SATAN Rulesets - what makes SATAN go


While not as potentially dangerous as the SATAN configuration file, the collection of files that make up SATAN's internal rules are probably the most important part of the entire SATAN system. All inferencing is done here; this is how SATAN determines, for instance, what the target's OS and hardware type is from the other data collected in the system. Generally speaking, the rule files determine:

In addition, the rules also inform SATAN to run other probes based on past input; for instance, if the host is found to run rexd, then the rexd.satan probe might be run, based on a rule contained here.

The files are nothing more than perl code that gets run when the program initializes; don't be intimidated by that, however - it is fairly easy to read and is heavily commented (if you don't know perl, comments (lines that don't do anything) are lines that start with a sharp/pound sign ("#")). Variables are tokens that start with a dollar sign; values of 0 or null ("") typically mean false, unless otherwise noted.

There are currently five (5) rule files, each governing a separate part of SATAN's behavior (note: facts contain information that individual SATAN data collection modules (e.g. the ".satan" files) collect.)

  1. rules.drop - determines what facts should be ignored.
  2. rules.facts - deduces new facts from existing data.
  3. rules.hosttype - tries to recognize host types from telnet/ftp/smtp banners.
  4. rules.services - classifies hosts by service type.
  5. rules.todo - specifies what probes to try next, given information gathered so far.
The easiest way to explain all of this is to just go over each file in turn.

rules.drop

This contains rules that determine what facts should be ignored. Each rule is applied once for each SATAN record that has an "a" in the status field (this means the host is available; see the SATAN Data Base Format section.)

For instance, SATAN assumes that CD-ROM drives are not harmful for export purposes; if we see a target host that exports "/cdrom" or "/CDROM", we assume it's harmless by telling SATAN to ignore this fact:

$text =~ /exports \/cdrom/i
(The $text variable holds the output of the SATAN probe, showmount.satan in this case; any of the global SATAN variables could be used.)

rules.facts

This file contains rules that deduce new facts from existing data. Each rule is executed once for each SATAN record that has an "a" in the status field. (this means the host is available; see the SATAN database format section.)

The rule format is:

condition TAB fact
(Note - the TAB is the tab character, not the three letters "T", "A", and "B"!)

For example, if we want to assume that if a host is running rexd it's insecure without trying to probe it further, we would put:

/runs rexd/     $target|assert|a|us|ANY@$target|ANY@ANY|REXD access|rexd is vulnerable
The most difficult thing with the rules.facts file is that you have to understand the SATAN data base format; a good way to understand that better is to merely look at any of the .satan files in the main SATAN directory and look to see what the probe does and what it outputs.

rules.hosttype

This file contains rules that recognize host types from telnet/ftp/smtp banners; these are applied to every record that has a telnet, ftp, or sendmail banner.

The format of this file is:

CLASS class_name
condition TAB hosttype
(Note - the TAB is the tab character, not the three letters "T", "A", and "B"!)

The class_name is used for the first rough breakdown by host type in reports. It should be a major software category, such as SUN, APOLLO, etc. For example, here is the code for recognizing a SUN and its major OS revision:

CLASS SUN
/SunOS/ && HOSTTYPE eq ""        "SunOS 4"
/4.1\/SMI-4.1/                   "SunOS 4"
/SMI-SVR4/                       "SunOS 5"

While it looks fairly impenetrable, look at the examples given if you'd like to create your own rules and steal and modify the code we use to do this.

rules.services

Very similar to the host type ruleset, this file contains rules that translate the cryptic SATAN record data to something that is more suitable for reports. Again, each rule is executed once for each SATAN record that has an "a" in the status field. (this means the host is available; see the SATAN database format section.)

Format of this file is:

class_name
condition TAB service_name TAB host
Where the class_name is SERVERS or CLIENTS. For instance, to classify a host as an NNTP server, you'd simply do this (in the SERVERS section):
$service eq "nntp"                      NNTP (Usenet news)

rules.todo

These are rules that specify what probes to try next. Each rule is executed once for each SATAN record that has an "a" in the status field. (this means the host is available; see the SATAN database format section.)

Format of this file is:

condition TAB target tool tool-arguments
(Note - the TAB is the tab character, not the three letters "T", "A", and "B"!)

The condition is a logical expression (with the usual internal SATAN variables) that has to be satisfied in order for SATAN to run the probe specified; when the condition is satisfied, the tool is executed as:

tool.satan tool-arguments target
SATAN keeps track of already executed tool invocations.

For instance, if a host is running ypserv, we would typically run the ypbind.satan probe against it. This would be done as follows:

$service eq "ypserv"                    $target "ypbind"

It's easy to put in a probe that, say, depends on the type of system that you're looking at. For instance, SGI/IRIX hosts have "guest", "lp", and other accounts with no password when taken out-of-the-box from SGI. Here's how you could check to see if this is a problem:

/IRIX/					$target "rsh" "-u guest"
That would do an rsh as user guest to see if a command could be executed remotely; SATAN would then record this fact in the results.