Package: pyHIDS
pyHIDSPresentationpyHIDSis aHIDS(host-based intrusion detection system) for verifying the integrity of a system.It is recommended to use Python >= 3.11.Featureschecks the integrity of system's files with a list of rules;checks the output of commands (iptables, ...);possibity to use RSA to sign to check the integrity of its database;alerts are written in the logs of the system;alerts can be sent via email to a list of users;alerts can be sent on IRC channels through theirkerIRC client (which should be running as
a daemon);verify files withHashlookup,Pandora,MISPandYARA;possibility to export the database in a Bloom or a Cuckoo filter.You can define rules to specify files to be checked.InstallationYou can usepipx.$pipxinstallpyHIDS
$exportPYHIDS_CONFIG=~/.pyHIDS/conf.cfgAn exampleof configuration file is available.
With this file you can configure:the integration with Hashlookup, Pandora, MISP and YARA;the IRC connection for the notifications;the SMTP connection for the email notifications;the list of files to scan;the regular expressions to specify files to scan in a folder;the command's output to check.Usage$pyhidsgen-keys--size2048Generating2048bitsRSAkeys...
DumpingKeys
Done.

$pyhidsgen-base--sign
Generatingdatabase...2427filesinthedatabase.

$pyhidsrun--check-signature
Verifyingtheintegrityofthebaseofhashes...
Databaseintegrityverified.
Verifyingtheintegrityofthefiles...[12/10/2321:35:26]Error(s):0[12/10/2321:35:26]Warning(s):0[12/10/2321:35:26]HIDSfinished.You can skip the first step (generation of the keys) if you do not want to
sign the database with the solution provided with pyHIDS (RSA) or if you
do not want to sign the database.Change a monitored file and relaunch the program:$pyhidsrun
Verifyingtheintegrityofthefiles...[12/10/2314:41:51][warning]/bin/cifsddchanged.The program warns that the file has changed. When this happens, a warning is
generated in the logs of the system and an email is sent to the
administrator. If no change is detected, only the log file is updated.Log file generated:$tailvar/log[09/10/2314:41:51][notice]/bin/cifscredsok[09/10/2314:41:51][notice]/bin/mbim-networkok[09/10/2314:41:51][notice]/bin/xclipok[09/10/2314:41:51][notice]/bin/preparetips5ok[09/10/2314:41:51][notice]/bin/pamperspectiveok[12/10/2314:41:51][warning]/bin/cifsddchanged.[09/10/2314:41:51][notice]/bin/pod2usageok[09/10/2314:41:51][notice]/bin/mkzftreeok[09/10/2314:41:51]Error(s):0[09/10/2314:41:51]Warning(s):1[09/10/2314:41:51]HIDSfinished.If you want to see the logs insyslogyou have different options
depending on your system:$journalctl--follow
Oct1222:58:47debianpyhids[98135]:pyHIDS-[12/10/2322:58:47][warning]/etc/resolv.confchanged.
Oct1222:58:47debianpyhids[98135]:pyHIDS-[12/10/2322:58:47][warning]/bin/mdsearchchanged.
Oct1222:58:47debianpyhids[98135]:pyHIDS-[12/10/2322:58:47][warning]/bin/smbcaclschanged.
Oct1222:58:47debianpyhids[98135]:pyHIDS-[12/10/2322:58:47][warning]/bin/smbspoolchanged.
Oct1222:58:47debianpyhids[98135]:pyHIDS-[12/10/2322:58:47][warning]/bin/smbclientchanged.
Oct1222:58:47debianpyhids[98135]:pyHIDS-[12/10/2322:58:47][warning]/bin/smbcquotaschanged.
Oct1222:58:47debianpyhids[98135]:pyHIDS-[12/10/2322:58:47][warning]/bin/smbgetchanged.
Oct1222:58:47debianpyhids[98135]:pyHIDS-[12/10/2322:58:47][warning]/bin/nmblookupchanged.
Oct1222:58:48debianpyhids[98135]:pyHIDS-[12/10/2322:58:47][warning]/bin/rpcclientchanged.
Oct1222:58:48debianpyhids[98135]:pyHIDS-[12/10/2322:58:48][warning]/bin/smbpasswdchanged.
Oct1222:58:48debianpyhids[98135]:pyHIDS-[12/10/2322:58:48][warning]/bin/dbwrap_toolchanged.
Oct1222:58:48debianpyhids[98135]:pyHIDS-[12/10/2322:58:48][warning]/bin/cifsddchanged.
Oct1222:58:48debianpyhids[98135]:pyHIDS-[12/10/2322:58:48][warning]/bin/netchanged.
Oct1222:58:48debianpyhids[98135]:pyHIDS-[12/10/2322:58:48][warning]/bin/samba-regeditchanged.
Oct1222:58:48debianpyhids[98135]:pyHIDS-[12/10/2322:58:48][warning]/bin/testparmchanged.
Oct1222:58:48debianpyhids[98135]:pyHIDS-[12/10/2322:58:48][warning]/bin/smbtreechanged.$journalctl--since="1 minute ago"$tail-f/var/log/syslogOther featuresChecks with external toolsCheck for known malicious files with Hashlookup, Pandora, MISP or YARA.$pyhidshashlookup
$pyhidspandora
$pyhidsmisp
$pyhidsyaraExport functions$pyhidsexport--bloom-filter
Bloomfiltergeneratedandstored:var/bloom/bloomfilter.bf$pyhidsexport--cuckoo-filter
Cuckoofiltergeneratedandstored:var/cuckoo/cuckoofilter.cfAutomatic executionUse the time-based job scheduler, Cron, in order to schedule system scans.
In your shell enter the command:$crontab-eAdd the following line to check the integrity of the system every fifty
minutes:*/50****pyhidsrunAfter each system check, pyHIDS sends a report to the administrators.
In the case of an attacker who has deleted the cron line, for example.LicensepyHIDSis underGPLv3license.Copyright (C) 2010-2023Cédric Bonhomme