Return to security.txt CVS log

Up to [LON-CAPA] / doc

Annotation of doc/security.txt, revision 1.1.1.1

1.1       albertel    1: at some point must update redhat kernel to prevent
                      2: remote users from crashing machine!
                      3: something convenient for exam-anxious students
                      4: 
                      5: /usr/share/config/kcmlocalerc saved as /usr/share/config/kcmlocalerc.rpmsave 
                      6: /etc/X11/xdm/Xsetup_0 saved as /etc/X11/xdm/Xsetup_0.rpmsave
                      7: up to date patches
                      8: 
                      9: 
                     10: 
                     11: /etc/hosts.allow
                     12: /etc/hosts.deny
                     13: 
                     14: nmap
                     15: iptraf
                     16: tcpdump
                     17: ntop
                     18: 
                     19: http://ncb.intnet.mu/security/news03.htm
                     20: 
                     21: * tripwire like md5sum on any subdirectory recursively
                     22:   without following softlinks
                     23: 
                     24: logs
                     25: /var/lib/rpm/
                     26: 
                     27: 
                     28: World-writable files, particularly system files, can be a security
                     29:      hole if a cracker gains access to your system and modifies them.
                     30:      Additionally, world-writable directories are dangerous, since they
                     31:      allow a cracker to add or delete files as he wishes.  To locate all
                     32:      world-writable files on your system, use the following command:
                     33: 
                     34: 
                     35: 
                     36:                        root# find / -perm -2 ! -type l -ls
                     37: 
                     38: 
                     39: 
                     40: 
                     41: 9.3.  Backup Your RPM or Debian File Database
                     42: 
                     43:   In the event of an intrusion, you can use your RPM database like you
                     44:   would use tripwire, but only if you can be sure it too hasn't been
                     45:   modified.  You should copy the RPM database to a floppy, and keep this
                     46:   copy off-line at all times. The Debian distribution likely has
                     47:   something similar.
                     48: 
                     49:   The files /var/lib/rpm/fileindex.rpm and /var/lib/rpm/packages.rpm
                     50:   most likely won't fit on a single floppy.  But if Compressed, each
                     51:   should fit on a seperate floppy.
                     52: 
                     53:   Now, when your system is compromised, you can use the command:
                     54: 
                     55: 
                     56: 
                     57:                                root#  rpm -Va
                     58: 
                     59: 
                     60: 
                     61: 
                     62:   to verify each file on the system.  See the rpm man page, as there are
                     63:   a few other options that can be included to make it less verbose.
                     64:   Keep in mind you must also be sure your RPM binary has not been com­
                     65:   promised.
                     66: 
                     67:   This means that every time a new RPM is added to the system, the RPM
                     68:   database will need to be rearchived.  You will have to decide the
                     69:   advantages versus drawbacks.
                     70: 
                     71: 
                     72: 
                     73: 
                     74: Internal integrity system
                     75: 
                     76: duplicate static logs
                     77: like packages.rpm etc that should never change
                     78: 
                     79: 
                     80: 
                     81: what to do in case of a security breach
                     82: send e-mail to korte@lite.msu.edu for now
                     83: maybe help@lite.msu.edu?
                     84: 
                     85: display warning message to all instructors
                     86: with limited information about nature
                     87: of security breach
                     88: