checkout samhain (www.la-samhna.de/*samhain*/) if your feeling really
paranoid.
Kahlil (Kal) Hodgson GPG: C9A02289
Head of Technology (m) +61 (0) 4 2573 0382
DealMax Pty Ltd (w) +61 (0) 3 9008 5281
Suite 1415
401 Docklands Drive
Docklands VIC 3008 Australia
"All parts should go together without forcing. You must remember that
the parts you are reassembling were disassembled by you. Therefore,
if you can't get them together again, there must be a reason. By all
means, do not use a hammer." -- IBM maintenance manual, 1925
On Thu, Sep 18, 2014 at 1:42 AM, Mark Tinberg <mtinberg@xxxxxxxx> wrote:
>
> On Sep 17, 2014, at 10:26 AM, Valeri Galtsev <galtsev@xxxxxxxxxxxxxxxxx>
> wrote:
>
> >
> > On Tue, September 16, 2014 9:40 pm, Always Learning wrote:
> >>
> >> On Tue, 2014-09-16 at 16:41 -0400, Bowie Bailey wrote:
> >>
> >>> Aide does not update it's database file. Whenever you run an init or
> >>> update, it will create a new file. You then have to manually rename
> >>> that file in order to start using the new database.
> >
> > I used aide for some time after tripwire went commercial, stayed without
> > support, and finally a bug (in e-mail...) was discovered. I moved away
> > from aide soon after. You may think of some intrusion detection
> > tool/system that:
> >
> > 1. doesn't keep reference database on the same box (I know, I know, they
> > are signed, etc...)
> >
> > 2. does not rely on binaries living on this same box (think about
> checking
> > these binaries on another, much more trusted box before using them…)
>
> That’s kind of an impossible requirement, any kind of userspace
> measurement of binaries, no matter how many hoops you jump through, have
> the same potential problems that a compromised system can hide from them
> using just the legitimate available APIs. A user space integrity checker
> is only good against malware that isn’t specifically trying to hide itself
> from the checker, which does actually cover a lot of ground, the only way
> to reliably find malware that is trying to be stealthy is offline
> checking. That still doesn’t cover other places where _really_ stealthy
> malware can hide, like in device firmware, that can survive a disk wipe.
>
> Although probably not relevant for CentOS 6 there are some interesting
> tools in the Linux Integrity Measurement Architecture that I have recently
> become aware of but haven’t tested. Apparently with newer versions you can
> store _signed_ hashes of binaries as an xattr that the kernel will check
> itself on open(), since they are signed off-box and the public key is in
> the kernel keyring you get much of the same benefit as AIDE without the
> heavy cron jobs and without any delay in checking, every time the file is
> read it is checked.
>
> —
> Mark Tinberg
> mtinberg@xxxxxxxx
>
> _______________________________________________
> CentOS mailing list
> CentOS@xxxxxxxxxx
> http://lists.centos.org/mailman/listinfo/centos
>
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
