Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

452

|

Chapter 13: Simple Intrusion Detection Techniques

Any integrity checker with an untrustworthy database is worthless. It’s

imperative to create this database as soon as possible after installing

the host’s operating system from trusted media. I repeat: installing,

configuring, and maintaining an integrity checker is not worth the

effort unless its database is initialized on a clean system.

Also keep in mind with integrity checkers is that they are not proactive. (Unless one or

more of your perimeter systems is a honeypot—a “sacrificial lamb” that sets off alerts

when compromised so you can prevent other systems from being compromised, too.

However, I wouldn’t count on attackers obliging you by attacking the honeypot sys-

tem first!) In most cases, by the time your integrity checker registers an alert, you only

have a small chance of intervening before a serious compromise occurs. Furthermore,

the attacker may tamper with or altogether suppress the alert before it reaches you.

This does not mean that integrity checking is futile! On the contrary, the first step in

incident response is learning that something has occurred in the first place, and if

you install an integrity checker properly, you do have a better chance of learning

about attacks soon enough to take meaningful action. ...