This may be a question best answered by a moderator, but here goes.

Is it possible when rebooting to run a system 'restore' from the harddrive of a workstation using dar that would undo what has been done by an LKM rootkit? Where exactly in the boot sequence should this happen?

The application for this is for publicly accessible,internet connected PC's such as libraries etc.

Alternatively would it be better to simply reload files from the file server when the PC boots?


Cheers

MazinOz

If you're considering reloading files from a remote server anyway, another possibility might be simply running from a GNU/Linux live cd, eh? A read-only OS; every admin's dream.

Under windows, there's a tool called Deep Freeze that does this kind of stuff.

I would suggest you look into building a copy-on-write filesystem with the 'writable' portion being a tmpfs (in-ram only). Therefore, on reboot, it reverts to the disk system without any changes made by the previous user.

Dear anomie and Matir

Thank you for your replies. I was aware of Deep Freeze but my impression of it was that it was tied very much to a Windows operating system. If you have it working successfully for linux please let me know.

A fileserver serving from a CD or DVD is also a good option as well as a ramdrive. The PC's are for a charity and have 256mb RAM with only 2 slots and are picky about what RAM works (Dells), Kingston RAM doesn't always work, though it is recommended. If I used Debian Sarge or Fedora Core 5, would performance levels be acceptable if serving from a 2.8G processor with 750mb RAM? Also I have mainly used SuSE but recently tried Fedora and Debian Sarge, both of which are heaps faster than SuSE out of the box for some reason. Though I have done a major overhaul of a number of things in SuSE I have decided to discontinue using it as it STILL has slower performance than Fedora or Sarge, and there is even a project to hack it to make its speed acceptable.

I'm self-taught and still learning heaps, but what is a copy-on-write file system? Also if I have a prototype setup, how do I make a bootable iso image? mkisofs? An outline of steps involved, or some links would be appreciated.

Cheers

MazinOz

Deepfreeze is indeed for Windows. I was merely comparing my suggestion to the functionality offered by Deepfreeze.

Dear Matir

What I think I want is something like a Linux version of this utility, but don't know how to go about achieving this. What do you mean exactly when you say a copy-on-write filesystem?

Thank you

MazinOz

Take a look at unionfs and this Linux Journal article.