|
About:
The Linux Intrusion Detection System (LIDS) is a
patch which enhances the kernel's security by
implementing a reference monitor and Mandatory
Access Control (MAC). When it is in effect, chosen
file access, all system/network administration
operations, any capability use, raw device,
memory, and I/O access can be made impossible
even for root. You can define which programs can
access specific files. It uses and extends the
system capabilities bounding set to control the
whole system and adds some network and
filesystem security features to the kernel to
enhance the security. You can finely tune the
security protections online, hide sensitive
processes, receive security alerts through the
network, and more.
Author:
Huagang Xie [contact developer]
Homepage:
http://www.lids.org/
Mailing list archive:
http://www.lids.org/?q=node/23
Trove categories:
[change]
Dependencies:
[change]
No dependencies filed
|
|
» Rating:
8.57/10.00
(Rank N/A)
» Vitality: 0.03% (Rank 2216)
» Popularity: 8.03% (Rank 338)
 
(click to enlarge graphs)
Record hits: 78,476
URL hits: 40,983
Subscribers: 204
|
|
Branches
Comments
[»]
love it..
by Jsuthan - Apr 6th 2005 09:16:22
This is a great tools to protect linux system. Basic setup and don't have
to recompile other program to work.. just nice. I looking forward for
sandbox feature from kernel 2.4 to 2.6. which is missing.
Also like to see one technique in future, process isolation via old chroot
method .. using init like process to be isolated into an enviroment. Acting
more like virtual host.
[reply]
[top]
[»]
important bug fix for lids-0.9.7
by Andreas Steinmetz - Jul 9th 2000 13:46:23
There is a problem with the admin tool (lidsadm-0.9.7) included in the
lids-0.9.7 package which does effectively deny switching off lids locally
and reloading of the lids configuration. As I can't reach the author right
now I posted a fix to the lids mailing list. Details and the fix can be
found at:
http://www.egroups.com/message/lids/967
[reply]
[top]
[»]
LIDS - Linux Intrusion Detection System
by Valerio Morettini - Oct 22nd 1999 06:47:50
Even if this is a very early version of this software, i find it quite
intriguing. This will make software like Tripwire or Fcheck obsolete, or at
least redundant. I can't think of a better way of protecting files than
doing it at kernel level (well...read-only media are better i guess :).
Protect your binaries. Protect your kernel file. Protect your lilo.conf.
Now you got a secure system, and all that's left to hope is that your
system was not trojanized BEFORE applying the patch :)
I look forward for the next releases of this patch. Good work guy.
[reply]
[top]
|
