On Sun, 2004-07-25 at 23:21, Norman Nunn wrote: > Scot, thanks to you and others on this. > > I now think my system is actually clean. The activity on this mail list > on security issues in general has been a good learning experience and, > as a result, I have added logsentry and portsentry to my system for > protection and notifications. I took the suggestion and setup the > aliases to send root's messages to me. > > I have also setup chkrootkit to run nightly and mail me the output. My > system has a Linksys router as a firewall, and the mail list traffic on > that subject prompts me to reconsider implementing iptable. The router > "incoming log" shows allot of attempts, and I "assume" from Portsentry > input to the logs, that nothing unwanted gets through the router. There > is that word again. > > I also, used the mail list input on ClamAV, and gave it a try. I am > very careful about what I down load but it identifed a few potential > viruses on unimportant files, not word or mail files. I have removed > them without any consequences, and plan to setup clamd as a protection > notification from future viruses. Freshclam is setup to refresh > nightly, and I will consider running "clamscan -r -i" nightly and mail > the output for root to me. > > I may be going overboard. > > Thanks again > Norm iptables is still a good idea. If by some chance a way through the linksys is found iptables can act as a second line defense. It also gives you a single place to specify what ports are open on the system to the network. Particularly important if you have other systems on the local LAN which could potentially be used as an attack vector. In other words, don't blindly trust everything on your LAN segment. Of course as has been pointed out if you are cutting any ports through your firewall your only protection at that point is good passwords/authentication and patching any known exploits through that service as quickly as possible. The IDS stuff you are doing should let you know if something odd is going on, hopefully before a hole is found. You may have already implemented it but another IDS type package that can be very useful is tripwire. Once it is setup, changes to any files being monitored by tripwire will be reported to you. A little paranoia is good, a lot can be even better! :) -- Scot L. Harris webid@xxxxxxxxxx Never play pool with anyone named "Fats".
