Are there known methods to safeguard the file?
On most distros, the file is already writable only by the utmp
group, which means only certain programs (usually terminal emulators) can edit it. You could even remove the 'setgid' bit from all of them, which would limit editing to programs that already run as root (i.e. sshd, /sbin/login, XDM).
Are there any other important files on Linux that I should also try to safeguard against hacking?
Have your syslog daemon send logs to a separate machine. Also, keep your system up-to-date. Consider a firewall, SELinux, AppArmor, grsec.
chattr +a ~user/.bash_history
Useless. The user could easily tell bash to write history elsewhere, or even run a different shell than bash. (Some places put readonly HISTFILE
in /etc/bashrc; this is still very easy to get around.)
chattr +i /etc/services
Useless. /etc/services
is only used for one purpose: translating port numbers to service names and back (e.g. in netstat
output); it would be very hard to modify in a malicious way. There are much more sensitive files on your system, including the kernel itself, kernel modules, PAM, sshd, basic utilities like ls
... (Besides, only root can edit that file anyway.)