Re: securing a unix system - suggestions on checking for intrusions

On Thu, Oct 6, 2011 at 6:17 PM, Andrew Simpson
<[email protected]> wrote:
> The rpm keeps a database of md5sum, permissions, size, date, etc on each
> installed file and each package. Hence this can very useful in checking
> what's changed in a system - providing you can trust the database.[2]
>
> ...
>
> Since changing to apt based distributions, I've found no equivalent.

debsums might give you some of that. It looks in
/var/lib/dpkg/info/*.md5sums and verifies your system files against
that.

Of course a smart attacker will change the checksum after they patch
the associated binary; to prevent this the checksum files need to be
signed with the same keys as the packages, which isn't happening, so
the results of this are potentially less useful than the rpm
equivalent (which I haven't investigated).

However, it is useful for less malicious damage ... here's an example
where I have deliberately altered /usr/bin/sup-mail from the sup-mail
package ...

cheja23p@maru:/var/lib/dpkg/info$ debsums sup-mail
/usr/bin/sup-add                                                              OK
/usr/bin/sup-cmd                                                              OK
/usr/bin/sup-config                                                           OK
/usr/bin/sup-dump                                                             OK
/usr/bin/sup-mail                                                         FAILED

Once I accidentally caused the deletion of some files in /lib ... we
were able to restore these by using debsums to check every package
that expected to put anything into /lib, and then re-install from the
specific .debs still sitting in /var/cache/apt/archives ...

-jim
-jim

_______________________________________________
NZLUG mailing list [email protected]
http://www.linux.net.nz/cgi-bin/mailman/listinfo/nzlug