how to check for a compromised system
Bill Moran
wmoran at collaborativefusion.com
Wed Jun 28 12:57:58 UTC 2006
In response to "Brent" <mrb at bmyster.com>:
> Hello,
> Im running several servers all ranging from FBSD 4.11 through the 5.4 release
> , patched of course. MY question is how do i check a system to see if has been
> compromised ? I have already run a current version "chkrootkit" & found nothing.
You need to plan ahead and install Samhain (or equiv) on the machines _before_
they're deployed so you can detect unauthorized changes.
> The symptom im seeing is yesterday all of a sudden the root user was removed
> from the /etc/passwd file & Im not sure on how to track down what happened. I
> managed to recover from this. Are there any other tools that i can use to
> track down say who did what on the box? files that may have changed & time &
> dates...
Yeah, Samhain and its class of software. Unfortunately, you have to have
it set up _before_ this happens in order for it to be useful.
--
Bill Moran
Collaborative Fusion Inc.
More information about the freebsd-questions
mailing list