If handed a lemon, make lemonade

If handed a lemon, make lemonade

Posted Apr 10, 2006 15:33 UTC (Mon) by rickmoen (subscriber, #6943)
In reply to: big deal by cate
Parent article: Crossplatform virus - the latest proof of concept

cate wrote:

Are not chkrootkit and rkhunter our ''antivirus''?

They are -- and the characteristics that make them so are the reason I've long advised people that they're in deep trouble if they use such things as anything but an afterthought double-check of separate, primary measures.

The best answer to any (e.g.) manager who want you to run "antiviral" software on Linux/BSD/etc. is that you already are -- and point to your setup of AIDE, Samhain, Prelude-IDS, or your other preferred flavour of file-based IDS. You needn't mention that such aren't exactly what they had in mind, but in fact are a lot more useful. What they don't know won't hurt them, and will help you.

Rick Moen
rick@linuxmafia.com

---

(Log in to post comments)