Re: Positive uses for rootkits

["Daniel R. Warner" <drwarner () SLEET LAKEHEADU CA>]

Something I like doing is leaving the kernel source there, but modify it
so it is unbootable. With the availability of the two-kernel-monte on
linux, leaving module support out is now really manditory. If the source
on the system is modified so the kernel won't boot, and an intruder DOES
manage to infiltrate the system and recompile the kernel, at least it
won't get any further than that.
The other thing that I like doing (on x86 boxes) is putting a boot CD in
the drive that is configured to pop the rootfs into a ramdisk and only
use the HDD for file storage etc.
Obviously this requires a BIOS with boot-cd support.

-Dan

Dick Visser wrote:
> So that's why I think it's better to build a minimal, static kernel
> without modules support. And once your kernel is OK and running, remove
> the .config file from your kernel source tree. If someone does get in and
> tries to make a new kernel (with modules support) he cannot simply grab
> the old configfile and add modules support to it.
> If he can make a kernel, at least he will have to configure it right to
> make it behave the same like the static kernel.
> I say this because it is not the first time I made a kernel and found out
> that it was not bootable because of a tiny misconfiguration :)
> Comments on this strategy are welcome.
>
> --
> Dick Visser