Re: [gentoo-security] tripwire-ish portage scanner

[Andrew Gaffney]

Andrea Barisani wrote:
> On Thu, Mar 25, 2004 at 09:16:05PM +0100, Michel Wilson wrote:
>
>>On Thu, Mar 25, 2004 at 02:03:45PM -0600, Andrew Gaffney wrote:
>>
>>>Tom Hosiawa wrote:
>>>
>>>>What about qpkq being compromised itself. As I understand it, in
>>>>tripwire, cryptographic keys are used for the policy file.
>>>>
>>>>Couldn't an attacker mess around with which files qpkq scans?
>>>
>>>That's another good reason for a customer portage-integrated solution.
>>>
>>
>>Oh yeah, that's a little 'detail' I forgot, yes :P
>>The integrity scanner itself can indeed be compromised. There isn't much
>>we can do about this, it's a chicken-and-egg problem. One solution would
>>be a read-only medium to store the scanner on, or a copy of gpg + the
>>signature of the scanner. But that is kind of problematic. And what
>>about an attacker that installs a rootkit so that the scanned files
>>appear to be intact when opened by the scanner, but not when opened by
>>the kernel?
>>To make a long story short, one can never be sure. My opinion is that
>>something along the lines of Tripwire is secure enough in most cases.
>>Tripwire can also be fooled by replacing the binary itself. If the
>>attacker does it right, no-one will notice. I.e. same file size, only skip
>>scanning files that are compromised so that there will still be false
>>alerts upon upgrades, etc.
>>
>>Michel Wilson.
>
>
> I suggest that you look at samhain:
>
> http://la-samhna.de/samhain
>
> It's an excellent file integrity and host-based intrusion detection system
> with advanced features that solves the "chicken-and-egg" problem along with
> other cool gizmos :).

 From the site:

  Support for a stealth mode of operation

Is there a way to make a process not show up in 'ps' output?

-- 
Andrew Gaffney
Network Administrator
Skyline Aeronautics, LLC.
636-357-1548


--
gentoo-security@g.o mailing list