Re: [CentOS] Check integrity or rootkits on remote server?

["Joshua Gimer" <jgimer@xxxxxxxxx>]

I would run an integrity checker like tripwire, one alternative is aide http://sourceforge.net/projects/aide. If you have another machine at the same location then you could create an NFS share with read-only permissions that you could mount and umount only when you are going to perform the checks, just make sure that the directory on the remote machine has the right permission set and is in an obscure directory. As far as the root-kit detection tools, I don't see why you shouldn't run those too.

On 6/12/06, Marco Fioretti <mfioretti@xxxxxxxxx> wrote:

Hello,

when one has physical access to a computer, he
can run something like tripwire, with keys and
checksum on a separate, write-only media, to
verify the integrity of the system.

What if the system is a remote one (in my case
Centos 4.3 on a User Mode Linux VPS some hundred
of KMs from here)?

Does it still make sense to run tripwire remotely?
If yes, how, since you cannot plug a floppy or USB
drive in the machine?

What if tripwire was never ran? Does it make sense, on
a Centos system without physical access, to download there
and run remotely one of those rootkit detection tools?
Would its findings be surely accurate?

Generally speaking, how does one handle these issues on
remote systems?
Thanks in advance for any comment,

Marco




_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos

-- 
Thx
Joshua Gimer
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos