{"id":2937,"date":"2010-04-19T03:22:18","date_gmt":"2010-04-19T07:22:18","guid":{"rendered":"http:\/\/g33kinfo.com\/info\/?p=2937"},"modified":"2010-04-19T03:22:18","modified_gmt":"2010-04-19T07:22:18","slug":"add-a-ninja-to-help-protect-your-server","status":"publish","type":"post","link":"https:\/\/g33kinfo.com\/info\/add-a-ninja-to-help-protect-your-server\/","title":{"rendered":"Use a ninja to help protect your server"},"content":{"rendered":"

From forkbomb.org\/ninja\/<\/a> and linuxpoison.blogspot.com<\/a><\/p>\n

DESCRIPTION
\nNinja is a privilege escalation detection and prevention system for GNU\/Linux hosts. While running, it will monitor process activity on the local host, and keep track of all processes running as root. If a process is spawned with UID or GID zero (root), ninja will log necessary information about this process, and optionally kill the process if it was spawned by an unauthorized user.<\/p>\n

A “magic” group can be specified, allowing members of this group to run any setuid\/setgid root executable.<\/p>\n

Individual executables can be whitelisted. Ninja uses a fine grained whitelist that lets you whitelist executables on a group and\/or user basis. This can be used to allow specific groups or individual users access to setuid\/setgid root programs, such as su(1) and passwd(1).<\/p>\n

EXTERNAL RESOURCES
\nHow to Ninja<\/a> and How to Ninja – Ubuntu 10.04<\/a> by bodhi.zazen<\/p>\n

MAN PAGE
\nRead the online man page here<\/a>.<\/p>\n

CURRENT VERSION
\n0.1.3 – ChangeLog<\/a><\/p>\n

DOWNLOAD
\nSource repository<\/a><\/p>\n

LICENSE
\nNinja is released under the General Public License (GPL) version 2 or higher<\/p>\n

INSTALL:
\nDownload ninja from – here
\nUntar the source, goto the ninja directory and type following command to compile and install the ninja:
\n
\n make
\n make install
\n<\/code>
\ncopy the white-list file to the \/etc\/ninja directory
\n
\n cp examples\/whitelist\/simple.wlist \/etc\/ninja\/
\n<\/code>
\nConfiguration:
\nAdd group “ninja” (note down the group id):
\n
\n groupadd ninja
\n<\/code>
\nAdd user ‘root’ and all other required users to this group:
\n
\n usermod -G ninja nikesh
\n usermod -G ninja root
\n<\/code>
\nCreate the ninja log files:
\n
\n touch \/var\/log\/ninja.log
\n<\/code>
\nOpen the ninja configuration file:
\n
\nvi \/etc\/ninja\/default.conf
\n<\/code>
\nand change the following settings
\n
\n group=1000
\n daemon = yes
\n interval = 0
\n logfile = \/var\/log\/ninja.log
\n whitelist = \/etc\/ninja\/simple.wlist
\n external_command = \/root\/bin\/alert
\n<\/code>
\nHere you also need to create a simple script alert (\/root\/bin\/alert) with following entries
\n
\n#!\/bin\/bash
\necho 'Alert - Unauthorized Access to system.' | mail -s \"'Alert - Unauthorized Access to system.\" njauhari@cybage.com
\n<\/code>
\nEdit the whitelist file located under the
\n
\n\/etc\/ninja\/simple.wlist<\/code><\/p>\n

The first field is the full path to the executable you wish to white-list. The second field is a comma separated list of groups that should be granted access to the executable. The third field is a comma separated list of users.<\/p>\n

:: <\/p>\n

The second or third field can be left empty. Please refer to the example whitlist located in “examples\/whitelist\/”.<\/p>\n

Remember that it is a good idea to whitelist programs such as passwd and other regular setuid applications that users require access to.<\/p>\n

Finally start ninja using following command:
\n
\n \/usr\/local\/bin\/ninja \/etc\/ninja\/default.conf
\n<\/code><\/p>\n

Testing Ninja:
\nCreate a test user ‘test’
\nLogin to the system using this test user
\nnow attempt to become ‘root’ user by typing command ‘su – ‘
\nHere ninja will come into action and will kill the entire session and dump the information into the log
\n<\/users><\/groups><\/executable><\/p>\n","protected":false},"excerpt":{"rendered":"

From forkbomb.org\/ninja\/ and linuxpoison.blogspot.com DESCRIPTION Ninja is a privilege escalation detection and prevention system for GNU\/Linux hosts. While running, it will monitor process activity on the local host, and keep track of all processes running as root. If a process is spawned with UID or GID zero (root), ninja will log necessary information about this… <\/p>\n

