HI Joshua, OSSEC does that since the early ages. It is part of our rootkit/system anomaly detection. We do not only check that, but we also compare:
-Attempts to bind to every TCP and UDP port. If it can't bind the port (port is used), we check if netstat is reporting it. -Attempt to kill(0), getsid and getpgid every process (from 1 to maxpid). We compare the output of these three system calls with ps and proc (where available). -Compare the output of stat st_nlink with the count from readdir (described in the article). - Attempt to read every file in the system and compares the size read with the one from stat. And a few more... Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Fri, Jun 19, 2009 at 12:30 PM, Joshua Gimer<[email protected]> wrote: > > Pretty interesting, now incorporated into chkrootkit. Does rootcheck > do anything like this currently? > > https://blogs.sans.org/computer-forensics/2009/06/19/directory-link-counts-and-hidden-directories/ > > -- > Thx > Joshua Gimer >
