Very Computer

by **qa monke** » Tue, 04 Jun 2002 05:32:20

im using openBSD 3.1 as a bridge/packet filter and I recently added
fcheck to monitor directories and files. I set it up to monitor the /etc
directory.
What other directories should I monitor for changes?

thanks,

-bob

by **RSmith65** » Tue, 04 Jun 2002 10:04:25

I would monitor: /etc /bin /sbin /usr/sbin and the crontab directory. If I
could, I'd probably add /usr/bin /usr/local/sbin /usr/local/bin, but these
aren't as important.

Just my $.02.

Roger

by **Damian Mensche** » Wed, 05 Jun 2002 05:24:15

> im using openBSD 3.1 as a bridge/packet filter and I recently added
> fcheck to monitor directories and files. I set it up to monitor the /etc
> directory.
> What other directories should I monitor for changes?

Monitor everything, for starters. Then stop monitoring things that
change too much to be worth monitoring.

Damian Menscher
--

-=#| 488 LLP, 1110 W. Green St, Urbana, IL 61801 Ofc:(217)333-0038 |#=-
-=#| 1429 DCL, Workstation Services Group, CITES Ofc:(217)244-3862 |#=-

by **Tony Earnsha** » Tue, 11 Jun 2002 05:11:46

> Monitor everything, for starters. Then stop monitoring things that
> change too much to be worth monitoring.

Quite. Go read the SANS (www.sans.org, www.giac.org) info. for a month,
then start on your project. If, by then, the two nice young men in the
clean white coats haven't come to take you away to the funny farm, where
life is beautiful all the time ...

Best,

Tony

--

Tony Earnshaw

e-post:

www:
http://www.billy.demon.nl
gpg public key: http://www.billy.demon.nl/tonni.armor

Telefoon:
(+31) (0)172 530428
Mobiel:
(+31) (0)6 51153356

GPG Fingerprint = 3924 6BF8 A755 DE1A 4AD6 FA2B F7D7 6051 3BE7 B981
3BE7B981

Very Computer

what to monitor with host based ids?

what to monitor with host based ids?

what to monitor with host based ids?

what to monitor with host based ids?

what to monitor with host based ids?