Read More<\/i><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-2937","post","type-post","status-publish","format-standard","hentry","category-info"],"yoast_head":"\nUse a ninja to help protect your server - Linux Shtuff<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/g33kinfo.com\/info\/add-a-ninja-to-help-protect-your-server\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Use a ninja to help protect your server - Linux Shtuff\" \/>\n<meta property=\"og:description\" content=\"From forkbomb.org\/ninja\/ and linuxpoison.blogspot.com DESCRIPTION Ninja is a privilege escalation detection and prevention system for GNU\/Linux hosts. While running, it will monitor process activity on the local host, and keep track of all processes running as root. If a process is spawned with UID or GID zero (root), ninja will log necessary information about this... Read More\" \/>\n<meta property=\"og:url\" content=\"https:\/\/g33kinfo.com\/info\/add-a-ninja-to-help-protect-your-server\/\" \/>\n<meta property=\"og:site_name\" content=\"Linux Shtuff\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/fb.me\/g33kinf0\" \/>\n<meta property=\"article:author\" content=\"https:\/\/fb.me\/g33kinf0\" \/>\n<meta property=\"article:published_time\" content=\"2010-04-19T07:22:18+00:00\" \/>\n<meta name=\"author\" content=\"g33kadmin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@https:\/\/twitter.com\/drsinger1111\" \/>\n<meta name=\"twitter:site\" content=\"@drsinger1111\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/add-a-ninja-to-help-protect-your-server\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/add-a-ninja-to-help-protect-your-server\\\/\"},\"author\":{\"name\":\"g33kadmin\",\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/#\\\/schema\\\/person\\\/c022e4c40b13ea1b678e6f020756f547\"},\"headline\":\"Use a ninja to help protect your server\",\"datePublished\":\"2010-04-19T07:22:18+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/add-a-ninja-to-help-protect-your-server\\\/\"},\"wordCount\":412,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/#\\\/schema\\\/person\\\/c022e4c40b13ea1b678e6f020756f547\"},\"articleSection\":[\"General Info\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/g33kinfo.com\\\/info\\\/add-a-ninja-to-help-protect-your-server\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/add-a-ninja-to-help-protect-your-server\\\/\",\"url\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/add-a-ninja-to-help-protect-your-server\\\/\",\"name\":\"Use a ninja to help protect your server - Linux Shtuff\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/#website\"},\"datePublished\":\"2010-04-19T07:22:18+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/add-a-ninja-to-help-protect-your-server\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/g33kinfo.com\\\/info\\\/add-a-ninja-to-help-protect-your-server\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/add-a-ninja-to-help-protect-your-server\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Use a ninja to help protect your server\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/#website\",\"url\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/\",\"name\":\"Linux Shtuff\",\"description\":\"Because I have CRS Syndrome...\",\"publisher\":{\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/#\\\/schema\\\/person\\\/c022e4c40b13ea1b678e6f020756f547\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/#\\\/schema\\\/person\\\/c022e4c40b13ea1b678e6f020756f547\",\"name\":\"g33kadmin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/wp-content\\\/uploads\\\/2022\\\/07\\\/minion-researchA.gif\",\"url\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/wp-content\\\/uploads\\\/2022\\\/07\\\/minion-researchA.gif\",\"contentUrl\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/wp-content\\\/uploads\\\/2022\\\/07\\\/minion-researchA.gif\",\"width\":512,\"height\":512,\"caption\":\"g33kadmin\"},\"logo\":{\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/wp-content\\\/uploads\\\/2022\\\/07\\\/minion-researchA.gif\"},\"description\":\"I am a g33k, Linux blogger, developer, student and Tech Writer for Liquidweb.com\\\/kb. My passion for all things tech drives my hunt for all the coolz. I often need a vacation after I get back from vacation....