Re: [Security-Discuss] 2006 su problem

* Matt Parker <matt-GI5F06Pch7ob0QgIrC/[email protected]> [2005-10-18 19:54:26 +0100]:

> > Out of curiosity... what is it about msec that you actually like/need?
> > I find msec to be more trouble than it's worth.  Frankly, I like the
> > idea of the various reports it sends, but I really can't stand how it
> > monkeys with files behind your back (and changing configs is even
> > worse).  Do you actually find msec "fixing" things is reliable and worth
> > it?
> 
> I love it.
> 
> For example, one of my web facing servers runs sshd and is open to everyone 
> (so long as they have a username/password). Given that I have all these users 
> (and some of them run Windows which is vulnerable to having keyloggers 
> installed) it helps me sleep at night knowing I'll get a report in the 
> morning if any config files have changed and that they will have been changed 
> back for me.

I think you put too much faith in msec.  It will change *some* configs
back, not all.  If someone breaks in and mucks with the apache configs,
msec will tell you it changed, but it won't fix it for you.

> I'm not much of a hands on administrator (I have other things to do) and I 
> like msec looking after my boxes for me.
> 
> Granted it can be a pain to set up, but it didn't take long to work out how to 
> configure it - even running at the highest security level below paranoid 
> (can't remember which number that is) - once I'd RTFM.

=)

-- 
"lynx -source http://linsec.ca/vdanen.asc | gpg --import"
{FEE30AD4 : 7F6C A60C 06C2 4811 FA1C  A2BC 2EBC 5E32 FEE3 0AD4}

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)

iD8DBQFDVdBzLrxeMv7jCtQRAuf8AJ4ySnuCyqou8NWsUL4CUakDQg83zQCfW/DW
c71qAi6oDlrKkWKCbNd3O0g=
=jp3t
-----END PGP SIGNATURE-----