Security question

hitest · 06-30-2007, 10:04 AM

I'm currently using rkhunter and chkrootkit to scan my Debian Etch box for rootkits.
Can anyone please recommend another Debian command line security application that you use?
Thank you for any and all replies.

hitest

{BBI}Nexus{BBI} · 06-30-2007, 10:33 AM

Quote:

Originally Posted by hitest

I'm currently using rkhunter and chkrootkit to scan my Debian Etch box for rootkits.
Can anyone please recommend another Debian command line security application that you use?
Thank you for any and all replies.

hitest

Tripwire is a nice security addition: http://www.tripwire.com/products/enterprise/ost/

hitest · 06-30-2007, 10:49 AM

Quote:

Originally Posted by {BBI}Nexus{BBI}

Tripwire is a nice security addition: http://www.tripwire.com/products/enterprise/ost/

Thank you, much appreciated. Scanning with tripwire now.

Daws · 06-30-2007, 10:56 AM

The harden packages are worth a look:

harden - Makes your system hardened
harden-clients - Avoid clients that are known to be insecure
harden-development - Development tools for creating more secure programs
harden-doc - Useful documentation to secure a Debian system
harden-environment - Hardened system environment
harden-nids - Harden a system by using a network intrusion detection system
harden-remoteaudit - Audit your remote systems from this host
harden-servers - Avoid servers that are known to be insecure
harden-surveillance - Check services and/or servers automatically
harden-tools - Tools to enhance or analyze the security of the local system

hitest · 06-30-2007, 11:12 AM

Thanks, Daws:-)

hitest · 07-01-2007, 11:25 AM

I ran rkhunter on my Debian box and it showed no evidence of rootkit activity.
When I ran chkrootkit I received the following result.

http://i34.photobucket.com/albums/d1...st/sniffer.jpg

Near the bottom of the screenshot it shows that lo is not promiscuous, but it also says something about a PACKET SNIFFER.
What do you think? I'm a bit confused by the scan result.
Thank you for any and all replies:-)

makuyl · 07-01-2007, 04:31 PM

Quote:

Originally Posted by hitest

I ran rkhunter on my Debian box and it showed no evidence of rootkit activity.
When I ran chkrootkit I received the following result.

http://i34.photobucket.com/albums/d1...st/sniffer.jpg

Near the bottom of the screenshot it shows that lo is not promiscuous, but it also says something about a PACKET SNIFFER. If your nic was in promiscuous mode it might mean that a sniffer is present. It's not.
What do you think? I'm a bit confused by the scan result.
Thank you for any and all replies:-)

If your nic was in promiscuous mode it might mean that a sniffer is present. It's not. http://en.wikipedia.org/wiki/Promiscuous_mode
The dhcp client often gives a false positive. Nothing to worry about that either. If you want, you can check the md5sum of its binary. If this is a home desktop behind a router you might as well setup a static IP for it and disable dhcp. This would speed up your boot time as well. Something like :

Code:

# /etc/network/interfaces -- configuration file for ifup(8), ifdown(8)

# The loopback interface
# automatically added when upgrading
auto lo
iface lo inet loopback


#iface eth0 inet dhcp
auto eth0
iface eth0 inet static
       address 192.168.1.3
       netmask 255.255.255.0
       network 192.168.1.0
       broadcast 192.168.1.255
       gateway 192.168.1.1

hitest · 07-01-2007, 04:55 PM

Quote:

Originally Posted by makuyl

If your nic was in promiscuous mode it might mean that a sniffer is present. It's not. http://en.wikipedia.org/wiki/Promiscuous_mode
The dhcp client often gives a false positive. Nothing to worry about that either. If you want, you can check the md5sum of its binary. If this is a home desktop behind a router you might as well setup a static IP for it and disable dhcp. This would speed up your boot time as well. Something like :

Code:

# /etc/network/interfaces -- configuration file for ifup(8), ifdown(8)

# The loopback interface
# automatically added when upgrading
auto lo
iface lo inet loopback


#iface eth0 inet dhcp
auto eth0
iface eth0 inet static
       address 192.168.1.3
       netmask 255.255.255.0
       network 192.168.1.0
       broadcast 192.168.1.255
       gateway 192.168.1.1

Thank you makuyl, I appreciate the reply! I was getting ready to format this puppy and put Lenny on it:-) I'm very happy with Etch. This unit is sitting behind a router so I think it is relatively secure.
Your explanation makes sense to me as it does say that the NIC is not in promiscuous mode. Good to know I haven't been hacked.
Thanks, again:-)

XavierP · 07-02-2007, 08:35 AM

Moved: This thread is more suitable in Linux-Security and has been moved accordingly to help your thread/question get the exposure it deserves.