Any suggestions on what to run on a centos box to verify that the server isn't compromised or being sniffed? Thanks!
19.2.2012 3:38, Al kirjoitti:> Any suggestions on what to run on a centos box to verify that the > server isn't compromised or being sniffed? Thanks!rkhunter comes to my mind. -- Don't hate yourself in the morning -- sleep till noon.
Al <mailinglist at theflux.net> wrote:>>Any suggestions on what to run on a centos box to verify that the server isn't compromised or being sniffed? Thanks! << For "isn't compromised", you need a host integrity verification system like Tripwire or AIDE (which is in the base repo). Expect to have to tweak the config to cover the stuff you've got installed. You can detect sniffing by checking for promiscuous interfaces on the LAN - use proDETECT (http://sourceforge.net/projects/prodetect/) or a similar tool for this purpose. Alternatively, if you have the time and resources, you could run a full-blown network intrusion detection system like Snort (http://www.snort.org). Best, --- Les Bell [http://www.lesbell.com.au] Tel: +61 2 9451 1144
Al writes:> Any suggestions on what to run on a centos box to verify that the > server isn't compromised or being sniffed? Thanks! > _______________________________________________ > CentOS mailing list > CentOS at centos.org > http://lists.centos.org/mailman/listinfo/centos >This is very handy, especially for web servers: http://www.rfxn.com/projects/linux-malware-detect/ (beware, it's _very_ slow) -- Nux! www.nux.ro