\",\"sameAs\":[\"https:\\\/\\\/thelinuxreport.com\",\"https:\\\/\\\/fb.me\\\/g33kinf0\",\"https:\\\/\\\/x.com\\\/https:\\\/\\\/twitter.com\\\/drsinger1111\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Use a ninja to help protect your server - Linux Shtuff","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/g33kinfo.com\/info\/add-a-ninja-to-help-protect-your-server\/","og_locale":"en_US","og_type":"article","og_title":"Use a ninja to help protect your server - Linux Shtuff","og_description":"From forkbomb.org\/ninja\/ and linuxpoison.blogspot.com DESCRIPTION Ninja is a privilege escalation detection and prevention system for GNU\/Linux hosts. While running, it will monitor process activity on the local host, and keep track of all processes running as root. If a process is spawned with UID or GID zero (root), ninja will log necessary information about this... Read More","og_url":"https:\/\/g33kinfo.com\/info\/add-a-ninja-to-help-protect-your-server\/","og_site_name":"Linux Shtuff","article_publisher":"https:\/\/fb.me\/g33kinf0","article_author":"https:\/\/fb.me\/g33kinf0","article_published_time":"2010-04-19T07:22:18+00:00","author":"g33kadmin","twitter_card":"summary_large_image","twitter_creator":"@https:\/\/twitter.com\/drsinger1111","twitter_site":"@drsinger1111","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/g33kinfo.com\/info\/add-a-ninja-to-help-protect-your-server\/#article","isPartOf":{"@id":"https:\/\/g33kinfo.com\/info\/add-a-ninja-to-help-protect-your-server\/"},"author":{"name":"g33kadmin","@id":"https:\/\/g33kinfo.com\/info\/#\/schema\/person\/c022e4c40b13ea1b678e6f020756f547"},"headline":"Use a ninja to help protect your server","datePublished":"2010-04-19T07:22:18+00:00","mainEntityOfPage":{"@id":"https:\/\/g33kinfo.com\/info\/add-a-ninja-to-help-protect-your-server\/"},"wordCount":412,"commentCount":0,"publisher":{"@id":"https:\/\/g33kinfo.com\/info\/#\/schema\/person\/c022e4c40b13ea1b678e6f020756f547"},"articleSection":["General Info"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/g33kinfo.com\/info\/add-a-ninja-to-help-protect-your-server\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/g33kinfo.com\/info\/add-a-ninja-to-help-protect-your-server\/","url":"https:\/\/g33kinfo.com\/info\/add-a-ninja-to-help-protect-your-server\/","name":"Use a ninja to help protect your server - Linux Shtuff","isPartOf":{"@id":"https:\/\/g33kinfo.com\/info\/#website"},"datePublished":"2010-04-19T07:22:18+00:00","breadcrumb":{"@id":"https:\/\/g33kinfo.com\/info\/add-a-ninja-to-help-protect-your-server\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/g33kinfo.com\/info\/add-a-ninja-to-help-protect-your-server\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/g33kinfo.com\/info\/add-a-ninja-to-help-protect-your-server\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/g33kinfo.com\/info\/"},{"@type":"ListItem","position":2,"name":"Use a ninja to help protect your server"}]},{"@type":"WebSite","@id":"https:\/\/g33kinfo.com\/info\/#website","url":"https:\/\/g33kinfo.com\/info\/","name":"Linux Shtuff","description":"Because I have CRS Syndrome...","publisher":{"@id":"https:\/\/g33kinfo.com\/info\/#\/schema\/person\/c022e4c40b13ea1b678e6f020756f547"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/g33kinfo.com\/info\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/g33kinfo.com\/info\/#\/schema\/person\/c022e4c40b13ea1b678e6f020756f547","name":"g33kadmin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/g33kinfo.com\/info\/wp-content\/uploads\/2022\/07\/minion-researchA.gif","url":"https:\/\/g33kinfo.com\/info\/wp-content\/uploads\/2022\/07\/minion-researchA.gif","contentUrl":"https:\/\/g33kinfo.com\/info\/wp-content\/uploads\/2022\/07\/minion-researchA.gif","width":512,"height":512,"caption":"g33kadmin"},"logo":{"@id":"https:\/\/g33kinfo.com\/info\/wp-content\/uploads\/2022\/07\/minion-researchA.gif"},"description":"I am a g33k, Linux blogger, developer, student and Tech Writer for Liquidweb.com\/kb. My passion for all things tech drives my hunt for all the coolz. I often need a vacation after I get back from vacation....","sameAs":["https:\/\/thelinuxreport.com","https:\/\/fb.me\/g33kinf0","https:\/\/x.com\/https:\/\/twitter.com\/drsinger1111"]}]}},"_links":{"self":[{"href":"https:\/\/g33kinfo.com\/info\/wp-json\/wp\/v2\/posts\/2937","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/g33kinfo.com\/info\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/g33kinfo.com\/info\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/g33kinfo.com\/info\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/g33kinfo.com\/info\/wp-json\/wp\/v2\/comments?post=2937"}],"version-history":[{"count":0,"href":"https:\/\/g33kinfo.com\/info\/wp-json\/wp\/v2\/posts\/2937\/revisions"}],"wp:attachment":[{"href":"https:\/\/g33kinfo.com\/info\/wp-json\/wp\/v2\/media?parent=2937"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/g33kinfo.com\/info\/wp-json\/wp\/v2\/categories?post=2937"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/g33kinfo.com\/info\/wp-json\/wp\/v2\/tags?post=2937"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}