Hi!
On Tue, Nov 25, 2008 at 09:02:58PM -0500, 7v5w7go9ub0o wrote:
> I run the "old" hardened toolchain, grsecurity-enhanced hardened kernel,
> rbac control, and jails for anything that accesses the LAN/WAN.(heh... I
> even chroot and kill dhcpcd after 5 seconds). Avira has hundreds of Linux
> rootkit signatures in its database, so I run Avira and Dazuko
> realtime/on-access scanning on my /home directory, the chroot jails, and on
> the portage workspace used during download and compilation.
Wow. While I'm a paranoiac in this sense too, I'm too lazy to do most of
these things. It's good to know there are potential for me to advance on
this way! ;-)
BTW, is your workstation really was under attack (don't counting ssh worms
and the like script kiddie games)? Is there was attacks which was able to
break first circle of protection (GrSec+PaX+toolchain)?
As for me, I decide not to worry about these things (browser chroot, etc.)
for now because on workstation most important information is files in my
home directory... and applications I use (like browser, mail client, etc.)
MUST have access to these files or these applications because nearly
unusable for me. So, even with RSBAC, if my mutt will be owned by some
malicious email, and it will delete/damage files it usually have access to
(like my mailbox :)), that will be _enough_ and make much more damage for
me than installing rootkit. So, I choose to do regular automated backups
and run chkrootkit/rkhunter from cron just for the case they detect
something interesting to play with. :)
--
WBR, Alex.
