Syscheck monitoring of /var/lib/tor/services/

[emkll]

Status

Ready for review

Description of Changes

Fixes #2960:
Modify ossec-agent configuration to monitor /var/lib/tor/services/ directory.

Testing

• make build-debs
• vagrant up /staging/
• vagrant ssh mon-staging
• /var/ossec/queue/syscheck/\(app-staging\)\ 10.0.1.2-\>syscheck should contain hashes all files and folders in /var/lib/tor/services and monitor/alert on changes.

Deployment

Will require a new ossec-agent package to published.

Checklist

If you made changes to the system configuration:

• Configuration tests pass

[codecov-io]

Codecov Report

Merging #2963 into develop will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff            @@
##           develop    #2963   +/-   ##
========================================
  Coverage    89.28%   89.28%           
========================================
  Files           31       31           
  Lines         1810     1810           
  Branches       209      209           
========================================
  Hits          1616     1616           
  Misses         144      144           
  Partials        50       50

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update df97f93...0274ca8. Read the comment docs.

[redshiftzero]

Changes look good and I've tested in staging following your test plan. Thanks @emkll!

[ageis]

@emkll @redshiftzero Hey both, just had a comment or thought here when I was looking at the list of directories that are being monitored. If we're speaking in terms of defense-in-depth, then you might want to monitor /var/run/tor as well. That's where the control socket and authentication cookie get written on Debian-based systems, so any changes would indicate someone has created a backdoor to the Tor process, which is explicitly disallowed, since you do not set a ControlSocket or CookieAuthentication in your torrc. However, there is a problem with doing this, which is that the PID file is in the same directory and subject to change.

[conorsch]

@ageis #1261 describes switching to Unix sockets (i.e. files on disk) for the Tor service. If that gets implemented, then the socket path would ideally be monitored by OSSEC. As for watching anything under /var/run/, that'd generate too much noise for Admins without providing any meaningful information: files there are expected to change.

[msheiny]

Hey @emkll should this also be monitored on upgrades? I can't see any logic that would add it as-is.