Re: [Full-disclosure] one of my servers has been compromized

[John Jacobs <flamdugen@xxxxxxxxxxx>]

Those considering Tripwire I would ask they take a look at OSSEC-HIDS; the 
filesystem change notification is outstanding and with inotify() support you 
get immediate notification of changes.  The monitoring and alerting of log 
files is also exceptional.  I am not affiliated with OSSEC in any way.  
http://www.ossec.net/main/about

I would recommend from a "rooting" aspect that kernel module loading be 
disabled after boot.  This is accomplished by removing the CAP_SYS_MODULE 
permission using something like lcap on older systems or by using the sysctl 
value of 'kernel.modules_disabled = 1'.  This can save a box by preventing 
automatic or intentional loading of a vulnerable modules or a module-based 
rootkit.

The sysctl value of 'kernel.panic_on_oops = 1' also is a good idea.

Thanks,
John


                                          
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/