All Questions
2 questions
2
votes
3
answers
824
views
How to capture not only the mtime but also the ctime when making forensic copies of files?
Context
I'm investigating a compromised Linux box where I found files with malicious code. The file system is too big to just make a copy of the whole block device and so far I'm only interested in ...
- 175
19
votes
3
answers
41k
views
Pros and cons of disabling TCP timestamps
So, lynis informs me that I should unset net.ipv4.tcp_timestamps.
I know that's a bad thing because an attacker could figure out which updates that require restarting the machine I haven't applied, or ...
- 931