Security Basics: Re: tools to run on compromised linux box

["Sukbum Hong" <sukbum.hong () cdnetworks co kr>]

Hello.

How about this?

These 3 programs are much widely used to check rootkit. 

chkrootkit : http://www.chkrootkit.org/
rkhunter : http://www.rootkit.nl/
rootcheck : http://www.ossec.net/en/rootcheck.html

Please check your kernel version and if your kernel is the lastest version.
Generally speaking, you would be no problem.

reference : 
Linux Kernel "vmsplice()" System Call Vulnerabilities 
http://secunia.com/advisories/28835/


Thanks.



> Can anyone recommend some tools to run on a compromised linux
> box to determine if there is further infestation? (rootkits, etc).