| 1 |
On Monday 17 July 2006 21:35, Hans-Werner Hilse wrote: |
| 2 |
> Hi, |
| 3 |
> |
| 4 |
> On Mon, 17 Jul 2006 19:36:30 +0100 |
| 5 |
> |
| 6 |
> Dave S <gentoo@××××××××.net> wrote: |
| 7 |
> > How accurate is chkproc? |
| 8 |
> > If you run chkproc on a server that runs lots of short time processes it |
| 9 |
> > could report some false positives. chkproc compares the ps output with |
| 10 |
> > the /proc contents. If processes are created/killed during this operation |
| 11 |
> > chkproc could point out these PIDs as suspicious. |
| 12 |
> > |
| 13 |
> > That fits in with the fact that chkrootkit & rkhunter now report clean (& |
| 14 |
> > also fits in with someone tinkering from the inside !) |
| 15 |
> |
| 16 |
> The problem I see here is that you can't expect chkrootkit to find |
| 17 |
> something when scanning from a clean base (Live-CD) when the only hint |
| 18 |
> you had was an alert from chkproc. You probably would have gotten the |
| 19 |
> alert from chkrootkit in the first place. chkproc inspects the |
| 20 |
> currently running system (and the /proc for the currently running |
| 21 |
> kernel). I.e. if it has no signature for the rootkit itself, it can't |
| 22 |
> find it again from that "clean" kernel. |
| 23 |
> |
| 24 |
> Do you have the possibility to monitor internet connections on an |
| 25 |
> intermediary gateway? I think monitoring it for a few days would give |
| 26 |
> you a better hint if there might be something active. |
| 27 |
> |
| 28 |
> And there are other things to think about. Do you have a webserver |
| 29 |
> running? |
| 30 |
Nope |
| 31 |
|
| 32 |
> CGI scripts? |
| 33 |
Nope |
| 34 |
|
| 35 |
> PHP applications? |
| 36 |
Nope |
| 37 |
|
| 38 |
> Do you have other network |
| 39 |
> reachable services? |
| 40 |
|
| 41 |
Nope none outside of my LAN |
| 42 |
> > Were you running a firewall? |
| 43 |
|
| 44 |
Yep - a netgear router firewall, NAT & state aware |
| 45 |
> |
| 46 |
> The past kernel bugs had very early exploit scripts. It is really a |
| 47 |
> no-brainer to insert a rootkit if something lets you, say, write a |
| 48 |
> script to /tmp and call it by exploitable buffer overflows, badly |
| 49 |
> written CGI... |
| 50 |
> |
| 51 |
> And remember that there's (nearly) no possibility for a positive proof |
| 52 |
> of the non-existence of a root kit. |
| 53 |
|
| 54 |
I am now seriously considering installing tripwire - To be sure of a clean |
| 55 |
tripwire database I know it means a clean install ... gulp ... |
| 56 |
|
| 57 |
> |
| 58 |
> -hwh |
| 59 |
-- |
| 60 |
gentoo-user@g.o mailing list |
Archives