Files restricted to only root user

ernie · 03-23-2007, 07:06 PM

I have bind-utils installed here. Do you have it installed? If not, install it. You can open a terminal window, su to root, then run:

urpmi bind-utils

urpmi will install the package if it is not installed, or report the package(s) already installed.

If bind-utils is installed, what services do you have running that need the bind package? The bind package contains a DNS server. Are you using this computer as a server? If you are, you should use the higher security level. I was under the impression that this computer is being used as a workstation. Please make it clear just how you are using this computer, and which services you have running (and why). Without this information, I and others here may provide incorrect information.

BiPolarPenguin · 03-23-2007, 09:55 PM

Quote:

Originally Posted by Peter_APIIT

I have did what ever you post here but during the boot process i can see that my shorewall and netlink got problem. I have check the /var/log/boot.log but cannot find any errors from there.

The shorewall cannot find bind directory - No such file or directory.

Thanks.

The above post is THE EXACT way I have my Firewall setup.

And I don't have any probs with Error Readings.

If you are still getting anything reading as error during Boot Up,
That has to do with the Firewall?

Which anyone here correct me if I'm Wrong but I don't think your error message, really has anything to do with the Firewall.
But as I've said I could be Wrong

.

But if after setting your Firewall Up as he's already explained.
And your Still having Probs with People trying to access Your Computer.

I think everyone here would agree with me...

May I suggest a 100% Clean reinstall?

I think thats the only way your TRULY going to solve your Prob.

Unless something is being done Wrong during the Install to begin with.

I hope this helps

Peter_APIIT · 03-24-2007, 11:56 PM

Thanks for all your information.

ernie · 03-25-2007, 03:03 PM

If you do choose to do a clean install, you may want to include the tripwire package. Then if you again think your system has been compromised, you can check with tripwire.

Here is the package description from the Mandriva Software Installer:

Quote:

Tripwire is a very valuable security tool for Linux systems, if it is installed to a clean system. Tripwire should be installed right after the OS installation, and before you have connected your system to a network (i.e., before any possibility exists that someone could alter files on your system).

When Tripwire is initially set up, it creates a database that records certain file information. Then when it is run, it compares a designated set of files and directories to the information stored in the database. Added or deleted files are flagged and reported, as are any files that have changed from their previously recorded state in the database. When Tripwire is run against system files on a regular basis, any file changes will be spotted when Tripwire is run. Tripwire will report the changes, which will give system administrators a clue that they need to enact damage control measures immediately if certain files have been altered.

Extra-paranoid Tripwire users will set it up to run once a week and e-mail the results to themselves. Then if the e-mails stop coming, you'll know someone has gotten to the Tripwire program...

After installing this package, you should run "/etc/tripwire/twinstall.sh" to generate cryptographic keys, and "tripwire --init" to initialize the database.

HTH,