Re: [cobalt-security] Attempted inside job. A report.

["Kevin D" <kdlists@xxxxxxxxxxxxxxx>]

> > I granted that request and tuned my IDS software a little. Just minutes
> after
> > the setup email had been sent (credit card had checked out fine) I got
> paged
> > with the following report from my IDS software:
> >
> > WARNING: --COMPILER ACCESS by user XXXXX!---
>
> What IDS?

Perhaps I should have asked, what IDS's scan for this kind of thing at the
command line? Will snort do this? I don't think it will work with
SSH/encryption, will it?

I'd like to see an IDS that watches the command line, but not of the packet
sniffer variety. Something that logs keystrokes (kindof like a bash_history
typof thing) that will look for certain commands, like SU, or ftp, etc. That
way, whether you use encryption or not, your IDS will pick up those
commands. I think something like this would be much more valuable than a
sniffer-based IDS.

Kevin