3 ms·

I agree that this is a problem and I've been researching this for some time now. Ideally you would want a HIDS system for small deployments (i.e. a single serv

I agree that this is a problem and I've been researching this for some time now. Ideally you would want a HIDS system for small deployments (i.e. a single server) but there doesn't seem to exist too many of those and there's little information about them online (as far as I can find). OSSEC is one example but I'm not convinced it installs too cleanly. At least FreeBSD has a package for it however. Actual configuration would be a mystery. I think information about this sort of stuff (intrusion detection) seems to be hard to come by in general. At least stuff that is written by knowledgeable people. I haven't seen much about it from major vendors either - it seems to be a black box kind of technology. I'd love to have a "lightweight" simple daemon that does this. I guess ideally you would monitor logs for stuff, user and group modifications, cron additions etc.

sliverstorm 11y ago
I tried using AIDE for a while, but it was a mild PITA and I was never convinced an attacker with a brain couldn't just patch the database to hide his changes.
detaro 11y ago
tripwire, rkhunter, ... are relatively simple options. And then hope that your configuration prevents the attacker from getting root or if they do, then they/their automated scripts are not prepared to break them.
- noinsight 11y ago
  RE: hashing files and whatnot: FreeBSD with a high enough securelevel allows you to set files append-only or immutable so that not even root can touch them. But then updating the index becomes problematic, you would need to create delta files (which themselves are also immutable) that contain the changed information and combine the data. Even then, I'm not convinced you could get that much valuable information from a full filesystem hash (or whatever) scan. The amount of information would probably be overwhelming. You would need to apply heuristics or filters. Checking filetypes with libmagic would work, mostly. You could only alert on new executables or whatever, etc..
koide 11y ago
OSSEC requires you to understand how it works. That's good, but means that you have to devote 10 or 15 hours reading docs and testing before being productive with it. I recommend it though

sliverstorm 11y ago

I tried using AIDE for a while, but it was a mild PITA and I was never convinced an attacker with a brain couldn't just patch the database to hide his changes.

detaro 11y ago

tripwire, rkhunter, ... are relatively simple options. And then hope that your configuration prevents the attacker from getting root or if they do, then they/their automated scripts are not prepared to break them.

noinsight 11y ago
RE: hashing files and whatnot: FreeBSD with a high enough securelevel allows you to set files append-only or immutable so that not even root can touch them. But then updating the index becomes problematic, you would need to create delta files (which themselves are also immutable) that contain the changed information and combine the data. Even then, I'm not convinced you could get that much valuable information from a full filesystem hash (or whatever) scan. The amount of information would probably be overwhelming. You would need to apply heuristics or filters. Checking filetypes with libmagic would work, mostly. You could only alert on new executables or whatever, etc..

koide 11y ago

OSSEC requires you to understand how it works. That's good, but means that you have to devote 10 or 15 hours reading docs and testing before being productive with it. I recommend it though