--- Dan Lukes <dan@obluda.cz> wrote:
> >> I need to install an anti-rootkid
>
> If I understand correctly, an intruder need to be superuser to be able
> to install a rootkit.
>
> If our intruders has superuser privileges, they can tamper any
> anti-rootkit.
>
> Is the main reason to install anti-rootkit we count the intruders are
> so dumb to look for one of port's anti-rootkit package before they do
> it's dirt work ?
>
> Or I miss something important ?
>
> Dan
One solution would be to have /var/log/auth.log being tailed out via a serial
port to another computer that is not accessable via a network - or have it sent
to a printer for a permanent hard-copy. It all depends on how much you really
want to do in regard to security.
Cheers, Tim.
____________________________________________________________________________________
Never miss a thing. Make Yahoo your home page.
http://www.yahoo.com/r/hs
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"