Re: [Security-Discuss] 2006 su problem

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

>>For example, one of my web facing servers runs sshd and is open to everyone 
>>(so long as they have a username/password). Given that I have all these users 
>>(and some of them run Windows which is vulnerable to having keyloggers 
>>installed) it helps me sleep at night knowing I'll get a report in the 
>>morning if any config files have changed and that they will have been changed 
>>back for me.
> 
> 
> I think you put too much faith in msec.  It will change *some* configs
> back, not all.  If someone breaks in and mucks with the apache configs,
> msec will tell you it changed, but it won't fix it for you.

msec is a *VERY* limited tool when it comes to managing config files.
If you want to really manage config files and ensure that any changes
made without your consent are reported and immediately reverted to their
original explicitly configured state, then you should be taking a long
hard look at cfengine.  Cfengine can also behave like tripwire by
keeping md5sums of important files that you specify and potentially even
copying known good (ie not on the local box) copies over a file who's
md5sum has changed.

There are many many more benefits to managing servers with cfengine, but
I'm not going to get into that just now.

>>I'm not much of a hands on administrator (I have other things to do) and I 
>>like msec looking after my boxes for me.

That's what I first liked about msec as well, although I think it's
utility is much better as an initial hardening tool rather than for
ongoing maintenance.

- --
Mason Schmitt
Systems Administrator
Sunwave Cable Internet / Shuswap Internet Junction
ph: (250) 832-9711
www.sunwave.net
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFDVnkabip6upg8pq8RAkhlAJ9/O2XEPcdURA00Ecmy5///8v1flwCgmG8x
+Ep0aTc8INjMMbenH/74B1g=
=KWaP
-----END PGP SIGNATURE-----

____________________________________________________
Want to buy your Pack or Services from Mandriva? 
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________