I've found some rootkits, but it all cannot compile and install in kernel 2.4, I use RHEL3.

Why are you planning to installing a rootkit on the system?

I want to know how to defence the attack

//Moderator.note: links removed, three lines. If people are motivated to work with LRK's they'll find the info and kits anyway. But, like I have said before and say in my reply below, LQSEC is more about "white hat" stuff than anything else and I would like to keep it that way. I do not want to see external links on LQSEC to root kits or any other (clearly labelled as) subversive toolage anywhere (if unsure ask or just post and let the moderators decide). BTW, this should not be misinterpreted as me chiding you: that is not the case.


With some googling you will find the sources.

I've found some rootkits, but it all cannot compile and install in kernel 2.4, I use RHEL3.
That's good to hear :-]


I want to know how to defence the attack
Then read up on how to harden your system in general and make the changes. *After* that play with rootkits if you like. The other way around makes no sense.


Please note Linux - Security is more about prevention, mitigation and recovery, more of a "white hat" kind of forum if you will. This means (potentially) damaging subversive activities including help like direct questions about getting a specific rootkit to work will not be tolerated anywhere on LQ: read the LQ Rules if unsure. What I'm saying is if you want to prevent stuff we're glad to discuss it here, but if you want to break stuff you're on your own. There's plenty of cracker boards anyway.
* If I've got the situation all wrong don't hesitate to discuss it, but please be verbose.

No problem, I understand.
Cheers