Re: [gentoo-server] Intrusion Detection

[Karl Zander]

At 05:14 PM 12/15/2003 +0100, you wrote:
 >> I think I read that AIDE was running on the Gentoo rsync server that was
 >> comprised so running it does seem like good practice.

 >IDS means intrusion DETECTION system, not PREVENTION! It cannot prevent
 >you system from being compromized (but a good configuration and regular
 >critical updates can...) - they only help you to understand what
 >happened, e.g. which files have been altered by a rootkit. Same for the
 >NIDS like snort and prelude...

 >HTH
 >       Florian Huber

I understand its Detection, not Prevention.   AIDE running on the rsync 
server helped the security folks understand what happened.  Prevention 
would be a one inch gap.

-Karl