[asterisk-users] Asterisk executable suddenly about 40KB larger - modules (Andres)

[Stefan Viljoen]

>I would also start by putting an audit rule on the binary. Something like
this:
>auditctl -w /usr/sbin/asterisk  -p war -k asterisk-bin

>then you can get a report on who modified it and when by using:
>ausearch -f /usr/sbin/asterisk

>Its a start, but eventually you might need to monitor even keystrokes with
pam_tty_audit.so to understand who is doing this:
>http://poorlydocumented.com/2014/05/enabling-pam_tty_audit-on-rhel-centos-o
r-scientific-linux/

Thanks I'll keep that in mind.

Just to report back, stopping pre-linking as detailed yesterday and setting
immutable with chattr on the Asterisk executable on the Head Office box here
appears to have solved the problem. The box did not crash this morning as it
did the previous two days and is working fine... strange, but good.

Previous to the problem starting on Tuesday, the box had been running fine
for about three years 24/7 - so I might still have some kind of compromise
going on.

Anyway thanks for the assistance everyone

Regards

Stefan