Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

I have a software firewall implemented on my server, and I have closed all unnecessary ports. I have strong passwords, and I validate user input on my website.

With these things already in place, do you recommend I use rkhunter to help detect rootkits? Or would that be unnecessary?

share|improve this question

2 Answers

up vote 5 down vote

Quick Answers
 The quickest answers are: "defense-in-depth", and "plan for failure"

You have protections in place, but what if they fail? What if an attacker finds a way in using a method that you did not anticipate? From these perspectives, then, yes, rkhunter is necessary.

But, then you start asking, "when do I stop adding more protection?"

Right Answers
There is a calculation you have to perform about what the risks are and how probable they are, what the costs are if those risks are realized, and the costs of mitigating those risks. Every piece of protection you put in place needs to be maintained and updated, which is a cost. If those costs are lower than the costs of having an incident, then it is worth it. If not, then you are spending more than you are protecting. This quick calculation is how you determine, "is it necessary?"

Other Options
 There might be other more important considerations, depending on your situation. Logging? Backups? Encryption? Ease of blowing away the server and rebuilding from known good? Web Application Firewalls? Secure web application design (apart from inputs)? Getting a good third-party review of your entire environment might highlight the more important components.

I hope these ideas help.

share|improve this answer
I commend you for recognizing that security is an economic good, with a value, and a price, and an opportunity cost. rkhunter appears to be linux (or maybe linux & BSD & unix) specific. Without knowing what distro the asker uses, the price and opportunity cost are impossible to calculate. – Bruce Ediger Sep 11 '12 at 15:52
@BruceEdiger Why would the distro have an impact on the calculation? – schroeder Sep 11 '12 at 19:11
Suppose the distro is Arch, with a rolllig release and a preference for "cutting edge". It will be harder for someone to write a root kit, as Arch installation continually roll kernel versions and directory structures. – Bruce Ediger Sep 12 '12 at 12:15
And yet Arch itself suggests rkhunter (wiki.archlinux.org/index.php/AIDE). The principle is the same for the OP regardless of distro, and I was not attempting to perform the calculation for him, but to guide him in his own considerations. – schroeder Sep 12 '12 at 14:51
Is that a real suggestion, or a "motherhood and apple pie" suggestion, like early PCI DSS insistence on a "malware checker" on every computer, which was slightly ridiculous for say, Paymentech's Stratus front ends. – Bruce Ediger Sep 12 '12 at 14:58
show 3 more comments
up vote 2 down vote

Yes, you should be using rkhunter (or similar) and also other security tools - how much time and effort depends on the value of the service, but in addition to a firewall I would recommend (as a basic setup):

  • some method for identifying required security patches - an automated solution may seem like a lot more effort - but even for a low value website, you should be checking at least once a week.

  • additional protection for ssh access - of course you have disabled root ssh access and restricted access to only a named group, but it's still a good idea to use port-knocking or fail2ban to cut down on the noise

  • a file interity checker - if you ever do get hacked, this is vital to getting your system back online and secure

  • a rootkit detector

  • regular backups - and do test them to make sure you can get back to a working system

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.