HummingBird Users Manual
1 Introduction and Intended Audience
1.1 Project Overview
The HummingBird System developed for Dr. Deborah Frincke is an Intrusion
Detection System for large networks. The System collects activity logs
from local systems and forwards them to managing systems. In this way a
single system administrator could collect misused data about a large network
of computers. The project seeks to augment the current system, in order
to allow for a peer-to-peer management system, an auto-configuration system,
and improve build and control devices from the web page.
The peer management system designed will allow HummingBird Managers
to communicate across the web. Currently, this does not happen. Managers
may only communicate with subordinates within a given network. The new
system will allow managers to communicate with other managers and make
decisions based on information gathered from other peers across the network.
The configuration system will be web based and allow a manager to configure
its subordinates automatically.
1.2 Product User Characteristics*
The HummingBird User Manual defines its users as:
1. HummingBird Development Team
member of or contributor to the HummingBird project. Has complete
knowledge of HummingBird.
Skills list as follows:
-
Perl
-
HTML
-
Advanced UNIX
-
C++
2. System Administrators
Knowledgeable user with experience in networks, programming, system
tools, and use all the features of HummingBird, as well as develop new
extensions to Hummingbird.
Skills list as follows:
-
HummingBird
-
Intermediate UNIX
-
Web Browser
3. Site Security Officers
HummingBird End-User only need is administrative data on security
status.
Skills list as follows:
2 Limitations of Use
This product requires that the user have a level of understanding of their
computer system and network at the level of a system administrator. The
Hummingbird system requires data to be passed into in from a system of
data gathering tools. A limited set of tools will be included with the
Hummingbird system. Some computer systems and some administrators will
wish to monitor information these tools do not. Monitoring additional data
will require writing additional tools that work with the Hummers.*
In addition, the current system only works on UNIX based architecture,
although a HummingBird system is currently being developed for the Windows
NT operating system at Washington State University.
3 Installation Guide
The installation is best described in the "INSTALL" file, which comes with
the HummingBird source code.
3.1 The Contents of the "INSTALL" File
This section describes how to install the HummingBird System (hummer).
HummingBird is an Intrusion Detection System for large networks. The System
collects activity logs from local systems and forwards them to managing
systems. In this way a single system administrator could collect misuse
data about a large network of computers.
3.1.1 INSTALLATION
For most machines and configurations, the following is all you need.
./configure
gmake
gmake install
./makedb
The gmake install command will prompt for a password about halfway through
the installation. This password is the password for the hummer account
on the Configuration Web Server.
You should also edit /etc/rc.local or equivalent to start hummer at
boot.
The source is written in GNU C++, Perl, and Java, and requires an ANSI
C compiler or GCC, and the JDK 1.1. A copy of GCC is available on all major
FTP sites (e.g., in ftp://prep.ai.mit.edu/pub/gnu).
A copy of Perl is available at http://language.perl.com/CPAN/src/latest.tar.gz.
A copy of JDK 1.1 is available at http://java.sun.com/products/jdk/1.1/index.html.
Further requirements for Hummingbird are PostgreSQL SQL database system
available at ftp://ftp.postgresql.org/pub/postgresql-6.3.1.tar.gz;
HummingBird uses the C++ (libpq++.h) and Perl (Pg.pm) language interfaces
to PostgreSQL. These interfaces are not installed by default with PostgreSQL.
CGI.pm Perl library for CGI programs available at http://www.genome.wi.mit.edu/ftp/pub/software/WWW/;
