News Archive

Now we move LIDS web server to new host. — OMO

I created new forum for LIDS at lids.jp/bbs. Old forum's contents disappeared due to a hardware problem. Sorry. — OMO

LIDS 2.2.3rc9 is released for kernel 2.6.31/32. It fixed several bugs in lids-2.2.3rc8. Downloads were published on the lids.jp wiki. If you find any problem, please freely send mail to me. — OMO

Currently we have hardware trouble on the forum.lids.org server. Now I'm trying to build a new server for the forum. — OMO

After 2.6.29 there were big changes to the security structure in the kernel. You must completely re-install lidstools to lidstools-2.2.7.8 because some structs changed — erase /etc/lids and re-make your ACLs with the new lidsconf. If you find any problem, please send mail or post to the forum. — OMO

Bugs fixed: sandbox not working properly; each state's capability not working properly. Requires lidstools-2.2.7.7 (sandbox flag moved into ext_cap) — erase /etc/lids and re-make ACLs with the new lidsconf. — OMO

Fixed: even in an LFS, capabilities (CAP_SYS_ADMIN, etc.) could not be controlled. Requires a full lidstools-2.2.7.6 re-install. This was expected to be the final rc release. — OMO

Includes the TDE/Sandboxing feature. Requires lidstools-2.2.7.5. The FAQ and documentation were being rewritten for lids-2.2.3. — OMO

Old versions of LIDS were temporarily republished at lids.jp/archives.download.html. — OMO

Includes the TPE/NFMark feature. Requires lidstools-2.2.7.3. "Also, now I'm developing lids-2.2.3rc4-2.6.23 which will include the TDE/Sandbox feature. Stay tuned." — OMO

Removed obsoleted hooks so LIDS compiles under kernel 2.6.14, and fixed a bug that prevented ssh and vsftpd from functioning correctly. From this version lidstools is released separately. RPM and deb packages for Fedora Core 3/4, CentOS 4.2 and Debian sarge were provided by LIDS-JP.

After 9 months of development, with a lot of help from LIDS users, here comes version 2.2.1 for kernel 2.6.13 — a stable version. Fixed a capability error causing sshd login failure; fixed a security bug in LD_XXXX checking; enhanced hooking to support ospf.

Shark released a Polish LIDS Howto at cc-team.org. Thank you Shark.

New unofficial LIDS patches were made available, including one combined with the Openwall patch. Have fun!

Options: to secure embedded systems · to secure production servers · to secure my workstation · just have fun · other.

Yusuke Sato of LIDS-JP wrote a very interesting article, "How to use LIDS with BusyBox on Embedded Linux", published on the LIDS-JP site.

Fixed a security bug when checking the "LD_" exploit; enhanced lids hooks to support capability-enabled applications such as ospfd; enhanced Kconfig so LIDS stays visible when other modules are marked as modules. Thanks to Michael Grosseg and Dirk Nehring for reporting bugs.

Omok released new LIDS-patched kernel RPM packages for Fedora Core 4 on the LIDS-JP download page.

Linus announced the release of 2.6.12 on the linux-kernel mailing list. "As some people may have noticed already, 2.6.12 is out there now."

"The Linux Intrusion Detection System (LIDS) is a kernel patch for both 2.4 and 2.6 kernels that adds Mandatory Access Control (MAC) and other security enhancements to the Linux kernel. The main feature of LIDS is its ability to limit the power of the root account. LIDS uses Access Control Lists (ACLs) to control access to files, processes, and network resources. Once these permissions are set, they cannot be overridden, even if a user or process has root privileges."

Yuuske Sato wrote a LIDS article in the June issue of Network World Japan describing how to install and use the LIDS TDE feature with lids-1.2.2. (Japanese only.)

By Yusuf Wilajati Purna. "Applications, which we believe trusted so that we give more privileges than others through LIDS ACLs, sometimes behave abnormally or unexpectedly in case unprotected inputs are given. Due to this anomaly, it is possible for attackers to hijack privileges of the applications, and then abuse the privileges to breach the system security." TDE sandboxes such applications, with sample configurations for Apache and Samba.

