Re: What is the best free HIDS for Debian

2022-05-08 Thread Michael Lazin
malware that resides in memory. Apparmor is included in Debian. Thanks, Michael Lazin On Sun, May 8, 2022 at 11:18 AM Sylvain wrote: > Dear Elmar, > > Thank you for your help. I really appreciate very much. > > I thought a lot about your answer and I feel a bit tricky... I > unde

Re: What is the best free HIDS for Debian

2022-05-08 Thread Michael Lazin
strengthened by key signing which is more common in the Debian community. Thank you. Michael Lazin On Sun, May 8, 2022 at 2:43 PM wrote: > Am 08.05.22 um 20:21 schrieb Michael Lazin:> I think if you have a root > kit it is very unlikely to get rid of it > > without backing up and reimaging

Re: What is the best free HIDS for Debian

2022-05-08 Thread Michael Lazin
Rkhunter does find patterns of known rootkits but it also finds indicators like memory anomalies like I mentioned and it logs each file change from the install, this is why ideally you should install it in a fresh system. Thanks. Michael Lazin On Sun, May 8, 2022 at 3:45 PM wrote: >

Re: What is the best free HIDS for Debian

2022-05-09 Thread Michael Lazin
. This method will not find deleted files so some expertise in the Linux file system is necessary when not using rkhunter. Thanks, Michael Lazin On Mon,May 9, 2022 at 4:04 AM Elmar Stellnberger wrote: > Am 09.05.22 um 00:48 schrieb Tomasz Ciolek: > > 5. have we eliminated other cause

Re: sysadmin in training

2023-05-12 Thread Michael Lazin
r bad scripts there. While I agree pulling third scripts with curl is cringe-worthy I think Ossec HIDS is an exception because it is GNU Public licensed. Michael Lazin .. τὸ γὰρ αὐτὸ νοεῖν ἐστίν τε καὶ εἶναι. On Fri, May 12, 2023 at 3:33 PM Jeffrey Chimene wrote: > On 5/12/23 10:16, Jeremy