Ask HN: How do you handle server security/intrusion monitoring?

Re:Ask HN: How do you handle server security/intrusion monit... by Sanguinez on Sunday November 22, 2009 @05:13PM (#956290)

There isn't one single solution to cover all angles. So yes, logs are useful but won't protect you either. And yes, they could help you to discover intrusion.

Regarding authentication, you could use public/private key auth for ssh. This is stronger than passwords. You could also use two factors authentication (look for yubikey for an example)

And yes, such a tool exist: for instance tripwire.

[ Parent | on HN ]

Re:Ask HN: How do you handle server security/intrusion monit... by ericd on Sunday November 22, 2009 @05:22PM (#956303)

Good tip on the pub/priv key auth for ssh. Also on tripwire. Thanks!

Custom logs generated by your own app for things like login attempts, etc, are definitely useful for detecting issues. I was referring more to things like apache connection logs, and other logs generated by other programs - I would imagine that there's a huge range of things to look for.

[ Parent | on HN ]

Re:Ask HN: How do you handle server security/intrusion monit... by Sanguinez on Sunday November 22, 2009 @06:31PM (#956414)

When I say logs, I mean all sort of logs (network, system, app...). So that include auth logs, apache logs and so on.

[ Parent | on HN ]