LIDS Hacking HOWTO

Xie Huagang, xie@lids.org, http:/www.lids.org/

1. Introduction

• 1.1 What is wrong with the current GNU/Linux system.
• 1.2 What is the idea behide LIDS.

2. Protect File System

• 2.1 Protect important files.
• 2.2 How LIDS protect files in kernel.

3. Protect Devices , Raw I/O access.

• 3.1 Device, Raw I/O in kernel
• 3.2 How to protect by LIDS.

4. Protect Important Process.

• 4.1 unkillable process.
• 4.2 hidden process.

5. Sealing the Kernel.

• 5.1 Sealing kernel with the LIDS.

6. LIDS with Capability

• 6.1 Capability in kernel.
• 6.2 Capability in LIDS.

7. LIDS Security Level in kernel.

• 7.1 two levels in the kernel.
• 7.2 Change security level online with lidsadm.

8. Network security in kernel.

• 8.1 Firewall and routing rules protection.
• 8.2 Disable Sniffer
• 8.3 Port scanner detector in kernel.

9. Intrusion Response System

• 9.1 Allow logging in a security way
• 9.2 hangup the console.
• 9.3 Notify the Administrator by mail and pager.

10. Thanks .