4 ms·
And how can you tell if that was the source of your power off?
by chrisper 8y ago
And how can you tell if that was the source of your power off?
- jakobdabo 8y agoBy examining the timestamp on the log file (defined by the --outfile parameter).
- lima 8y agoPowering off will destroy valuable evidence, though, most payloads live in-memory nowadays. Maybe just disable the NIC? It's not going to do much against a determined adversary, anyway. If he's prepared to turn the NIC back on, he would just kill your inotifywatch first.
- jakobdabo 8y agoHonestly, I didn't give it any serious thought, I came up with the idea and quickly executed it as a PoC in a couple of minutes after that compromised npm package incident a while ago. Disabling the NIC is a nice idea too, it should also be much quicker than shutting the machine down, so, please, feel free to make the script better. The only "clever" thing I did was making sure the honey-pot key comes first in the ~/.ssh directory and that it's big (to gain time to poweroff while it's being transmitted to somewhere). Clearly, this is not a protection against a determined adversary.