OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: ro hd
From: Ricardo Sediyama (neronSAVENET.COM.BR)
Date: Wed May 03 2000 - 11:43:10 CDT

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

If you want to really lock some directories in (like /bin, /sbin,
/etc), you can try the lids (Linux Intrusion Detection System) kernel
Patch, this Patch will allow you to make some files ready-only or
only append permited (for log files).

You can find lids in www.lids.org. Try it ;-)

Ricardo Sediyama

- -----Original Message-----
From: Focus on Linux Mailing List
[mailto:FOCUS-LINUXSECURITYFOCUS.COM]On Behalf Of
sigippWELLA.COM.BR
Sent: terįa-feira, 2 de maio de 2000 11:45
To: FOCUS-LINUXSECURITYFOCUS.COM
Subject: ro hd

Hi,

Iīm quite new to the whole security thing, so if this idea sounds
crazy, sorry.
Itīs just an idea. Many exploits normally result in changing some
essential
files. So what if these files would be read only? And what if those
files would
be really read only? I mean physically?

There are several directories which contain files which on normal
operation
should never be written (exept for upgrading). These include /bin,
/sbin, /etc
and /boot. These could all be on one hard disk, while others (/var,
/home and
the like) could be on another hard disk. And now the idea/question:
Does anybody
have an idea or an information on how to disable writing (on IDE
devices)? May
be this needs to cut off one wire and/or tie it to ground or some
other level
(+5V?). Or are there disks on the market which have some jumper for
enabling/disabling writing?

O.k., i donīt want to lock me out, so i would enable/disable that
with a key
from outside. May be the never used keyboard disable key.

Well, just an idea.
Greetings
Siegfried Gipp

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.3 for non-commercial use <http://www.pgp.com>

iQA/AwUBORBXHrW5R/HvJs7uEQKzjgCg6HOSP8P5BTg3BFfV3JA2/EzKsSsAn28O
DOT+nkDyWQ/azZ0+abDXrOTL
=RnPR
-----END PGP SIGNATURE-----