[lfs-support] LFS + Rootkits
loki at pancevo.rs
Sun Apr 8 11:06:50 PDT 2012
First this is not a support request but a live story from someone
using LFS heavily in real life situations and servers and why I would
choose LFS before any distribution based server.
Let me introduce myself. Im into LFS since version number 3 - 4.
Can't remember exactly anymore. A lot of water under the bridge since
then. For the past four years I work for a governmental agency where
I have installed some servers, all running LFS. From version 6.1 -
6.8 (32 and 64 bit) (DNS, WEB, MAIL and so on).
Well after years of using it one of our servers got hacked (because
some of the users didn't pay attention to my ramblings about
usernames and passwords) and a rootkit was installed. When I logged
in and tried to ls I saw that ls gave me a segmentation fault error.
After some more minutes I saw that there are some files that I didn't
install. Then it hit me. "YOU GOT HACKED". But the services still
worked fine. So I put up a very restrictive Iptables on the router
for this server. Just the service could go through. After checking
the log files I figured that the intrusion took place 5 days before
when I had to open iptables for ssh for one of our 3rd party
maintanance crew. So why is LFS better than distros? I made heavily
customizations during the compilations so when the rootkit was
applied none of the new installed apps worked. Not even ls. Because
they were compiled for normal distros and normal shared libs which
you can't use on custom made systems. The baseline is this, the
intruder couldn't make any heavy damage, the services still work, the
intruder was detected (which is very dificult with rootkits, this one
even rkhunter didn't detect), downtime will be only the time when I
extract the non-compromised documents to the new server which even
will be more hardened.
So kids use LFS, it is a great tool and if you are into the business
of servers you will learn how they function, something a distro can't
teach you. And you don't have to rely on someone who you don't know
that he/she did a good job securing the distro or that you missed a
config file and your server is wide opened. LFS + BLFS is just the
beggining, there is a whole world of tarballs on the Internet out
there. GO MAD !!! :-)
More information about the lfs-support