suse/linux-security-sensor

Linux security sensor

Velociraptor - Endpoint visibility and collection tool.

Velociraptor is a tool for collecting host based state information using The Velociraptor Query Language (VQL) queries.

To learn more about Velociraptor, read the documentation on:

https://docs.velociraptor.app/

Quick start

If you want to see what Velociraptor is all about simply:

1. Download the binary from the release page for your favorite platform (Windows/Linux/MacOS).

2. Start the GUI

  $ velociraptor gui

This will bring up the GUI, Frontend and a local client. You can collect artifacts from the client (which is just running on your own machine) as normal.

Once you are ready for a full deployment, check out the various deployment options at https://docs.velociraptor.app/docs/deployment/

Training

We have our complete training course (7 sessions x 2 hours each) https://docs.velociraptor.app/training/

The course covers many aspects of Velociraptor in detail.

Running Velociraptor via Docker

To run a Velociraptor server via Docker, follow the instructions here: https://github.com/weslambert/velociraptor-docker

Running Velociraptor locally

Velociraptor is also useful as a local triage tool. You can create a self contained local collector using the GUI:

1. Start the GUI as above (velociraptor gui).

2. Select the Server Artifacts sidebar menu, then Build Collector.

3. Select and configure the artifacts you want to collect, then select the Uploaded Files tab and download your customized collector.

Building from source

To build from source, make sure you have a recent Golang installed from https://golang.org/dl/ (Currently at least Go 1.14) and the go binary is on your path. In addition make sure the GOBIN directory is also on your path (Defaults are: on linux and mac ~/go/bin, on Windows c:\\Users\\<username>\\go\\bin) :

    $ git clone https://github.com/Velocidex/velociraptor.git
    $ cd velociraptor

    # This will build the GUI elements. You will need to have node
    # installed first. For example get it from
    # https://nodejs.org/en/download/.
    $ cd gui/velociraptor/
    $ npm install

    # This will build the webpack bundle
    $ make build

    # To build a dev binary just run make.
    # NOTE: Make sure ~/go/bin is on your path -
    # this is required to find the Golang tools we need.
    $ cd ../..
    $ make

    # To build production binaries
    $ make linux
    $ make windows

Getting the latest version

We have a pretty frequent release schedule but if you see a new feature submitted that you are really interested in, we would love to have more testing prior to the official release.

We have a CI pipeline managed by GitHub actions. You can see the pipeline by clicking the actions tab on our GitHub project. There are two workflows:

1. Windows Test: this workflow builds a minimal version of the Velociraptor binary (without the GUI) and runs all the tests on it. We also test various windows support functions in this pipeline. This pipeline builds on every push in each PR.

2. Linux Build All Arches: This pipeline builds complete binaries for many supported architectures. It only runs when the PR is merged into the master branch. To download the latest binaries simply select the latest run of this pipeline, scroll down the page to the "Artifacts" section and download the Binaries.zip file (Note you need to be logged into GitHub to see this).

If you fork the project on GitHub, the pipelines will run on your own fork as well as long as you enable GitHub Actions on your fork. If you need to prepare a PR for a new feature or modify an existing feature you can use this to build your own binaries for testing on all architectures before send us the PR.

Supported platforms

Velociraptor is written in Golang and so is available for all the platforms supported by Go. This means that Windows XP and Windows server 2003 are not supported but anything after Windows 7/Vista is.

We build our releases on Centos 6 (x64) for Linux and Sierra for MacOS so earlier platforms may not be supported by our release pipeline. If you need 32 bit builds you will need to build from source. You can do this easily by forking the project on GitHub, enabling GitHub Actions in your fork and editing the Linux Build All Arches pipeline.

Artifact Exchange

Velociraptor's power comes from VQL Artifacts, that define many capabilities to collect many types of data from endpoints. Velociraptor comes with many built in Artifacts for the most common use cases. The community also maintains a large number of additional artifacts through the Artifact Exchange.

