Linux Rootkit/Securing a Linux System

[Gabriel2010]

Hello All,

Got a Red Hat 8 systen with apache, mysql & bugzilla installed, would like to have a rootkit to check for anything odd in the system. It seems there are a couple of rootkits, which one is recommended?

I'm looking to secure this system & its programs, etc (MySQL, Apache, and so on)so any link/info on that is appreciated as well.

Thanks in advance for suggestions & information.

Gabriel


Glad to be here!

 

[thedaver]

Gabriel, you might be misusing a term.

"rootkit" is a tool that a system cracker uses to ABUSE the system. "rootkit" is not commonly known as a term to describe a tool used to secure a system. One might use a "rootkit" to test his work AFTER securing a system....

To secure Redhat, read up here....

Bastille Linux

http://www.bastille-linux.org/

OpenNA's Securing and Optimizing Linux book.

http://www.amazon.com/exec/obidos/redirect?tag=surfinbox-20&path=tg/detail/-/0968879314/

Hacking Linux (Second Edition)

http://www.amazon.com/exec/obidos/redirect?tag=surfinbox-20&path=tg/detail/-/0072225645/

Surfinbox.com Business Internet Services - National Dialup, DSL, T-1 and more.

http://www.surfinbox.com/business/

 

[Gabriel2010]

Yes, you are right, shame on me!!!
Thanks the links, Bastille Linux should be helpful. There are tons of information about securing Linux in the Net. Amazing


Glad to be here!

 

[sleipnir214]

If you are looking for rootkit detectors, there's also chkrootkit and Rootkit Hunter



Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[w1nn3r]

You may also want to use programs like

http://www.tripwire.org/

to check critical system files, using security features like portsentry and logsentry are crucial as well. If its a machine that alot of users are going to have access to you may think about running a 2nd SSHD and disallowing root access to the one run on port 22 to hinder most script kiddies from trying to access root on your machine. Also familiarizing yourself with ipchains/iptables would be a good idea since some daemons have buffer overflow exploits that can be prevented with iptables.