GD.pm Perl library for creating GIF images available at http://www.genome.wi.mit.edu/ftp/distribution/software/WWW/GD.html.
Follow the installation instructions for these packages before beginning
installation of HummingBird.
3.1.2 CONFIGURATION OPTIONS
The package comes with an autoconf-generated configure script. The script
accepts several options
All standard options, including:
--prefix=PREFIX where to install files (default: subdirs of $HOME/hum)
--exec_prefix=PREFIX where to install executables (default: same as prefix)
--srcdir=DIR find sources in DIR (default: where configure is)
Specific options:
--with-postgres=[POSTGRES_PREFIX] Directory containing PostgreSQL (/usr/local/pgsql default)
--with-kerberos5=[KRB_PREFIX] Compile in Kerberos5 support.
You may also want to configure the following variables:
CC=compiler specify name of the C compiler (default: gcc or cc)
CFLAGS=flags specify flags to C compiler (default: -O -g or just -O)
LDFLAGS=flags specify flags to linker (default: none)
Alternate values can be given to configure in the environment, e.g.:
CC=xcc CFLAGS="-O2" LDFLAGS="-L/lib/zzz" ./configure
(Note that if you have already configured, and later decide to give some
values on the command line, you may need to say "make distclean" before
reconfiguring.)
3.1.3 MAKEFILE
The Makefile is generated from Makefile.in by running configure. It
supports the following targets:
all: compile everything
install: install in $exec_prefix/bin and $prefix/man/man1.
clean: remove object files and executables
distclean: remove anything not in the distribution
3.1.4 PORTABILITY
This software has been used at least in the following environments.
FreeBSD 2.x; Pentium
HPUX 10.x; HPPA
Linux 1.2.x, 2.0.x Slackware 2.x, 3.x, RedHat 2.1, 3.0; i486, Sparc
Solaris 2.3, 2.4, 2.5, 2.5.1; Sparc, i386
Please report back any other environments where you have used HummingBird,
and send back any patches you had to do so that they can be integrated
to the distribution. The proper address is hummer@cs.uidaho.edu. Always
remember to mention the hummer version number and machine type in your
bug reports.
3.1.5 STARTING HUMMINGBIRD
The hummer should be started with the "starthum" shell script. You can
optionally run the Java Console Interface first.
cd $HOME/hum/bin
./Interface &
./starthum
In a few moments the starthum command will return and the HummingBird
System should start collectin logs.
3.1.6 MODIFYING THE RUNNING HUMMER
To select which data is loged or displayed connect to the host's configuration
web server.
http://localhost:15000/
Follow the Help and HTML forms with your web browser to change the settings.
3.1.7 USING HBVT
HummingBird Visualization Tool is a new addition to HummingBird that
displays the text logs as graphic images. HBVT is extenable for any sort
of log in the database. To use the packaged visualizations connect to the
HBVT web server.
http://localhost:15000/
Select the link at the bottom of the page labeled "HummeringBird Visualization
Tool".
3.1.8 REPORTING PROBLEMS AND OTHER CONTACTS
Please report any bugs, problems, and enhancements to hummer@cs.uidaho.edu.
The WWW home page for hummer is http://www.cs.uidaho.edu/~hummer/.
4 Operational Walk-Through*
4.1 User Interface Concepts
The HummingBird user interface is a web page like the one
below.
The interface has the usual clicking done everywhere else
on the web, along with some text boxes, radio buttons, and normal buttons
here and there, as shown in the image to the left. Also pictured here is
a selection box in which the user picks from a list of choices selected
from the list. In this case, once a desired configuration is made, the
user clicks on the "configure" button.
-
4.2 Usage Scenarios
4.2.1 Scenerio 1: Manager-Subordinate Relations
clicking on "Manager/Subordinate Relations" from the main
menu shown in section 4.1, the user is allowed to configure manager subordinate
relationships. This includes adding, removing and changing a manager, and
adding, removing and configuring a subordinate. The Manager/Subordinate
Configuration interface looks like this:

