A simple intrusion detection script Post: 302295014

Sponsored Content

Top Forums Shell Programming and Scripting A simple intrusion detection script Post 302295014 by jim mcnamara on Friday 6th of March 2009 10:17:04 AM

03-06-2009

Registered User

I worked on root kit hunter at sourceforge.net for a while. There are similar capabilities in the scripts in that app as well.

You may be missing something essential - as an example:
root kits may change a lot of utilities in /usr/bin to avoid detection. md5sum is one of them. It "knows" how to report the old value for a given system file, even though the file is now completely different. The same is true for ls, find and so on. If you ldd those files and ldd is not corrupt you may see odd libraries linked into them.

I would:
create a separate hidden tree of ls, find, md5sum, etc. that your script points to with it's own version of PATH. Populate the directory with known good versions of the files. If you're even a little more paranoid, consider rebuilding & linking those files statically which eliminates shared library masquerading.

It all depends on your level of exposure - if you're inside a good firewall, my suggestions may be overkill.

jim mcnamara

View Public Profile for jim mcnamara

Find all posts by jim mcnamara

6 More Discussions You Might Find Interesting

1. Cybersecurity

Intrusion Detection - System Call Introspection

can u give me a code for host based intrusion detection using system call introspection...

2. Shell Programming and Scripting

key detection in a script

Heloo every one I want to write a script that detects a key press and mouse click and movement,but I dont know how. The second one is I want to run myscript without writing the shell ie not "sh script.sh" but "script.sh" Can you help me out of here? Thanks in advance.

3. Shell Programming and Scripting

File detection then run script

I am currently running 4 scripts to complete a job for me. Each script requires the finished file of the one before it. For example the first script gets the finished file called model.x, then i would like script2 to start in and use model.x as the input and get model_min.x as the finished...

4. Shell Programming and Scripting

need bash script Intrusion Detection on Linux

Hello all I have a script but I failed on the creation of Script is any is carried out in the shell sends the owner of the server, the message is has been implemented For example, functioned as a detection system intruders but in smaller Is it possible to help if you allow I want the...

5. Programming

Parallel Processing Detection and Program Return Value Detection

Hey, for the purpose of a research project I need to know if a specific type of parallel processing is being utilized by any user-run programs. Is there a way to detect whether a program either returns a value to another program at the end of execution, or just utilizes any form of parallel...

6. Shell Programming and Scripting

Help making simple perl or bash script to create a simple matrix

Hello all! This is my first post and I'm very new to programming. I would like help creating a simple perl or bash script that I will be using in my work as a junior bioinformatician. Essentially, I would like to take a tab-delimted or .csv text with 3 columns and write them to a "3D" matrix: ...

LEARN ABOUT CENTOS

installsieve

INSTALLSIEVE(1) 					      General Commands Manual						   INSTALLSIEVE(1)

 *

NAME

       installsieve - user utility for managing sieve scripts

SYNOPSIS

       installsieve

DESCRIPTION

       installsieve is a utility that allows users to manage their sieve scripts kept on the server.

OPTIONS

       -v <name> View script with the given name. The script if retrieved sucessfully is output to standard output.

       -l  List  all  of  the scripts currently on the server. If one of the scripts is active a arrow is printed indicating that it is the active
       script.

       -p <port> Port to connect to. If left off this defaults to "sieve" as defined in /etc/services.

       -i <file> Install a file onto the server. If a script with the same name already exists on the server it is overwritten.  Upon  sucessfully
       putting	the  script on the server the script is set active. If <file> has the extension .script it is chopped when put on the server since
       sieve names may not contain a '.'.

       -a <name> Set <name> as the active script. The list of available names can be obtained from the '-l' option..

       -d <name> Delete the sieve script on the server with <name>.

       -m <mechanism> Force installsieve to use <mechanism> for authentication. If not specified the strongest authentication mechanism is chosen.

       -g <name> Get the sieve script with <name> and save it to disk with a ".script" extension. If a file with that name already  exists  it	is
       overwritten.

       -u <user> Userid/Authname to use for authentication; by default, the current user.

CMU
								   Project Cyrus						   INSTALLSIEVE(1)