4 ms·
No problem try to make resolv.conf immutable with: chattr +i /etc/resolv.conf Not even root can then change it without removing the attribute (-i) However HI
by nix23 4y ago
No problem try to make resolv.conf immutable with:
chattr +i /etc/resolv.conf
Not even root can then change it without removing the attribute (-i)
However HIDS are really nice to detect stuff like that...and they are not that complicated (OSSEC or samhain)
- Max-Ganz-II 4y agoI'd actually not heard of HIDS before, so now I'm aware of them, I can look into them when there's a good moment to Google a bit. All part of that learning curve :-)