Linux intrusion Monitoring System LIDS principle (4)

9. Intrusion Response System

When we detect that some programs violate our rules, we must respond to them. In the current LIDS system, we can use the record function to record all information. We can also suspend the console that this user uses. Then, we will add more response systems to LIDS, not only in the kernel, but also in the user zone.

9.1 allow login in a safe way

In the traditional kernel login mode, we use printk to print information on the console every time. However, the kernel is vulnerable to DoS attacks. The system will frequently run the printk command. We can use security_alert () in the kernel to implement the alarm response function.

You can check the code of/include/linux/kernel. h.

9.2 console Suspension

This function uses security logs to suspend the consoles of those who violate the security rules defined by LIDS. To continue, they must log on to the system again. However, everything they do has been recorded by the system logs or sent to the Administrator via e-mail.

9.3 report to the Administrator via email or call

This function is developed by boidi. With this tool, we can easily know where errors occur in the system and respond to intrusions in a timely manner.

These are the basic principles of LIDS, which may involve programming of kernel modules. In this regard, you can go to the chinabyte linux zone, where there is coolboy information about the module lkm that can be loaded. Cool. If you have any questions, you can also e-mail me chaobowang@sina.com hope you support more linuxbyte !!!!