
	ids.mod - Basic host-based Intrusion Detection for Eggdrop 1.3
	      (c) 1999 by Mixter <mixter@newyorkoffice.com>
				VERSION 1.0

This module will currently perform the following tasks:

 * Minutely check all existing remote ethernet interfaces for promisc state.
   These checks can detect remote session hijacking done by tools like hunt,
   juggernaut, etc. They will also detect any promisc ethernet sniffer.

 * Check vital system files for modifications, which are normally never
   altered. This will detect trojan and backdoor versions of these
   files installed by intruders and configuration changes.

Installation:

 Move this directory to eggdrop1.3.xx/src/mod/ids.mod and
 compile eggdrop.. (static eggdrop supported).
 Include the following settings in your config file.

Eggdrop config file settings:
(Copy these into your config file. Below are the module default settings.)

##### IDS MODULE #####
loadmodule ids.so

# [0/1] Enable the file checking
set ids-filecheck 1

# [0/1] Enable the network promisc checking
set ids-netcheck 1

# [0/1] Die on changed system files
# If set to 0, eggdrop will just log an alert and broadcast
# it over the botnet, and only die if it finds promisc flags
set ids-filecheck-lethal 0

# [0/1] When the bot dies, remove crontab settings to prevent restart
set ids-kill-cron 0

# [0/1] When the bot dies, wipe the eggdrop dir to prevent userfile compromise
set ids-self-destructing 0

# A list of the files you want the filecheck to monitor for changes, separated
# ONLY by "," - these should be system files that normally don't change
set ids-files "/etc/inetd.conf,/.bash_history,/etc/rc.d/rc.local,\
/etc/rc.d/rc.sysinit,/bin/login,/usr/sbin/tcpd,/core"
