Ask HN: How do you handle server security/intrusion monitoring?

Re:Ask HN: How do you handle server security/intrusion monit... by ams6110 on Sunday November 22, 2009 @04:54PM (#956258)

A really skilled intruder won't leave any obvious clues behind if he gets in. You are likely to encounter this only if someone is deliberately targeting your server for some reason.

That said, most intrusion attempts are unsophisticated, analogous to a person walking around a parking lot trying car doors to see if any are unlocked.

Tools I've used (it's been a while so some of these may be dated) include logwatch to check for suspicious log activity, portsentry to watch for suspicious connection activity, and tripwire to spot modified system files.

[ Parent | on HN ]

Re:Ask HN: How do you handle server security/intrusion monit... by JoachimSchipper on Sunday November 22, 2009 @05:46PM (#956342)

Tripwire is useful for post-facto detection - at least as long as the attacker doesn't get root - but logwatch defaults to letting stuff through, which means that any change in log formatting by any program means that your "security" suddenly fails.

[ Parent | on HN ]

Re:Ask HN: How do you handle server security/intrusion monit... by ericd on Sunday November 22, 2009 @05:07PM (#956272)

Awesome, those tools sound great. I hadn't heard of anything like tripwire, but it's one of those things that I was hoping existed.

[ Parent | on HN ]