| Author |
Message |
NeonNero
Joined: 04 Jan 2005
Posts: 115
Location: Ålesund, Norway
|
| Posted: Mon Mar 28, 2005 10:02 pm Post subject: Detecting a hacked Linode |
|
|
I came across this article, which is worth a read if you want to know what to do when your Linux server is hacked:
http://security.linux.com/security/05/03/23/2239205.shtml?tid=35
The article references two IDS tools, Tripwire and chkrootkit. I know for a fact that both exist in the Gentoo portage repository, and only chkrootkit of the two is available from the Debian APT repository.
Latest versions of both, as well as more detailed information about the two tools, can be found here:
http://www.chkrootkit.org/
http://www.tripwire.org/ |
|
| Back to top |
|
sednet
Joined: 17 Mar 2004
Posts: 106
Location: Europe
|
| Posted: Tue Mar 29, 2005 3:36 am Post subject: Tripwire |
|
|
Tripwire isn't in debian because it isn't free ( as in freedom. )
If you are using debian integrit does more or less the same thing.
Mounting noexec,ro where possible is also a simple but good idea. |
|
| Back to top |
|
mikegrb
Joined: 16 Oct 2003
Posts: 254
Location: Dr Wierd's Lab, South Jersey Shore
|
| Posted: Tue Mar 29, 2005 11:20 am Post subject: |
|
|
| sednet is correct, if one wants tripwire on Debian, you can add the non-free category and get tripwire. |
|
| Back to top |
|
rjp
Joined: 15 Aug 2003
Posts: 102
|
| Posted: Wed Mar 30, 2005 2:55 pm Post subject: |
|
|
| Another useful approach is to use RIBS to back your Linode up to a local directory, and have it email its reports to you. Any file that gets modified will be picked up by rsync and listed in the report, and you will still have access to older versions. |
|
| Back to top |
|
OverlordQ
Joined: 04 Jun 2004
Posts: 199
|
| Posted: Sat Apr 02, 2005 4:24 am Post subject: |
|
|
Erm, the tripwire package is in main but it's non-us not non-free since after all the package in debian *is* based off of the GPL sources :)
Package: tripwire
Priority: optional
Section: non-US
Installed-Size: 6564
<snip some stuff here>
Filename: pool/non-US/main/t/tripwire/tripwire_2.3.1.2-6.1_i386.deb |
|
| Back to top |
|
mikegrb
Joined: 16 Oct 2003
Posts: 254
Location: Dr Wierd's Lab, South Jersey Shore
|
| Posted: Sat Apr 02, 2005 11:12 am Post subject: |
|
|
| Overlord, thanks for the corrections. I didn't bother to check beyond seeing that it was apt-getable ;) |
|
| Back to top |
|
OverlordQ
Joined: 04 Jun 2004
Posts: 199
|
| Posted: Sat Apr 02, 2005 11:16 pm Post subject: |
|
|
| it used to be in non-free untill teh tripwire ppl released a GPL version which replaced what was in debian so it was moved :) |
|
| Back to top |
|
| |
