0

I wanted to know if /var/log/wtmp file can be protected against someone modifying/deleting it. I notice that using 'chattr +a /var/log/wtmp' doesn't work. Are there known methods to safeguard the file?

Are there any other important files on Linux that I should also try to safeguard against hacking?

(What I have done till now is only to chattr +a ~user/.bash_history and chattr +i /etc/services.)

1 Answer 1

1

Are there known methods to safeguard the file?

On most distros, the file is already writable only by the utmp group, which means only certain programs (usually terminal emulators) can edit it. You could even remove the 'setgid' bit from all of them, which would limit editing to programs that already run as root (i.e. sshd, /sbin/login, XDM).

Are there any other important files on Linux that I should also try to safeguard against hacking?

Have your syslog daemon send logs to a separate machine. Also, keep your system up-to-date. Consider a firewall, SELinux, AppArmor, grsec.

chattr +a ~user/.bash_history

Useless. The user could easily tell bash to write history elsewhere, or even run a different shell than bash. (Some places put readonly HISTFILE in /etc/bashrc; this is still very easy to get around.)

chattr +i /etc/services

Useless. /etc/services is only used for one purpose: translating port numbers to service names and back (e.g. in netstat output); it would be very hard to modify in a malicious way. There are much more sensitive files on your system, including the kernel itself, kernel modules, PAM, sshd, basic utilities like ls... (Besides, only root can edit that file anyway.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .