Re: [Security-Discuss] msec strange messages

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On August 25, 2004 08:15 am, [email protected] wrote:
> i think it's coming from msec program, is that true? How could i know if
> it's realy a security problem? Every day appears the same message.
>
It is coming from msec.  Msec runs via cron (cron.daily) every morning and 
runs a series of security checks on your system based upon the level you have 
it set at.  This is completely normal.  If you configure msec to email diffs, 
you can actually see what changes from day to day.  The diffs have allowed me 
to catch some script kiddies, dropping apps into /tmp/ on our webserver via a 
poorly coded php script, on more than one occasion.

> What should i do?
>
(A gentle RTFM) Go through the msec man page and if you get adventurous, the 
mseclib man page.  Find out which msec level you are currently running at and 
decide if that's where you need to be (for a public server, I suggest running 
at 4 or 5).  Customize as needed for your particular environment.  
**Configure msec to send, at the very least, diff emails.**  

I know there are some on this list that are not fond of msec, but I think it's 
a great tool for catching basic configuration errors, some script kiddie 
behavior, providing you a list of installed packages over time (just keep 
your diff emails whenever you install new software), and for those that are 
not well educated in hardening linux, it takes care of most of the drudgery.

It's a tool that I think has a lot of promise for an "ease of use" distro like 
Mandrake.

- -- 
Mason Schmitt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBLLg8zQfDZFESS2IRAumbAKCIBkMH9jmEyITjLaG9H9DA6dAKOwCdGTzC
MFa2RsR4EBY4bdRFcO4+c0A=
=atcl
-----END PGP SIGNATURE-----

____________________________________________________
Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com
Join the Club : http://www.mandrakeclub.com
____________________________________________________