Those considering Tripwire I would ask they take a look at OSSEC-HIDS; the
filesystem change notification is outstanding and with inotify() support you
get immediate notification of changes. The monitoring and alerting of log
files is also exceptional. I am not affiliated with OSSEC in any way.
http://www.ossec.net/main/about
I would recommend from a "rooting" aspect that kernel module loading be
disabled after boot. This is accomplished by removing the CAP_SYS_MODULE
permission using something like lcap on older systems or by using the sysctl
value of 'kernel.modules_disabled = 1'. This can save a box by preventing
automatic or intentional loading of a vulnerable modules or a module-based
rootkit.
The sysctl value of 'kernel.panic_on_oops = 1' also is a good idea.
Thanks,
John
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
