Kategoriarkiv: Knowledge Base

using updatedb on freebsd – slocate

Udgivet den juli 10, 2004 af black

the updatedb program is named locate.updatedb to fix: cd /sbin ln -s /usr/libexec/locate.updatedb updatedb updatedb

Udgivet i FreeBSD, Knowledge Base, Old Base | Skriv en kommentar

Scan for rootkit

Udgivet den juli 10, 2004 af mike

Use chkrootkit to determine the extent of a compromise. If you suspect that you have a compromised system, it is a good idea to check for root kits that the intruder may have installed. In short, a root kit is … Læs resten →

Udgivet i Knowledge Base, Linux, Old Base | Skriv en kommentar

Finding compromised packages with RPM

Udgivet den juli 10, 2004 af mike

Verify operating system installed files in an RPM-based distribution. So you’ve had a compromise and need to figure out which files (if any) were modified by the intruder, but you didn’t install Tripwire? Well, all is not lost if your … Læs resten →

Udgivet i Knowledge Base, Linux, Old Base | Skriv en kommentar

Verify file integrity and find compromised files

Udgivet den juli 10, 2004 af mike

Use Tripwire to alert you to compromised files or verify file integrity in the event of a compromise. One tool that can help you detect intrusions on a host and also ascertain what happened after the fact is Tripwire (http://sourceforge.net/projects/tripwire). … Læs resten →

Udgivet i Knowledge Base, Linux, Old Base | Skriv en kommentar

Forensics: Create an image of the entire harddisk

Udgivet den juli 10, 2004 af mike

Make a bit-for-bit copy of your system’s disk for forensic analysis. Before you format and reinstall the operating system on a recently compromised machine, you should take the time to make duplicates of all the data stored on the system. … Læs resten →

Udgivet i Knowledge Base, Linux, Old Base | Skriv en kommentar

Record honeypot activity

Udgivet den juli 10, 2004 af mike

Keep track of everything that happens on your honeypot. Once an attacker has fallen prey to your honeypot and gained access to it, it is critical that you monitor all activity on that machine. By monitoring every tiny bit of … Læs resten →

Udgivet i Knowledge Base, Networking, Old Base, Security | Skriv en kommentar

Using honneyd

Udgivet den juli 10, 2004 af mike

Use honeyd to fool would-be attackers into chasing ghosts. As the saying goes, you will attract more flies with honey than with vinegar. (I’ve never understood that saying; who wants to attract flies, anyway?) A honeypot is used to attract … Læs resten →

Udgivet i Knowledge Base, Networking, Old Base | Skriv en kommentar

Apache IDS

Udgivet den juli 10, 2004 af mike

Protect your web server and dynamic content from intrusions. Detecting intrusions that utilize common protocols and services is a job that a network intrusion detection system is well suited for. However, due to the complexity of web applications and the … Læs resten →

Udgivet i Apache, Knowledge Base, Networking, Old Base | Skriv en kommentar

Optimizing snort for high performance / Database

Udgivet den juli 10, 2004 af mike

Decouple Snort’s output stage so it can keep pace with the packets. Snort by itself is fine for monitoring small networks or networks with low amounts of traffic, but it does not scale very well without some additional help. The … Læs resten →

Udgivet i Knowledge Base, Linux, Networking, Old Base | Skriv en kommentar

Stealthing the sensorts

Udgivet den juli 10, 2004 af mike

Keep your IDS sensors safe from attack, while still giving yourself access to their data. Your IDS sensors are the early warning system that can both alert you to an attack and provide needed evidence for investigating a break-in after … Læs resten →

Udgivet i Knowledge Base, Linux, Networking, Old Base | Skriv en kommentar