🚀 go-pugleaf

I'm doing a UNIX security survey...

[I know, I know, everybody and their family from an edu site does
 unix security surveys - but mine is for real, so please at least
 read the questions before skipping this message!]

The situation: I may "inherit" the administration (or be responsible
for a larger part of the administration) of some workstations at my
place of employment, so I have a couple of general questions:

1) What security software do you use?

  I am familiar with cops, crack, and tripwire, and plan to use them
all.  Are there any other free security packages I don't know about?
Are there any commercial packages?  I'm curious at how many sites use
cops, crack, and tripwire.

2) Have you ever been the victim of a breakin?  What happened?  How
did you know you were broken into?

  Basically, I am looking for the number of actual breakins and
attempts that are made, typically.

  I am not looking for specific details.  The answers I'm looking for
in the "what happened" area can be quite general: denial of services
(used up significant cpu time), user's email read, user's files
deleted, relay point to another machine, system crash, system files
altered, we were attacked but resisted, etc.  I'd like to have an idea
of what happens on average.

  For the "how did you know" question: law enforcement told us, system
logs showed unusual activity, other site informed us, user complained
about missing files, cracker left message in motd..., unusal behavior,
extra root accounts were found, etc.

3) The network at work is connected to internet - no news, though :-).
If I am allowed to set up anonymous ftp, what steps do you suggest in
addition to what is mentioned in Garfinkel and Spafford's _Practical
Unix Security_?

I appreciate any answers to any of the above questions.  If there is
interest, I will post a summary (statistics only, with no names).

Respond to:

/-----------------------------------\
| Karl L. Barrus                    |
| barrus@tree.egr.uh.edu (NeXTMail) |
| elee9sf@menudo.uh.edu             |
\-----------------------------------/