On Wed, 2004-10-20 at 11:52 -0500, Nicholson, Dale wrote:
<snip>
Can someone help me with where to get a listing of everything I have
installed and the versions?
`ls /var/db/pkg/*/*/*.ebuild | cut -d/ -f5-6 | less`
will list everything you have installed
Also, I need something that can detect root kits etc. on linux. I've heard
knoppix mentioned as having good tools on this list for an example, but I
wouldn't know what tools to use for this particular case.
chkrootkit - http://www.chkrootkit.org
or
rkhunter - http://freshmeat.net/projects/rkhunter
You will also find chkrootkit on knoppix-STD -
http://www.knoppix-std.org
This is what I tried so far:
I logged in using a boot CD, mounted the hard disks, chrooted in, blanked
out the root password in the /etc/shadow file, changed the root password,
rebooted and tried to log in normally. This did not work. I also checked
that the correct users were in both /etc/passwd and /etc/shadow.
Attacker may have modified the login binary, since it's a gentoo box
and the binaries will be self compiled it will be hard to verify this
since I'm under the impression you haven't been performing integrity
checks. I suggest you don't put this install back into production, as since
you are a self confessed novice you will have a hard time cleaning it
out.
Find all the key configuration files and back them up (or use a recent
backup), before a reinstall of the system, then replace everything as
needed. Be sure to verify that the configuration files you restore to
the new install don't have any dodgy modifications, if in doubt re-build
the config from the default config files.
No offence intended but if your admin can't talk you through getting
access to the box again, than maybe you should seek advice from
elsewhere on the running of your machine. Since you have little security
experience yourself getting someone that knows security would be a good
help. Also updating a machine once a week doesn't equate to good
security, if he isn't log monitoring and performing integrity checks,
then you won't know if you are being attacked or not.
Good Luck. :-)
--
Barrie Dempster (zeedo) - Fortiter et Strenue
http://www.bsrf.org.uk
[ gpg --recv-keys --keyserver www.keyserver.net 0x96025FD0 ]
signature.asc
Description: This is a digitally signed message part
