Re: [PLUG] Security breach post morten

[Jonathan Simpson <jonathan@jdsnetwork.com>]

I would enjoy a talk on this topic if someone is interested in presenting.

On Aug 10, 2015 10:12 PM, "Eugene Smiley" <eug.smiley@gmail.com> wrote:

lynis
chkrootkit and rkhunter

On Mon, Aug 10, 2015 at 7:10 PM, Paul Walker <pjwalker76@gmail.com> wrote:

Mostly looking for advice and tools on post-mortem analysis assuming that no special measures were taken during setup (no checksums, snapshots etc)

On Mon, Aug 10, 2015 at 10:08 PM, Eugene Smiley <eug.smiley@gmail.com> wrote:

I just went through a scare a while back, but took horrific notes on the subject.

What I do have written down is a list of various tools, some are only useful if set up before the incident.

lynis
chkrootkit and rkhunter

auditd

afick/aide/osiris/samhain/tripwire/ossec/tiger

fail2ban

logcheck/logwatch

snort

On Mon, Aug 10, 2015 at 6:57 PM, Paul Walker <pjwalker76@gmail.com> wrote:

Assuming that a system has had a security breach, what are tools and procedures that people would use to evaluate filesystem backups and database dumps for the presence of malicious code, unauthorized user accounts, malware, etc?

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug