76 reputation
7
bio website
location Germany
age 44
visits member for 2 years, 9 months
seen Dec 19 '12 at 20:27

I studied information science and did computers from the old Commodore VC-20 onwards.

I started during study as pc-admin for DOS, Windows, WfW and all related software and hardware stuff.

Later I switched over to servers, starting with linux-samba and NT 3.5/4.0.

My first job made me a Solaris admin in a huge company with over 500 solaris servers. There I got every day a new interesting problem that I have never encountered before.

My next job brought me into project management and later back to system administration - mainly Linux. It was frustrating to manage a project when you knew that doing the admin`s job yourselv would have the current step finished in less than 30 minutes...

In system administration my first priority is IT-security. I try to make "my" systems as secure, as possible - but they have to be maintainable, too.


Sep
24
awarded  Autobiographer
May
24
awarded  Teacher
May
24
answered Information Security Career tracks - Academically vs. IT certifications
May
24
comment How does changing your password every 90 days increase security?
That is the same result that I got after talking to some security auditing people about the sense of ISO 270001 - especially the password-change policy. It was their opinion that frequent password changes force bad passwords. Whereas a good password does not have to be changed that frequently.
May
11
awarded  Commentator
May
11
comment Physical computer security, how to disable USB ports when the computer is 'locked'?
Even so - do you have that problem if you set your default-runlevel to 3 in /etc/inittab, too? I see no reason to run a graphical GUI on a linux server.
May
10
comment Physical computer security, how to disable USB ports when the computer is 'locked'?
On Linux USB-devices are not normally automounted. Normally you need root-access to do so. What Linux are you talking about here?
May
10
answered Physical computer security, how to disable USB ports when the computer is 'locked'?
Apr
30
answered Integrity monitoring for a LAMP server
Apr
30
comment Is there an IDS based on process patterns?
@Polynomial hey - you are triggering a segfault! Is OSSEC the way to go?
Apr
28
awarded  Promoter
Apr
28
revised Is there an IDS based on process patterns?
reduced question to its core.
Apr
20
comment Is there an IDS based on process patterns?
Snort is network based. Is there nothing like an IDS based on process patterns (HIDS) that reacts like the OOM-killer (killing malicious sub-processes)? That would even lead to a process-based HIPS...
Apr
20
awarded  Editor
Apr
20
revised Is there an IDS based on process patterns?
added "maintain" to "configure"
Apr
19
comment Is there an IDS based on process patterns?
I still think that blacklisting is more easy to maintain in my scenario - have you got some pointers to heuristic process analysis HIDS systems?
Apr
19
comment Is there an IDS based on process patterns?
I just read a little bit on the OSSEC page - this seems to be pretty much like logwatch plus fam/aide/samhain/beltane. I did not find a reference to watch for unusual process patterns though. Can you provide me a pointer to that, please?
Apr
19
comment Is there an IDS based on process patterns?
If you say so. I have attended some advance linux courses with trainers that had many years of real-world experience. They all said that SELinux/Apparmor are too complex to maintain on more than a couple of servers.
Apr
19
comment Is there an IDS based on process patterns?
True - we already have these lines of Defence in place. The strongest line is IMO a good WAF. But I do care about the - what if they break into the last line of defence - how will I be alerted about that?
Apr
19
comment Is there an IDS based on process patterns?
I disliked SELinux after it kept blocking SNMPD from writing to its own log (CentOS 5). The possible attack-vectors are very small in my systems - web server frontend and application server frontend are the places I am worried about. The defined "normal" behaviour is very easy to describe for these.