FIM File Integrity Monitoring in Rust
Description
FIM is a File Integrity Monitoring tool that tracks any event over your files. It is capable of keeping historical data of your files. It checks the filesystem changes in the background.
FIM is the fastest alternative to other software like Ossec, which performs file integrity monitoring. It could integrate with other security tools. The produced data can be ingested and analyzed with tools like ElasticSearch/OpenSearch. It has developed with Rust, a popular programming language.
Goals
Solve as many issues as possible. We will try to include Audit data in Windows environments as the first target. Improve the code style, refactor if needed and improve testing cases. We invite all that wants to learn or code in rust to collaborate with a PR. We will be glad to help!
Resources
- Repository: https://github.com/Achiefs/fim
- Issue list: https://github.com/Achiefs/fim/issues
- Documentation about the project: https://documentation.achiefs.com
- The Rust programming language book: https://doc.rust-lang.org/stable/book/
Looking for hackers with the skills:
Nothing? Add some keywords!
This project is part of:
Hack Week 24
Activity
Comments
-
21 days ago by josefernandez | Reply
Sorry for not update this quite often. I will add comments for the past days and which progress I made.
-
21 days ago by josefernandez | Reply
Day 1: I started with macOS infrastructure, I have one old mac mini Late 2012 (The upgradable one) with macOS High Sierra that builds packages of FIM (pkg).
This host was quite uncomfortable to work with, pretty old system, no easy way to install new software to edit files or code smaller disk...
Then I proposed to give it a new way to serve to the FIM project, I disassembly it I started to change the HDD to a new SSD and reinstalling the system. Some problems occur during this procedure and my low knowledge level of macOS. My mac mini doesn't support any newer than Catalina and I want to install Ventura.
At this point the only choice I have is to run the old HDD again and do a little of research. I discovered OpenCore tool that enables old macs to run newer software so I prepare this one to run Ventura, swap the disc again and it works!
Then, I had a new mac mini to research install vscode and other tools for development, quite good!
PD: Sorry for not having any pictures it would be cool one of the mac mini disassembled but I was struggling how to make it works at such moment.
PD2: I made a screenshot of the last result Link (You must be part of SUSE org in Drive)
-
21 days ago by josefernandez | Reply
Day 2: Continuing with the mac mini series, I wanted to maintain the version compatibility of FIM application to High Sierra, it's time to play with virtualization, easy right? nope.
I started with VMWare Fusion that is free for personal use but I'm not totally sure that Open Source project was personal use (Anyway, I tried this option) The app installs good the machine started good and I'm happily installing macOS High Sierra on a VM, Happy until the next reboot...
All seems to work good tuning the machine preparing all the stuff and it is working (Bad for me to disable secure computing at VMWare).
Not enough with this VM working I wanted to check UTM, that is OpenSource and free for use. I tried several combinations and provided High Sierra configuration without success the host lock at some points and the performance was terrible, after a few hours trying to make it work I gave up this method (For now).
Jumping to VMWare, starting the host and boom, macOS kernel panic, what the hell happened? The machine works some hours ago without any change. Today, is a mystery not resolved. In any case, I was forced to create a new VM install macOS HS tune up and do all the stuff again, this time not disabling secure computing and it seems to work.
At this point we are ready to connect to the mac mini, code in Ventura with the latest tools and features, compile and build packages in High Sierra at the same time, it's kind of cool!
A proof of this goal is in this Link
PD: UTM isn't over, at the first day screenshot you saw that my mac mini has 8GB of RAM but this will change soon, I ordered 16 GB of RAM for this little beast and the second round will start when they arrive (At December).
PD2: I had another headache searching for a good model of RAM mac mini compatible, after a few hours I take the Crucial ones that the manufacturer said it is compatible. I pray to good...
-
20 days ago by josefernandez | Reply
Day 3: Well the first coding day. Sadly, after all the previous days of work I did not start coding on something related to macOS but, the environment is ready for future code, yay!
I returned to an old branch that I was coding about Windows Auditing and EventLog, this feature is quite cool and it needs a bump in the development so I started to review the old code so cool task to do.
After review all the legacy and not working code, cleaning and tidy up I started o a freshly base to include SACL modification on Windows. If you don't know what is SACL simplifying is a System Access Control List so smart naming :D The section that report Audit information for files is done or at least I remember that from the last coding days of this branch so I jumped to SACL definition (A requirement to Audit information to be gathered).
I have to say that I am pretty new to all Windows coding libraries and ecosystem but at least Microsoft produce a Rust library to interact with the core of Windows this library is as low level as possible I guess because it uses pointers (Widely not recommended under Rust ecosystem) but as far as I know is the only way to proceed to use Windows crate.
I started with getSecurityInfo method to obtain security information of a file/object this function gave me a lot of headache because at this coding point I don't understand how Windows functions and pointer in Rust integrates and work each other.
Finally, after the whole day I figured out how to work with Rust pointers and manage weird type conversions like
*mut c_voidto a*mut ACLI guess this is the perfect way to store structs...And this is it, I share here a commit to the GetSecurityInfo code, please be kind is currently in pre-alpha-not-cleaned version. Commit lines
-
20 days ago by josefernandez | Reply
Day 4 and 5: Thank you for all that reached this point of my little trip I will try to give a happy end to the story.
This two days I was learning more and more knowledge about how Windows crate works, I tried some additional functions to create a new SACL like SetSecurityInfo plus AddAuditObjectAce and some additional required steps before setting ACL info with the function AdjustTokenPrivileges.
After all this I managed to include a way to add my requirements to the code. Sadly, the user has some needs and it needs to maintain his current SACLs intact. Yes, this point is where I'm stuck currently. I discovered two methods to accomplish nearly the same, SetEntriesInAclW and the rusty old one to read all Aces, create a new SACL include all Aces and push this ACL to the object. At least I have two options -sigh-.
I tried any of combinations, pointers, selectors and types with SetEntriesInAclW but none of them works. This method return 87 if any of the parameters are wrong and it has three parameters and three of them are... pointers... anyway I don't want to discourage you to learn Rust or Windows I'm just telling my way to fight this world!
I encourage you all to learn something new (like Rust) and expand your knowledge and developments around the world! and if you like Rust maybe you could help me with this or another issue :D
See you and have a great day!
Similar Projects
This project is one of its kind!