-
Help
-
By clicking on the "Help" link just below the title, the
user will be taken to a helpful screen describing the functionality and
methodology of this page.
-
My Manager
-
Configure My Manager
-
This option assumes that you have a manager.
It allows you to connect to your manager's Hummer menu (depicted in section
4.1) assuming that you know the password and username, and make all and
any changes to the manager's configuration that you wish. To add
a manager to your Hummer, click on "Change My Manager" and add.
-
Change My Manager
-

-
This option will allow you to change the current manager.
1.Click on Change My Manager.
2.You will go to a screen with a prompt for a new manager.
3.Enter a new manager (this can be done in IP or name
format.)
4.Press the Change button when done.
5.A confirmation or error screen will display.
-
Delete My Manager
-
This option will allow you to delete your current manager.
If you do not have a current manager, you will receive an error.
If you do, a message will display notifying you that your manager is no
longer your manager.
-
My Subordinates
-
Configure Selected Subordinate
-
This option will allow you to configure a subordinate.
1.Choose a subordinate from the pull-down subordinate
list.
2.Click on this option.
3.Press the Configure button to go to the Main Configuration
page for the specified subordinate.
-
Remove Selected Subordinate
-
This option will allow you to remove a subordinate.
1.Choose a subordinate from the pull-down subordinate
list.
2.Click on this option.
3.Press the Configure button.
4.A confirmation or error screen will display.
-
Add a New Subordinate
-

-
This option will allow you to add subordinates (with you
as the manager).
1.Click on Add a New Subordinate.
2.You will go to a screen with a prompt for a new subordinate.
3.Enter a new subordinate (this can be done in IP or
name format.)
4.Press the Change button when done.
5.A confirmation or error screen will display.
4.2.2 Scenerio 2: Hummer Levels / Kill Files
By clicking on "Hummer Levels / Kill Files" from the main
menu shown in section 4.1, the user is allowed to make all configurations
for a Hummer wishing to change inherited and local levels of itself and
other hummers. Specifically, these levels deal with integrity, cooperation,
and trust. In addition, this interface allows for the development of "kill"
files, where you may specify certain Hummers or messages to ignore.

-
Help
-
By clicking on the "Help" link just below the title, the
user will be taken to a helpful screen describing the functionality and
methodology of this page.
-
Trust, Integrities, and Cooperation Levels
-

-
Both the Local Levels and Inherited Levels interface look
like the one above.
-
Use the help link at the top for help on using the page
-
Select a Hummer from the pulldown list
-
Use the radio buttons to either remove the selected Hummer
as a subordinate or change the selected Hummer's level settings, 1 being
the lowest and 5 being the highest.
-
Trust Level describes how much you trust the selected Hummer.
-
Cooperation Level describes how much you wish to cooperate
with the selected Hummer.
-
Integrity Level describes how accurate you think that the
data the selected Hummer is sending you, is.
-
Add a new Hummer and Levels
-

-
This screen allows you to add a new Hummer to your database,
and is accessed when you click Add a New Hummer and Levels from the Levels
and Killfiles interface.
-
Enter in a Hummer at the prompt (name or IP will work), and
set up trust cooperation and integrity levels.
-
Local Vs. Inherited Levels
-
Local Levels
-
This allows you to modify all of the trust, integrity, and
cooperation levels of Hummers to which you may pass these levels.
-
Modify Inherited Trusts, Integrities, and Cooperation
Levels
-
This allows you to modify all of the trust, integrity, and
cooperation levels of Hummers to which you have inherited them from.
-
Kill Files for Other Hummers
-

-
Both the Local and Inherited Kill File Interfaces look like
the one above.
-
Use the help link to get help information about this page.
-
To add a new Hummer to the kill file, click on the Add a
New Kill File Hummer link. The interface to add the Hummer is exactly
like the "add a new subordinate" interface in section 4.2.1, Scenerio 1.
-
To Remove a Hummer that already exists in your kill file,
select it from the pulldown menu labeled Hosts and click on the Remove
Button.
-
Local Vs. Inherited Kill File
-
Modify Local Kill File
-
This allows you to ignore certain Hummers (or un-ignore)
to which you may pass to other subordinate Hummers.
-
Modify Inherited Kill File
This allows you to ignore certain Hummers (or un-ignore)
to which you may change the kill files you have inherited.
-
Reread and Push Configuration to Subordinates
-
Push this button to make the changes final, and push the
settings to your subordinates.
4.2.3 Scenerio 3: Incoming Message Filters
By clicking on "Incoming Message Filters" from the main menu
shown in section 4.1, the user is allowed to create, edit, and remove filters
within the filter database. Filters determine what messages you will
receive.