Merged a patch by Andreas Steinmetz adding x86_64 support; code cleanup; prevented /etc/lids from being read by normal users; fixed filp_open to prevent open failures.

Includes the LIDS TDE application sandboxing feature, with lidstools 0.5.7 fixing a bug on outbound ports for sandboxed processes found by Michael Gale. All 2.4.x users advised to update.

This site is built with Drupal.

Nikkei-BP released the "Linux Secure Server" book, including an explanation of LIDS 2.2.0 written by Omo Kazuki.

NewsForge published an article about the ADIOS project. Unlike other live CDs, ADIOS lets you boot into either LIDS or SELinux — a way to try LIDS without compiling anything.

The Dutch edition of c't magazine ran a three-page article (issue 3, pages 112–114) explaining what LIDS is, what it can do, and how to get started with a small rulebase.

1,854 Nmap users from the nmap-hackers mailing list voted on their favorite security tools, and LIDS was selected into the Top 75 Network Security Tools. "The LIDS team will continue to do their best to make LIDS one of the best tools."

"Intrusion Detection für Linux-Server" by Ralf Spenneberg covers LIDS extensively, together with Tripwire, Snort, and forensics.

This version is for kernel 2.5.54.

Continuing to keep LIDS working with kernel 2.5.50.

Made compatible with 2.5.49; changed i_dev to i_sb->s_dev.

Fixes a problem with hidden files.

Removes LIDS_ALLOW_ANY_PROGRAM_SWITCH.

Patch against vanilla 2.5.45. Removes the "switch local on" feature, adopts new 2.5 kernel facilities including Kconfig and workqueues, and fixes bugs in ACLs. Please try it and report bugs!

The equivalent of 1.1.2rc3 for the 2.2.22 kernel.

Fixes one compile-time bug, one warning, and one improbable memory leak.

Same as 1.1.2rc1, adapted to kernel 2.4.19.

Improves set[ug]id support and capability-aware application support.

Corrects small bugs, including behaviour that made LIDS give privileges to privileged programs even when run by non-root users.

Fixed a capability bug found by Jan Kurik and Radek Bohunsky. Upgrading is recommended.

Fixed an unlimited file-ACL inherit bug and a VERSION checking bug. From this version LIDS supports secondary modules (module stacking), so OWLSM (Openwall for LSM) can live alongside LIDS. Applies to both 2.4.x and 2.5.x.

Keeps up with 2.5.7's changes and was included in the recently released LSM 2.5 tree.

Uses path_lookup for the new kernel change and adds lids_security_alert when a HIDDEN file is accessed.

No bugs since the last release, so it is considered stable. Note that the manpage has been updated :).

Made LIDS independent of the 2.5/2.4 split — one patch works on either 2.4.18 or 2.5.5 with the LSM patch from lsm.immunix.org.

Back-port from 2.0pre3-2.5.5-lsm with a lot of cleanup.

lidstools 0.1 for LSM is now available, including the admin tools needed to use LIDS under LSM. The 2.0pre3 patch fixes bugs and adds features, to be included in the LSM tree soon.

Thanks to the LSM (Linux Security Modules) development team, LIDS is included in the LSM tree, downloadable from lsm.immunix.org.

LIDS ported to LSM — LIDS can now be compiled as a module as well as built into the kernel. Apply the LSM patch first, then the lids-2.5.4-lsm patch.

Lots of bugfixes — check the changelogs and release notes.

The first version for the 2.5 development kernel branch. Enjoy it!

These releases seem stable enough to be release candidates. It even seems that 0.11.0pre5 contains fewer bugs than 0.10.4.

A significant security fix was released; all users were urged to upgrade immediately.

A backport of many improvements made for 1.1.0, one of them being the packaging. "I've not really tested this one… pay attention!"