Security

Ask something
Discussion Locked

Detect rootkits on your UNIX system

0 helpful
4 replies

by debate

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Have you searched your UNIX system for rootkits? What programs did you use? Did you find any? If so, how did you get rid of them? Tell us about your experiences with fighting rootkits, as featured in this week's Internet Security Focus e-newsletter.Then, rate the usefulness of this column from 1 to 5, with 5 being the highest.

4 replies

by matiu

I use integrit on my Debian system.

I keep the change db on a read only floppy. And update it manually from a different computer after any scheduled changes.

by matiu

Actually I don't keep it on a floppy, that was my plan. But now I see it's 19mb :(

I've just been keeping a backup copy on my laptop but not checking it against the original at all.

I'll have to find some larger read-only media to put it on. Maybe a cd or a remote windows share. Something that can't be mounted writable remotely... :)

by rvk

Chkrootkit is a fine tool when you can trust the integrety of your shared libraries such as on an uncompromised machine with the questionable hard disk mounted for examination. However, if you can't trust your local libraries then you can't trust the results of chkrootkit. When I had my public DNS and SMTP server attacked, I couldn't take it down to remove the drive. Rather, I immediately used a remote trusted machine to download staticly built versions of netstat, ps, ls, sed, awk, etc. and used them on the attacked computer to look for rootkit evidence. After I was reasonably convinced that the libraries on the attacked system had not been compromised, I could more confidently use chkrootkit for an automated confirmation. Following that,I built a replacement computer, pulled the plug on the attacked unit, and re-built my entire security infrastructure from the ground up, including an LRP floppy based firewall, secure remote logging, tripwire database, etc. But nothing ensures security as much as keeping a patched updated system.

by andy520

Hi!
As for me one way - have up-to-date system -
'cause Linux "mutating" to often , second -
there's no more secure system that one not
"powered on" .
Checking your network with ethereal / etherape
sniffers give good result in understandingwhat's
going on , specialy when using different Os in
segment.
Chkrootkit is simple to use but don't forget
it also must be "up-to-dated"
I find must often ps,ls,netstat comands infected
on systems stay open after install before
"secured" - close of useless services and daemons
but here is also not an OS problem - it's human
problem

This discussion is closed to new replies.