security script

[Paula J Frazer-Campbell]

Hi to all.

I am looking at writing a script that will on being run FTP copies of system log files to another server. So that in the event of a security problem I can concentrate on fixing and bring the attacked sever back on line and then later do an offline investigation.

Well guys/gals what are your thoughts on this?

Is it feasible to set up a list of all the files that may show an intruders footsteps?

And if so which file do you include - some are very obvious (wtmp,btmp,syslog etc)but what are the less obvious?

Awaiting your ideas-
Paula

[CHRIS_ANORUO · Accepted solution]

You can use /var/adm.inetd.sec to restrict access to your system. It provides additional security.
Also check /var/adm/sulog.

[Ossie de Jongh]

Hi Paula,
Your problem will be as follows:
If someone gets into the system, he/she will always try to wipe their prints. So depending on what level of access they get to you system will basically determine how well they can wipe their prints. Most damaging obviously being root.

Besides they few obvious ones like wtmp,btmp,etc you should consider copieng some of these files as well:
passwd
shell history commands
acct files
crontab - yes nice way to reinstate access
syslog
maillog
nettlogs

This list might vary a lot depending on the setup of your system
Like: is accounting enabled?
are you running a secure system ?
etc

Hope you find some info to be usefull.

[Paula J Frazer-Campbell]

Hi and thanks to Chris and Ossie so far.
- points will be awarded.

The list so far is:-

1. wtmp
2. btmp
3. utmp
4. utmpx
5. syslog.log
6. passwd
7. groups
8. shell history
9. mail.log
10. netlogs
11. sulog
12. inetd.sec
13. crontab

Now the list is mainly log files, how about.

ll ?R |grep ?ATTACK_DATE? >attacked

and this file included in the routine?

[Rick Garland]

There is a SW app called Tripwire that will keep tabs on what has been modified. You can configure the files it is to watch and it can tell you if changes have occurred.

Can be obtained from the COAST security site.

[Paula J Frazer-Campbell]

Thanks Chris Ossie and Nick,

Points have been awarded.

Best wishes
Paula

[Paulo Afonso Bruno]

Rick

do you know what is internet address this sw ( SW Tripwire ) ?

thank?s
Paulo

[Paulo Afonso Bruno]

Rick

do you know what is internet address this sw ( SW Tripwire ) ?

thank?s
Paulo

[Paulo Afonso Bruno]

Rick

do you know what is internet address this sw ( SW Tripwire ) ?

thank?s
Paulo

[Paula J Frazer-Campbell]

Hi
Address for tripwire is
http://www.tripwiresecurity.com/products/

[Paulo Afonso Bruno]

Thanks Paula