Re: [PLUG] Hacked server - recovery

[Carl Johnson <cjohnson19791979@gmail.com>]

dd if-jp_brain of-plug_list

:-)





Sent from my Motorola DynaTAC 8000x

JP Vossen <jp@jpsdomain.org> wrote:

>> Date: Fri, 24 Feb 2012 10:45:04 -0500
>> From: Fred Stluka<fred@bristle.com>
>
>> Is there any advantage of fcheck over tripwire?
>
>Pros and cons.  IMO, fcheck is a *heck* of a lot easier and faster to 
>set up so it removes a lot of the "that's a time-consuming, tedious
>pain 
>so I'll do it later" inertia.  OTOH, it is arguably less secure than 
>some alternatives.  In theory I agree, but in practice, having
>something 
>(fcheck) is hugely better than having nothing (I'll install Osiris Real
>
>Soon Now).
>
>Please go read the 3 slides in my preso, they have a bit more info like
>
>this.
>
>
>> Also, logcheck over logwatch?
>
>The goal is the same.  I haven't used logwatch, but I *think* the way
>it 
>works is to look for stuff it knows and report that.  Can anyone
>correct me?
>
>Having said that, logcheck will blacklist known good stuff and tell you
>
>about the rest, while I think logwatch will only tell you about its 
>whitelist.  Think about that for a sec, because in this context a 
>blacklist is good and a whitelist is bad.
>
>Logcheck (http://www.logcheck.org/), on the other hand, is the 
>application of a concept that I also call "logcheck" for lack of a 
>better name.  My introduction to the concept was from Marcus Ranum and 
>Fred Avolio's 'frequentcheck.sh' for TIS Gauntlet, way back when.  See 
>also my old Windows port of this: 
>http://www.jpsdomain.org/windows/winlogcheck.html.  And I've yammered
>on 
>about this before: 
>http://lists.netisland.net/archives/plug/plug-2009-03/msg00190.html.
>
>The concept is simple.  Given some data (e.g., a log file):
>
>1.1) Remove stuff you know you don't care about
>1.2) Look for things you know you do care about, but then remove things
>
>you don't care about (false positives)
>
>You then get output in two parts:
>2,1) Stuff you don't know about
>2.2) Stuff that is known to be bad
>
>Over time, you "tune" the #x.1 "stuff you know you don't care about" 
>list so you end up with only "known bad" output...until something novel
>
>happens or upstream changes or adds log messages.
>
>Do you see how simple yet awesome that is?  I can't say it's "self 
>tuning" since--hey, you have to write the egrep regular expressions 
>yourself, though if you 'grep' for stuff you can already do that and 
>there are lots of examples.  You never have to audit it to see what it 
>might be missing, it just evolves with your environment very
>organically 
>and seamlessly.
>
>The tricky part for doing this for a growing log file is to not miss 
>anything and no do repeats and there is a 'logtail' tool for that. 
>It's 
>a lot easier to do on a flat file after a complex build or other
>verbose 
>process has completed.  I do this a *lot* and it's great.  There's a 
>trivial 'egrep' implementation in my Windows logcheck port above.
>
>I'd do a PLUG preso on this, but it's only about 10-20 mins...  I've 
>also wanted to do a wikipedia article on it, I just never get to that.
>
>Later,
>JP
>----------------------------|:::======|-------------------------------
>JP Vossen, CISSP            |:::======|      http://bashcookbook.com/
>My Account, My Opinions     |=========|      http://www.jpsdomain.org/
>----------------------------|=========|-------------------------------
>"Microsoft Tax" = the additional hardware & yearly fees for the add-on
>software required to protect Windows from its own poorly designed and
>implemented self, while the overhead incidentally flattens Moore's Law.
>___________________________________________________________________________
>Philadelphia Linux Users Group         --       
>http://www.phillylinux.org
>Announcements -
>http://lists.phillylinux.org/mailman/listinfo/plug-announce
>General Discussion  --  
>http://lists.phillylinux.org/mailman/listinfo/plug

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug