From owner-freebsd-security Thu Sep 16 22:25:27 1999 Delivered-To: freebsd-security@freebsd.org Received: from lariat.lariat.org (lariat.lariat.org [206.100.185.2]) by hub.freebsd.org (Postfix) with ESMTP id B263714F00 for ; Thu, 16 Sep 1999 22:25:23 -0700 (PDT) (envelope-from brett@lariat.org) Received: from mustang (IDENT:ppp0.lariat.org@lariat.lariat.org [206.100.185.2]) by lariat.lariat.org (8.9.3/8.9.3) with ESMTP id XAA06811; Thu, 16 Sep 1999 23:25:06 -0600 (MDT) Message-Id: <4.2.0.58.19990916232349.047c27a0@localhost> X-Sender: brett@localhost X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.0.58 Date: Thu, 16 Sep 1999 23:25:05 -0600 To: "Harry M. Leitzell" From: Brett Glass Subject: Securing a system that's been rooted remotely (Was: BPF on in 3.3-RC GENERIC kernel) Cc: Liam Slusser , Kenny Drobnack , security@FreeBSD.ORG In-Reply-To: References: <4.2.0.58.19990916185341.00aaf100@localhost> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org At 09:28 PM 9/16/99 -0400, Harry M. Leitzell wrote: > No offense, but tripwire is really a bit overrated except if the >person is a script child and hasn't a clue as to what to do. If tripwire >hasn't been set up with the db set on a readonly disk partition and you >gain root, you can set up a KLM to change the db on the fly. securelevel=2 and above disables LKMs, IIRC. --Brett To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message