Re: one of my servers has been compromized

[John Jacobs <flamdugen () hotmail com>]

Those considering Tripwire I would ask they take a look at OSSEC-HIDS; the filesystem change notification is 
outstanding and with inotify() support you get immediate notification of changes.  The monitoring and alerting of log 
files is also exceptional.  I am not affiliated with OSSEC in any way.  http://www.ossec.net/main/about

I would recommend from a "rooting" aspect that kernel module loading be disabled after boot.  This is accomplished by 
removing the CAP_SYS_MODULE permission using something like lcap on older systems or by using the sysctl value of 
'kernel.modules_disabled = 1'.  This can save a box by preventing automatic or intentional loading of a vulnerable 
modules or a module-based rootkit.

The sysctl value of 'kernel.panic_on_oops = 1' also is a good idea.

Thanks,
John


                                          
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/