|
[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]
|
Re: [PLUG] AV software for Linux
|
- From: brent saner <brent.saner@gmail.com>
- To: Philadelphia Linux User's Group Discussion List <plug@lists.phillylinux.org>
- Subject: Re: [PLUG] AV software for Linux
- Date: Thu, 13 Dec 2007 16:04:45 -0500
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:user-agent:mime-version:to:subject:references:in-reply-to:content-type:content-transfer-encoding; bh=GpZuyToKv3AcszoPpu2UADUyto+oy103c7pKgqNhxSs=; b=JTb6fPw3IpTCQQ6CPHCaYvBJlPzm5sXoBvPrzZjvQQf37oGvmTZI3E9JbDFmvSGfQbMuslrSbWieipKSEuuSbtPfLLKnUidVd3utNF+0BLUohkX0PkkGOcV80pL4u1do5vkBOOBF6NJDK/wCyRwWslDYjJGAvcEYQ66y2CTaj+0=
- Reply-to: Philadelphia Linux User's Group Discussion List <plug@lists.phillylinux.org>
- Sender: plug-bounces@lists.phillylinux.org
- User-agent: Thunderbird 1.5.0.14pre (X11/20071022)
Art Alexion wrote:
I'm thinking real root accounts instead of sudo, with no root passwords
distributed to regular users should solve this. For years the users have
been told to save important data to a network drive. That we are not
responsible for lost files on desktops.
the nice thing about sudo though is that you can track activity if you
really wanted to, to some degree. i get a little wary about multiple
people knowing a root password. if someone gets any funny ideas, what's
to stop them? it may be to late. with sudo, you can have at least some
sort of cushion layer there...
.
If you're concerned about nefarious deeds, I'd recommend a HIDS (ie.
Tripwire, AIDE), or if you use Debian, something like Debsums+Tiger. That
should reveal any monkey business.
ditto, highly recommended.
Has anyone used/tried AppArmor?
never bothered to give it a shot but from what i hear, much like SElinux
it's "worth more trouble than it is good". again, YMMV; word of mouth.
and there aren't any viable linux virii, no... and they can't really
propagate, but what happens if you contract one? that user can
potentially be toast. true, it's easily fixed with an rm /home/<foo> and
then restoring the backup but what if that user had sudo access (which
DOES validate your concerns, stewart)? you're looking at a system-wide
audit at that point.
--
Brent Saner
215.264.0112(cell)
215.362.7696(residence)
http://www.thenotebookarmy.org
Bill Gates is to hacking as Sid Vicious was to the Sex Pistols: no talent, everyone hates him, and he's just in it for the fame and money.
___________________________________________________________________________
Philadelphia Linux Users Group -- http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion -- http://lists.phillylinux.org/mailman/listinfo/plug
|
|