[Aide] aide 0.11 is generating a VERY large database.
Marc Haber
mh+aide at zugschlus.de
Mon Feb 5 18:02:53 EET 2007
On Mon, Feb 05, 2007 at 03:34:54PM +0000, Bob Hutchinson wrote:
> !/var/log/messages(.[0-9])?(.gz)?
> !/var/log/mail.(log|error|info|warn)(.[0-9])?(.gz)?
> !/var/log/kern.log(.[0-9])?(.gz)?
So your attacker places her root kit in
/var/log/messages.9999999999999 and you won't notice.
Greetings
Marc
--
-----------------------------------------------------------------------------
Marc Haber | "I don't trust Computers. They | Mailadresse im Header
Mannheim, Germany | lose things." Winona Ryder | Fon: *49 621 72739834
Nordisch by Nature | How to make an American Quilt | Fax: *49 621 72739835
More information about the Aide
mailing list