-
Help
-
By clicking on the "Help" link just below the title, the
user will be taken to a helpful screen describing the functionality and
methodology of this page.
-
Modify Local/Inherited Message Filters
-

-
Use the help link to view information about this page
-
Select an expression from the pull down list
-
If you would like to modify the expression, click on the
appropriate button; and the same goes for removing the selected expression.
-
Modify Selected Expression + Configure
-

-
Use the help link to display help with this screen.
-
Filters
-
In the field provided, modify the filter if you choose.
-
Use the Date and Time fields to configure the date and times
that you want your filters active
-
Use the pull down lists for Trust, Cooperation, and Integrity
levels for the incoming message filter, 0 being the lowest and 5 being
the highest
-
Use the "Messages accepted from" field to explicitely declare
who you would like to receive messages from.
-
Actions and Alerts
-
If you want the filter to be logged to the console or locally,
click on the appropriate buttons
-
If you want to forward the message to other Hummers, specify
them explicitely in the "Forward...to the Hummers" box.
-
If you want to forward the message to other Hummers in a
peer group, specify them explicitely in the "Forward...to the Peer Groups"
box.
-
Click on Configure to make the changes permanent.
-
Add a New Expression
-
The interface is exactly like the interface above for modifying
an expression, only in the end you add a new expression.
-
Reread and Push Configuration to Subordinates
-
Push this button to make the changes final, and push the
settings to your subordinates.
4.2.4 Scenerio 4: Configure Peer Groups
By clicking on "Configure Peer Groups" from the main menu
shown in section 4.1, the user is allowed to make all configurations for
a Hummer wishing to be a peer moderator or a Hummer wishing to configure
its status, other's status, and to deal with all messaging within a peer
group.

-
Help
-
By clicking on the "Help" link just below the title, the
user will be taken to a helpful screen describing the functionality and
methodology of this page.
-
Peer Tasks
-
Peer Interface
-

-
This option will take you to the peer interface, where you
can create and send action and data messages to other peers in any group
for which you are subscribed.
-
Current Peer Group Is tells you which peer group you are currently viewing. Use the pulldown list to select a peer group with which you wish to interact.
-
Peer Group Status tells you all about the peer group to which you are currently subscribed. Specifically, it lists each member of the peer group, whether or not they moderate the group, and whether or not they are actually subscribed to the group.
-
Level Status tells you about what levels each group member have been assigned to you. When you subscribe, all group members are added to the levels database with default level values set to 1. All group member added to the group by the moderatory after your subscription must be explicitely added to the database.
-
Send Hummer Message To uses a pulldown list to allow you to specify who you would like to send a Hummer message to. The message can be entered in the box directly below. Click on "Send Message" to send the message to all specified Hummers in the group.
-
Subscribe to a Peer Group
-

-
This option allows you to subscribe to a peer group. In order
to subscribe, the peer group moderator must already have you in their database
(See "Create a Peer Group" below). Enter in the name of the peer group to which you wish to subscribe in the space provided; Enter in the host name or IP address of the moderator of the peer group. Click on subscribe to make it final.
-
Unsubscribe from a Peer Group
-

-
This option allows you to unsubscribe from a peer group in
which you have already subscribed. Use the pulldown list to select a peer group to which you are currently subscribed and to which you ARE NOT the moderator (to remove yourself as the moderator of a group, use "Edit a Peer Group" from the main peer interface) and click on Unsubscribe to finalize it.
-
Moderator Tasks
-
Create a Peer Group
-

