Re: What is the best free HIDS for Debian

Hi All

I have been following this discussion with some interest.

I have few questions, which all go to

1. what behaviour leads the syetem owner/manager to believe that there is a security issue at play here?
2. how old is the syusytem in question?
3. have there been manual tools installs done on the system?
4. Has the system been fully updated/upgraded?
5. have we eliminated other causes of file mismatch - bad/incomplete
updates, corrupted HDD, bad RAM, user error ?
6. finally - does the debcheckroot tool look at the security distribution archive as well as the
main debian archive? There are times where packages are updated in the
security archive, but not reflected in mailine 

Cheers
Tomasz

On Sun, May 08, 2022 at 06:26:51PM -0400, Michael Lazin wrote:
> Rkhunter does find patterns of known rootkits but it also finds indicators
> like memory anomalies like I mentioned and it logs each file change from
> the install, this is why ideally you should install it in a fresh system.
> Thanks.
> 
> Michael Lazin
> 
> On Sun, May 8, 2022 at 3:45 PM <[email protected]> wrote:
> 
> > Am 08.05.2022 20:43, schrieb [email protected]:
> > > P.S.: A memory only rootkit would still need a hook to reinstall on a
> > > fresh boot.
> >
> >    Yes I know it is an issue. Debcheckroot does f.i. not check you
> > initrd. To fix this issue I would need to program an own piece of
> > software like debcheckinitrd. Anyone who wants to support me can do
> > this: https://www.elstel.org/Contact.html. I am a free developer and I
> > do not get paid for my open source related work.
> >
> -- 
> Michael Lazin
> 
> .. τὸ γὰρ αὐτὸ νοεῖν ἐστίν τε καὶ εἶναι.

-- 
Tomasz M. Ciolek	
*******************************************************************************
 tmc at vandradlabs dot com dot au 
*******************************************************************************
   GPG Key ID:		0x830AD092288EF017
   GPG Key Fingerprint: 07DF B95B DB58 57B6 9656  682E 830A D092 288E F017
   Key available on good key-servers
*******************************************************************************

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEB9+5W9tYV7aWVmgugwrQkiiO8BcFAmJ4SL8ACgkQgwrQkiiO
8BczeRAAvhi2yJe84RfGjt8lspRNbZTDYiru+niKgAa+OSoVcNB4SNhdcULhpU/p
LghFRfQo7tImPraBqbA+jQy+yc5SQrbykNImjXuRZhKIsuIVv5Ay69F4Bsnlnvu9
y1CcJiBGxa9N+j7vflX8F66BLHbA97LgE4AjG/c8lhJDArgx5r7VmHzBgkBYZVl3
pf1P1OT5LClrq8F5cJpaByc7Kht+WKGK2ZxlkmapwUnqXQBKoAsSzPh8cp+1Vodc
7kKQpuWOtWCXOtiyG7GyO8T2UXn3Vo3l8j+1Qb9dnf1jgxh/xizTzOviWcBp0p/Q
72EXpp/eQD0M/f6rpe4HobTusNpACkQo1rEGAUSsTv9cml8LcuwEBqTVPLPOq0WN
05ljf+N8+8NvLwFt6ZgyzSv+sxSyiMyYNTQxmpFocthuULpol0cYsXM+kZihUkY8
HA4tszfjdagrOdT8pAXEfciaR70506zcXGoCS/05sDcCpfi9Dxs+BwK9KYoChnwi
lQfdmMl8THMYveO7+50EoQLdGUkkmpeEuh1Hkml5ZbW/+AeNdR9QCD4KBwrOp/C2
/GfJOIfQcPJVm1K4fMRwInTn0+fCk7A4fqCVajfEF2/7fkubMrr/I3MC5zjhfCu3
Kx8sz61MhK0JbMstOw8SuTGQIDS4tWylsD2yFlSXCeVL4EttM1s=
=l+Wf
-----END PGP SIGNATURE-----