Getting help

Questions and feedback are welcome at [email protected] (or https://groups.google.com/g/velociraptor-discuss)

You can also chat with us directly on discord https://docs.velociraptor.app/discord

File issues on https://github.com/Velocidex/velociraptor

Read more about Velociraptor on our blog: https://docs.velociraptor.app/blog/

Hang out on Medium https://medium.com/velociraptor-ir

Follow us on Twitter @velocidex

linux-security-sensor's Issues

Hash function can panic with nil pointer dereference

Reproduce steps:

1. make stat() sometimes fail in newHashResultCacheEntry()

while true; do touch /tmp/test; rm /tmp/test; done

2. keep running hash() on the file

./output/velociraptor-v0.7.0-4-linux-amd64 query -v --max_wait=1 "SELECT hash(path=File.path) FROM audit(rules=['-w /tmp -p w -k testkey']) WHERE 'testkey' in Tags"

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0xc36c00]

goroutine 129 [running]:
www.velocidex.com/golang/velociraptor/vql/functions.(*unixHashResultCacheEntry).Result(0xc000260df0?)
	/root/linux-security-sensor-oct12/vql/functions/hash_cache_unix.go:38
www.velocidex.com/golang/velociraptor/vql/functions.(*HashFunction).Call(0xc00180629c?, {0x2a3da58, 0xc000e50e10}, {0x2a5f4a8, 0xc00131b5e0}, 0x10?)
	/root/linux-security-sensor-oct12/vql/functions/hash.go:305 +0xd92
www.velocidex.com/golang/vfilter.(*_SymbolRef).callFunction(0xc000c6a360, {0x2a3da58?, 0xc000e50e10}, {0x2a5f4a8?, 0xc00131b5e0}, {0x2a2e080?, 0x4438100})
	/root/linux-security-sensor-oct12/vendor/www.velocidex.com/golang/vfilter/vfilter.go:1736 +0x55c
www.velocidex.com/golang/vfilter.(*_SymbolRef).Reduce(0xc000c6a360, {0x2a3da58, 0xc000e50e10}, {0x2a5f4a8, 0xc00131b5e0})
	/root/linux-security-sensor-oct12/vendor/www.velocidex.com/golang/vfilter/vfilter.go:1590 +0x1b8
www.velocidex.com/golang/vfilter.(*_Value).Reduce(0xc0006afe00, {0x2a3da58, 0xc000e50e10}, {0x2a5f4a8, 0xc00131b5e0})
	/root/linux-security-sensor-oct12/vendor/www.velocidex.com/golang/vfilter/vfilter.go:1478 +0x13f
www.velocidex.com/golang/vfilter.(*_MemberExpression).Reduce(0xc000b48d80, {0x2a3da58, 0xc000e50e10}, {0x2a5f4a8?, 0xc00131b5e0?})
	/root/linux-security-sensor-oct12/vendor/www.velocidex.com/golang/vfilter/vfilter.go:1165 +0x50
www.velocidex.com/golang/vfilter.(*_MultiplicationExpression).Reduce(0xc000b48dc0, {0x2a3da58, 0xc000e50e10}, {0x2a5f4a8?, 0xc00131b5e0?})
	/root/linux-security-sensor-oct12/vendor/www.velocidex.com/golang/vfilter/vfilter.go:1414 +0x4d
www.velocidex.com/golang/vfilter.(*_AdditionExpression).Reduce(0xc000b48e00, {0x2a3da58, 0xc000e50e10}, {0x2a5f4a8?, 0xc00131b5e0?})
	/root/linux-security-sensor-oct12/vendor/www.velocidex.com/golang/vfilter/vfilter.go:1329 +0x4d
www.velocidex.com/golang/vfilter.(*_ConditionOperand).Reduce(0xc000b03260, {0x2a3da58, 0xc000e50e10}, {0x2a5f4a8?, 0xc00131b5e0?})
	/root/linux-security-sensor-oct12/vendor/www.velocidex.com/golang/vfilter/vfilter.go:1367 +0x6d
www.velocidex.com/golang/vfilter.(*_OrExpression).Reduce(0xc000b48e40, {0x2a3da58, 0xc000e50e10}, {0x2a5f4a8?, 0xc00131b5e0?})
	/root/linux-security-sensor-oct12/vendor/www.velocidex.com/golang/vfilter/vfilter.go:1291 +0x50
www.velocidex.com/golang/vfilter.(*_AndExpression).Reduce(0xc000b48e80, {0x2a3da58, 0xc000e50e10}, {0x2a5f4a8?, 0xc00131b5e0?})
	/root/linux-security-sensor-oct12/vendor/www.velocidex.com/golang/vfilter/vfilter.go:1259 +0x45
www.velocidex.com/golang/vfilter.(*_AliasedExpression).Reduce(0x22a6640?, {0x2a3da58?, 0xc000e50e10?}, {0x2a5f4a8?, 0xc00131b5e0?})
	/root/linux-security-sensor-oct12/vendor/www.velocidex.com/golang/vfilter/vfilter.go:705 +0x93
www.velocidex.com/golang/vfilter.(*_SelectExpression).Transform.func2({0x2a3da58, 0xc000e50e10}, {0xc0007d2918?, 0x14?})
	/root/linux-security-sensor-oct12/vendor/www.velocidex.com/golang/vfilter/vfilter.go:961 +0x55
www.velocidex.com/golang/vfilter.MaterializedLazyRow({0x2a3da58, 0xc000e50e10}, {0x2152e40?, 0xc000a06000?}, {0x2a5f4a8, 0xc00131b680})
	/root/linux-security-sensor-oct12/vendor/www.velocidex.com/golang/vfilter/lazy.go:110 +0x1cd
www.velocidex.com/golang/vfilter.(*_Select).processSingleRow(0xc000b34060, {0x2a3da58, 0xc000e50e10}, {0x2a5f4a8, 0xc0017b5a40}, {0x23bdb60, 0xc002410000}, 0xc000a51b60)
	/root/linux-security-sensor-oct12/vendor/www.velocidex.com/golang/vfilter/vfilter.go:614 +0x3c5
www.velocidex.com/golang/vfilter.(*_Select).Eval.func3()
	/root/linux-security-sensor-oct12/vendor/www.velocidex.com/golang/vfilter/vfilter.go:569 +0x179
created by www.velocidex.com/golang/vfilter.(*_Select).Eval in goroutine 128
	/root/linux-security-sensor-oct12/vendor/www.velocidex.com/golang/vfilter/vfilter.go:552 +0x2e5

