LinuxQuestions.org

Logwatch, webserver logs, PHP malarky

Posted 10-03-2009 at 05:52 AM by unSpawn

As I'm seeing more questions about (badly coded) web applications spawning rogue processes I wonder why people don't read their logs. Attacks require reconnaissance so keeping an eye on anything that looks like a prelude enables you to take measures. And please spend time updating when updates are released, installing apps properly (like not leaving the installation files around when docs remind you not to), hardening (any IDS, mod_security, Gotroot rulesets, mod_evasive or equivalent, PHPIDS, Suhosin,...

unSpawn

Moderator

Posted in Uncategorized

Views 206 Comments 0 unSpawn is offline

Rootkit Hunter 1.3.5-dev progress

Posted 08-05-2009 at 10:47 AM by unSpawn
Updated 08-05-2009 at 10:49 AM by unSpawn

Tags rootkit hunter

Take a peak at RKH's SF CVS stats and you will see that activity picked up again. Currently the RKH 1.3.5(-dev) Changelog (rev1.119) lists 16 bugfixes, 13 new items, 14 changes and counting.

It was a bit sad to notice some of the existing signatures were incomplete though. And while everyone knows breaches of security "the old school rootkit way" have dropped to nil, RKH aims to be complete. So I'll be replaying rootkit installs again and working on improving rootkit checks...

unSpawn

Moderator

Posted in Uncategorized

Views 397 Comments 0 unSpawn is offline

Eiciel .spec

Posted 07-09-2009 at 07:46 AM by unSpawn

Tags acl, eiciel, rpm, spec file

Eiciel allows you to visually edit file ACL entries. You can add and remove users and groups who will be granted permissions through the graphical interface. Eiciel can be used as stand-alone application and as Nautilus extension.

ACL: http://bestbits.at
Eiciel: http://rofi.roger-ferrer.org/eiciel/
Also-see: http://www.cs.bham.ac.uk/~nrs/jfacl/ (Java-based UI)

I didn't see no package but I know it is in Fedora-extras, I just didn't want to rebuild it....

unSpawn

Moderator

Posted in Uncategorized

Views 466 Comments 0 unSpawn is offline

Torsocks .spec

Posted 07-03-2009 at 06:07 AM by unSpawn

Tags rpm, socks, spec file, tor

Torsocks: http://code.google.com/p/torsocks/

Code:

# No debuginfo:
%define debug_packages	%{nil}
%define debug_package %{nil}
#
%define name torsocks
%define ver 1.0
%define rel 1
%define buildver %{ver}-gamma
#
# Configuration switches for rebuilding (1=yes 0=no).
# Force dns lookups to use tcp? (config switch --enable-socksdns)
%define enablesocksdns 0
%{?build_enablesocksdns:%define enablesocksdns

...

unSpawn

Moderator

Posted in Uncategorized

Views 531 Comments 0 unSpawn is offline

Non-authoritative scan results of BitDefender, ClamAV and F-prot

Posted 07-01-2009 at 08:35 PM by unSpawn

Tags antivirus

Like before here's some results of running BitDefender, ClamAV and F-prot on over 11K of files containing Rootkits, LKM's and other goodies. Because of what I do most of the files are GNU/Linux related. (I run AV like a pentester would run metasploit against a networked entity.) I'm well aware of the AV-on-GNU/Linux-yes-or-no debate and this is not the place to go into that: search LQ or open up a thread if you need to discuss validity.

The commercial AV market is kind of an odd...

unSpawn

Moderator

Posted in Uncategorized

Views 576 Comments 0 unSpawn is offline

Page 1 of 6

Last »