Ninja v0.1.3 - privilege escalation detection and prevention
Ninja is a privilege escalation detection and prevention system for GNU/Linux hosts. While running, it will monitor process activity on the local host, and keep track of all processes running as root. If a process is spawned with UID or GID zero (root), ninja will log necessary information about this process, and optionally kill the process if it was spawned by an unauthorized user.
Version 0.1.3 (03-12-2009)
- general: bumped version to 0.1.3
- log.c do va_start() before writing to logfile to fix segfault on x86_64 platforms. (Reported by Francois Marier & William Vera)
A "magic" group can be specified, allowing members of this group to run any setuid/setgid root executable.
Individual executables can be whitelisted. Ninja uses a fine grained whitelist that lets you whitelist executables on a group and/or user basis. This can be used to allow specific groups or individual users access to setuid/setgid root programs, such as su(1) and passwd(1).
Ninja requires a configuration file to run. For more information about the configuration, please refer to the "default.conf" file, located at "examples/config/" in the source tree. There, all the available options are explained in detail.
- Ninja is released under the General Public License (GPL) version 2 or higher
- Read How to Ninja
- More Informatio: here
Post scriptum
Related Articles
| Defense |
|
| Ninja |
|
| Security Solutions |
|
