Forum OpenACS Q&A: Re: server security...

Collapse
13: Re: server security... (response to 1)
Posted by Tom Ayles on

David - a couple of useful commands for you:

netstat -a

That'll list all processes that are bound to ports on your machine, regardless of whether they can be seen from outside (eg, iptables filters that port). This is useful to see which services are running on your machine.

rpm -Va

This will check the integrity of all the RPMs installed on your machine. Even a healthy machine will produce some output, so you'll need to analyse the results manually - refer the rpm man pages for what the output means. MD5 mismatches on binaries are quite a bad thing. I had a server at one stage that was misbehaving - turned out to be due to some kind of filesystem problem - and running this command can tell you what's damaged so you can fix it.

I wouldn't rely on either of these commands to tell if your system's been compromised, as a skilled hacker would probably have trojaned these utilities with a root kit to hide their trails. Regardless, the first is good to see what your running, and the second is useful if you suspect accidental system corruption.