Linux OS files Question

the_nu_gurl · 06-14-2006, 09:58 AM

Hi,

I have a question about the linux OS, what system files should be monitored across the board? Currently, I am implementing Tripwire and I just want to start with the basics.

Thanks!

unSpawn · 06-14-2006, 11:02 AM

The first question should be what are you protecting and what other host hardening measures are taken?
An elaborate answer would involve looking at what the majority of rootkits "infect", but in short I'd say /lib, etc, /{sb,b}in, /usr/{sb,b}in,lib, /usr/lib would cover most of the "defaults" IMHO.

BTW, are you sure you want tripwire? It's stale, unsupported, badly licensed, unmaintained, cludgy while Aide (passive) and Samhain (active) are the opposite.

the_nu_gurl · 06-14-2006, 11:44 AM

Well that's what my company purchase..didn't have any input on that. The server has been hardened..Mostly we just want to know when and if someone is accessing critical systems files and such.

I guess I'll try a search on what toolkits infect.

Thnx

unSpawn · 06-15-2006, 08:58 AM

Well that's what my company purchase
I see. The commercial version. Oh well.

accessing critical systems files
On stable servers only some files in /etc will probably need tweaking.
Not to start a discussion, but "critical" can mean different things...

I guess I'll try a search on what toolkits infect.
Covering ninetynine percent of that really is kinda easy.
Just use your grep-fu on the sources of Chkrootkit and Rootkit Hunter.