On Wed, Nov 10, 2010 at 3:57 AM, Jakub Moravek <[email protected]> wrote: > Hi everybody, > I was discussing some security issues wit my colleagues. And we > found interresting issue. How is guaranteed integrity of Ossec itself? > Can Ossec somehow discover, that an attacker will replace Ossec with > modified application. Modified Ossec will report during syscheck scan > same size, modification times, checksums, etc. as had original version > of Ossec application. Is there any internal mechanism howto prevent or > discover described situation? > > Jakub
It's extremely unlikely that both the SHA1 and MD5 checksums will match up on a modified version. You could also gpg sign the binaries and check the signature every so often.
