Re: securing a unix system - suggestions on checking for intrusions
| Newsgroups | gmane.org.user-groups.linux.new-zealand.general |
|---|---|
| Message-ID | <[email protected]> |
On Thu, 06 Oct 2011 15:24:26 +1300, Robin Paulson wrote: > On Thu, 06 Oct 2011 15:09:23 +1300, Bryan Baldwin wrote: >>> me neither. any suggestions on software/script to do the former, >>> i.e. >>> check every file? >>> >> >> Something like this could help. >> >> http://www.tripwire.org/ >> >> http://en.wikipedia.org/wiki/Open_Source_Tripwire > > excellent, i'll give it a whirl. but it brings up this question: > is there anything to check the tripwire database, to ensure it hasn't > been tampered with? Sounds like a Russian doll problem to me. Any check you can do will need a check on itself and so on... You could be reasonably sure by taking a sha1 hash of the tripwire database when your system is in a known good state and storing it on another system (encrypted if necessary). Rob _______________________________________________ NZLUG mailing list [email protected] http://www.linux.net.nz/cgi-bin/mailman/listinfo/nzlug