-
This option takes you to an interface where you will
be allowed to create a peer group and add as many "peers" to it as you
would like. Don't forget, you may add as many peers as you like, but peers
must "subscribe" in order for them to actually be interactive within a
peer group.
- Choose a Peer Group Name allows you to enter in an arbitrary name where you may specify what you would like your peer group to be called.
- Enter The Contact Email Address is the field where you are to enter in the name of the email address where all "peer group pertinent" mail should be sent. All members of the peer group will use this email address to contact the moderator by mail.
- Enter the Hummers to be added to the above group in the box below is where you should add all of the peers that you would like to be in your peer group. Use a carriage return or whitespace as a delimiter.
-
Edit a Peer Group
-

-
This option allows you to add peers to or remove peers from
any of the peer groups which you moderate. It also allows you to remove yourself as the peer moderator.
- Current Peer Group Is uses a pulldown list for you to select which peer group you would like to edit. Note that only peer groups which you MODERATE are in this list.
- Peer Group Status lists who is currently subscribed and not subscribed in your peer group. It also lists you as the moderator for every group selected on this page.
- Add a Hummer to the Peer Group allows you to add a Hummer to the peer group. You do this by simply entering in the name of the Hummer you wish to add to the group, or its IP address.
- Remove a Hummer from the Peer Group allows you to remove any Hummer from the Peer Group. Use the pulldown list to select any Hummer in the group which you would like to remove.
-
Peer Group Moderation Interface
-

-
This page is mostly established as a framework for peer moderation tasks to come in the future development of Hummingbird. Here, you may set values pertinent to peer moderation. For
example, you may set communication frequencies for all of the groups which
you moderate. This value indicates the frequency with which the Peer Moderator actually updates peer group members with group information.
4.2.4 Scenerio 4: HummingBird Visualization Tool
See http://www.cs.uidaho.edu/~hummer/hbvt for detailed information
about this portion of the program.
5 Related Documentation
-
Further reference for HBVT is given is the initial proposal
letter [Marconi, 1997d].
-
Details of the HummingBird System as of May 1997 are in [Coltrin
et al., 1997].
-
The most recent and complete text on HummingBird is given
in [Frincke et al., 1997].
-
A plan for completing this software project is in [Marconi,
1997a].
-
A Software Requirements Review Presentation was given on
September 24, 1997 slides are available [Marconi, 1997b].
-
A Software Requirements Specification was produced [Marconi,
1997c].
6 Error Messages
6.1 Peer Group Error Messages
6.1.1 Unsuccessful Peer Group Subscription
This will occur when either the name of the peer group or the Moderator's IP address (or hostname) was entered incorrectly. To correct this error, check with the Moderator and make sure that the group is still being Moderated at the host specified. Also check for proper spelling and cases (the interface is case sensitive). If there is still a problem, check to make sure that PeerServ is up and running with the rest of your Hummingbird tools and that the Moderator's server, PeerServ, is up and running as well.
6.1.2 Can't Subscribe to or Create a group with the same name as a group you are already subscribed to
This error message is self explanatory. To resolve this issue, either unsubscribe yourself to the group with the desired name, or convince the Moderator to change the name of the peer group of which you wish to subscribe.
6.1.3 Invalid Hummer Name
When trying to add a Hummer to an existing peer group, the hostname or IP address must be valid. If it is not, you will not be permitted to add the (invalid) Hummer to the group.
7 System Maintenance Considerations (e.g., backups)
It is advised, at this point, to restart PostgreSQL on a daily basis. There seems to have been a lot of problems with the system forking many children without cleaning them up and the result is a system crash. In addition, it is advised to backup the database and log files nightly just to be safe.
8 Appendices of Related Materials and Definition
*Selected items marked with a "*" were taken directly from the user manual
from Team A in Spring of 1997 for CS481 at the University of Idaho, at:
http://www.cs.uidaho.edu/~hummer/hum-A-html/.