Printable View
I have a few hundred Linux servers installed and i am trying to find the best solution for rootkit monitoring on these boxes. Maybe even something that allows for large scale deployments.
I currently run rkhunter but its not enough there are loads of logs and i need something to help me raise red flags and to spot problems quickly.
Any ideas?
I'm not sure if it does everything you're looking for, but Tripwire is a tried and true solution.
I have been looking around a lot and i'm thinking OSSEC seems like a best option to me.
And from their site:
OSSEC is a scalable, multi-platform, open source Host-based Intrusion Detection System (HIDS). It has a powerful correlation and analysis engine, integrating log analysis, file integrity checking, Windows registry monitoring, centralized policy enforcement, rootkit detection, real-time alerting and active response.
It runs on most operating systems, including Linux, OpenBSD, FreeBSD, MacOS, Solaris and Windows. A list with all supported platforms is available here.
If anyone has any other ideas i am all ears.
First and foremost, you need to prevent the intrusions (duh)
Are you running SELinux containers? At least chroot environments for each public daemon?
Use SUID and SGID (carefully) to allow things to read/write where needed without a direct path to root from the user.