Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a number of servers (100+) that we need to increase a certain type of security on. (sortof internal, sorry NDA).

We have thought about using a rootkit of some sort that would be able to keep us access if the main root password has been compromised. It is a time sensitive problem (think high SLA).

What we are after is a script that can take a server and password list and add this backdoor to. We have other software to automate other things, but not this unfortunately.

This is NOT a fishing or hacking goal, we own and have full rights to said servers, we just don't know much about scripting or backdoor type stuff :/

share|improve this question

closed as not constructive by Chopper3 Nov 17 '11 at 12:22

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

"This is NOT a fishing or hacking goal, we own and have full rights to said servers, we just don't know much about scripting or backdoor type stuff :/" - Doesn't that just sum up the problem and the solution ? – Antoine Benkemoun Nov 17 '11 at 11:40
I'm stuck in a bureaucratic quagmire but yes that is the case. Unfortunately the solution is not as easy as that, because I'm neither the technical team nor management. I'm in a very shit position :( – Joshua D'Alton Nov 17 '11 at 11:47
You want to install rootkit software to create a backdoor to increase security? OMG... – Robert Merkwürdigeliebe Nov 17 '11 at 11:49
Your idea is not necessarily non-sense but I advise you to read up on the subject big time ! Make sure you are not creating a vulnerability by introducing this "protection". – Antoine Benkemoun Nov 17 '11 at 11:51
I don't have a choice on this. I've been tasked to provide a solution within these guidelines. I'm in the unfortunate position where the powers that be believe there is a solution (thankyouverymuchfuckinghackermoviesthatarebullshit). – Joshua D'Alton Nov 17 '11 at 11:58

So you're defending yourself from a potential vulnerability by introducing another one ?

Adding attack surface won't solve your problem, just use SSH keys, disable password use, store the keys encrypted (and backed-up offline, think usb/cd in a safe), keep you servers updated and you will thwart most attacks.

Every compromised machine MUST be disconnected as soon as possible (think seconds or minutes, not hours !) from your infrastructure and taken to the lab for analysis and maybe recovering files but take care doig that.

share|improve this answer
You don't understand, sorry. It isn't from external attacks, it is from .... 'internal'. I can't say anything more specific due to NDA. I know it seems absurd that this situation exists, but I'm sure you all know of the epic waste of government money that can happen. – Joshua D'Alton Nov 17 '11 at 11:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.