Re: what to monitor with host based ids?

From: Damian Menscher (menscher+security@uiuc.edu)
Date: 06/03/02

  • Next message: phn@icke-reklam.ipsec.nu: "Re: This is why businesses should avoid windoze/unix/linux ..." 

    From: Damian Menscher <menscher+security@uiuc.edu>
Date: Mon, 03 Jun 2002 20:24:15 GMT

    qa monkey <byeaw@hotmail.com> wrote:
    > im using openBSD 3.1 as a bridge/packet filter and I recently added
    > fcheck to monitor directories and files. I set it up to monitor the /etc
    > directory.
    > What other directories should I monitor for changes?

    Monitor everything, for starters. Then stop monitoring things that
    change too much to be worth monitoring.

    Damian Menscher 

    -- 
-=#| Physics Grad Student & SysAdmin @ U Illinois Urbana-Champaign |#=-
-=#| 488 LLP, 1110 W. Green St, Urbana, IL 61801 Ofc:(217)333-0038 |#=-
-=#| 1429 DCL, Workstation Services Group, CITES Ofc:(217)244-3862 |#=-
-=#| <menscher@uiuc.edu> www.uiuc.edu/~menscher/ Fax:(217)333-9819 |#=-

    Relevant Pages

    • Re: what to monitor with host based ids?
      ... > im using openBSD 3.1 as a bridgeing packet filter and I recently added ... I set it up to monitor /etc. ... Of course if you're keeping fcheck, ... a better place to ask this question would have been in an OpenBSD ...
      (comp.security.firewalls)
    • Re: what to monitor with host based ids?
      ... > im using openBSD 3.1 as a bridgeing packet filter and I recently added ... I set it up to monitor /etc. ... Of course if you're keeping fcheck, ... a better place to ask this question would have been in an OpenBSD ...
      (comp.security.firewalls)
    • Re: xorg.conf for 1440x900 lcd
      ... I have a new monitor with resolution 1440x900. ... In OpenBSD 4.2, there is no xorg.conf anywhere on the system. ... My understanding is that Xenocara is still built as a monolithic module ...
      (comp.windows.x)
    • Re: xorg.conf for 1440x900 lcd
      ... I have a new monitor with resolution 1440x900. ... In OpenBSD 4.2, there is no xorg.conf anywhere on the system. ... xinit uses a builtin xorg.conf, ...
      (comp.windows.x)
    • Re: bridge0 problem with 100Mbps
      ... tedu wrote: ... and a security-conscious system like OpenBSD is likely to choose to slow ... down network traffic instead of not sending everything to the monitor. ...
      (comp.unix.bsd.openbsd.misc)