tool for checking compromised box

[ScruLoose]

On Fri, Aug 01, 2003 at 08:21:14AM +0800, Louie Miranda wrote:

> Hello,
>
> Is there any Debian package that can check a compromised box?

I imagine it depends on what kind of "compromised" you're looking for.
chkrootkit springs to mind if you think you've been rooted.

integrit or tripwire are pretty cool too, but they're only useful if
installed on a "known clean" system. Since they monitor changes to the
filesystem, they need a snapshot of the "before" picture to compare
against.

HTH
--
,-------------------------------------------------------------------------.

> -ScruLoose- | What makes a person so poisonous righteous <
> Please do not | That they'd think less of anyone who just disagreed? <
> reply off-list. | - Moxy Fruvous <

`-------------------------------------------------------------------------'

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see [url]http://www.gnupg.org[/url]

iD8DBQE/Kc5OGW5/T9+iw4kRAmsnAKDpeUtVSG5IBuyrijVz9j5aChKSJwCfcGN1
Y3QL24EgeG4a6NFKhQe7hcQ=
=mmv9
-----END PGP SIGNATURE-----

[Karsten M. Self]

on Fri, Aug 01, 2003 at 08:21:14AM +0800, Louie Miranda (louie@axishift.ath.cx) wrote:

> Hello,
>
> Is there any Debian package that can check a compromised box?

As previously noted, chkrootkit is one pallative.

Note that once a box is suspect, your trust in any of its output is
equally suspect. You must analyze it from known good media (say, a
Knoppix boot disk).

A mix of chkrootkit, debsums, and the new tripwire replacement (aide,
integrit), would probably be good. Reinstall from known good sources
would be strongly recommended.

Peace.

--
Karsten M. Self <kmself@ix.netcom.com> [url]http://kmself.home.netcom.com/[/url]
What Part of "Gestalt" don't you understand?
Verio webhosting? Guaranteed downtime:
[url]http://www.wired.com/news/politics/0,1283,57011,00.html[/url]
[url]http://www.dowethics.com/r/environment/freedom.html[/url]

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQE/LMW1efG8443k044RAjJMAKCMHwkwLbWMk6PD1xdBlugIO/hnmQCfU66q
QgRcJJUV9I0CostCJpJzLZk=
=Ap5w
-----END PGP SIGNATURE-----