface.

     The thresholds for detecting an attack are  hard  to  change
     after the clients are installed.

AUTHORS
     Bob Baldwin, Ben Dubin, and Richard Mahn.  Copyright 1995 by
     Los  Altos Technologies, Inc.  All rights reserved.  Gabriel
     is a trademark of Los Altos Technologies, Inc.

























Sun Release 4.1    Last change: 30 March 1995                   4