cronsnoop uses log.Fatal

If any of the cron files that cronsnoop is expected to monitor is missing, it calls log.Fatal which causes the client to exit. We should log an error and continue.

Error: Unknown artifact reference Windows.Sys.Users

I'm unable to run Generic.Client.Info.

The reproducer is:

• click Hunt Manager in the menu
• click New Hunt
• click Select Artifacts, select Generic.Client.Info
• click Launch
• -> error pops up: Error: Unknown artifact reference Windows.Sys.Users

Maybe I was looking in a wrong place, but it seems that the following precondition is not evaluated correctly:
velociraptor/artifacts/definitions/Generic/Client/Info.yaml

  - name: Users
    precondition: SELECT OS From info() where OS = 'windows'
    query: |
      SELECT Name, Description, Mtime AS LastLogin
      FROM Artifact.Windows.Sys.Users()

It might be also caused by the following line in the spec file:
rm -rf artifacts/definitions/Windows

Client output (syslog) too verbose

Environment

rpm -q velociraptor-client
velociraptor-client-0.6.7.4~git63.4a1ed09d-lp153.16.1.x86_64
uname -r
5.14.21-150400.24.38-default

Steps to reproduce

• run make olddefconfig (in Linux kernel tree)
• observe output of journalctl -u velociraptor-client.service

Actual behavior

A single invocation of make olddefconfig produces ~800 log messages. Mainly pairs of:

Jun 20 13:41:46 host velociraptor[139992]: [INFO] 2023-06-20T13:41:46+02:00 File Ring Buffer: Enqueue {"header":"{\"ReadPointer\":50,\"WritePointer\":3200,\"MaxSize\":1073741874,\"AvailableBytes\":3030,\"LeasedBytes\":0}","leased_pointer":50}                              
Jun 20 13:41:46 host velociraptor[139992]: [INFO] 2023-06-20T13:41:46+02:00 read_file: /proc/76624/cmdline: lstat /proc/76624: no such file or directory

Expected behavior

Messages that may occur in great amount during short time ("amplifiers") backed by no malicious activity should not pollute the global syslog (e.g. log with lower level (or handle the underlying cause here)).

Package client service file and config in velociraptor rpm

While velociraptor-client package contains only client, velociraptor package contains both server and client functionality.
Unfortunately, the following client files are not part of the velociraptor package:

/etc/velociraptor/client.config
/usr/lib/systemd/system/velociraptor-client.service

Filter key typo in Linux.Events.NewFiles

djoreilly@eb5c0f6

Not sure where to make PR to.

sensor build fails on ppc64l and aarch64

esbuild depends on architecture. We need to either change magefile.go to call "npm ci" or install esbuild-wasm with much worse performance.

(It doesn't have priority right now, just tracking it).