HELP ME!! with Security

Jbone78 · 06-21-2011, 05:37 PM

Hello I have been asked to help set up security monitoring on Linux systems.

I have currently created baseline files using the following commands

find / -perm -4000
find / -perm -2000

What I want to do is create a crontab that would either check for a change in filesize or do a dif (not sure what would be the best route)

Can someone please give me some pointers

Thanks

chrism01 · 06-21-2011, 05:51 PM

You're going to need these

http://rute.2038bug.com/index.html.gz
http://www.adminschoice.com/docs/cro...Crontab%20file
http://tldp.org/LDP/Bash-Beginners-G...tml/index.html
http://www.tldp.org/LDP/abs/html/
www.linuxtopia.org

Please add the distro name and version of Linux you are running to your profile.
Try

Code:

cat /etc/*release*
uname -a
lsb_relase

Note that you do not want to monitor filesize changes on files that you know will change rapidly/frequently (usually most stuff under /var, especially /var/log). Also, ignore /proc, it's just a window into the kernel
Pre-built tools include Tripwire, Samhain etc; see the Security Forum.

Tinkster · 06-21-2011, 05:54 PM

Hi, welcome to LQ!

Quote:

Originally Posted by Jbone78

Hello I have been asked to help set up security monitoring on Linux systems.

I have currently created baseline files using the following commands

find / -perm -4000
find / -perm -2000

What I want to do is create a crontab that would either check for a change in filesize or do a dif (not sure what would be the best route)

Can someone please give me some pointers

Thanks

Why re-invent the wheel? Install AIDE or samhain, and be merry.

Cheers,
Tink

TB0ne · 06-21-2011, 06:17 PM

Quote:

Originally Posted by Tinkster

Hi, welcome to LQ!
Why re-invent the wheel? Install AIDE or samhain, and be merry.

Agreed...and Tripwire (mentioned previously), is also great, and my personal favorite.

Tinkster · 06-21-2011, 06:21 PM

Quote:

Originally Posted by TB0ne

Agreed...and Tripwire (mentioned previously), is also great, and my personal favorite.

Wow ... when did tripwire get forked into an OpenSource branch?
I was going to go off on a ramble about it's licence, but it
appears it's GPLed ?

Cheers,
Tink

chrism01 · 06-21-2011, 06:25 PM

Actually, I just took that off the top of my head. when I saw your post I thought maybe I should have said AIDE... Anyway, if the OP comes back, he should get the hint after this lot