It is an age since I last announced this program and I should have got back sooner. Better late than never. check-ps is a program that tries to blend in with the background and runs ps every so often (as nobody). It compiles its own list and compares the two. If suspect differeneces turn up it yells at the administrator by email via another machine (it uses port 25 to avoif local logs). It will optionally kill the processes. Anti=race condition code is there but it has not been tested much. The code is avialable by anonymous ftp from mars.astra.co.uk in the pub/word2x directory. Any relationship with the previous version of eons ago is remote. Much of the size is due to massive paranioa coding everywhere. On linux it will probably tell you where the cracker is connecting from if he/she overruns a buffer of a network service and the local port number (so you know exactly which service was involved too...) -- Duncan (-: "software industry, the: unique industry where selling substandard goods is legal and you can charge extra for fixing the problems."
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 13:52:45 PDT