1–10 of 21 posts
Sometimes the effects of an intrusion are obvious (a blackhat takes down the site), I'm more worried about the case where someone plants something on the system to monitor and send info back out. How would you detect this?
* you have scripts to analyze these logs and notify you if anything suspicious happens. This is faster, can be done more often and is less tedious for you
* you have some reference files somewhere so you can compare checksums
That said, most intrusion attempts are unsophisticated, analogous to a person walking around a parking lot trying car doors to see if any are unlocked.
Tools I've used (it's been a while so some of these may be dated) include logwatch to check for suspicious log activity, portsentry to watch for suspicious connection activity, and tripwire to spot modified system files.
* you use logs so you can be aware of suspicious events at network, system and app level * you have scripts to analyze these logs and notify you if anything suspicious happens. This is faster, can be done more often and is less tedious for you * you have some reference files somewhere so you can compare checksums
Do most people just make a strong password and trust that that keeps the baddies away?
I think one thing that would be interesting would be a utility that checks the checksums of files and contents of directories of various installed components against canonical versions stored elsewhere. Does this exist?
A really skilled intruder won't leave any obvious clues behind if he gets in. You are likely to encounter this only if someone is deliberately targeting your server for some reason. That said, most intrusion attempts are unsophisticated, analogous to a person walking around a parking lot trying car doors to see if any are unlocked. Tools I've used (it's been a while so some of these may be dated) include logwatch to…
* you use logs so you can be aware of suspicious events at network, system and app level * you have scripts to analyze these logs and notify you if anything suspicious happens. This is faster, can be done more often and is less tedious for you * you have some reference files somewhere so you can compare checksums
Logs are great for forensic investigation after one has been alerted to an exception, my question is more about expanding alert coverage to various other suspicious activity. Do most people just make a strong password and trust that that keeps the baddies away? I think one thing that would be interesting would be a utility that checks the checksums of files and contents of directories of various installed components…
* you use logs so you can be aware of suspicious events at network, system and app level * you have scripts to analyze these logs and notify you if anything suspicious happens. This is faster, can be done more often and is less tedious for you * you have some reference files somewhere so you can compare checksums
Logs are great for forensic investigation after one has been alerted to an exception, my question is more about expanding alert coverage to various other suspicious activity. Do most people just make a strong password and trust that that keeps the baddies away? I think one thing that would be interesting would be a utility that checks the checksums of files and contents of directories of various installed components…
Regarding authentication, you could use public/private key auth for ssh. This is stronger than passwords. You could also use two factors authentication (look for yubikey for an example)
And yes, such a tool exist: for instance tripwire.
Earlier quoted context omitted.
Logs are great for forensic investigation after one has been alerted to an exception, my question is more about expanding alert coverage to various other suspicious activity. Do most people just make a strong password and trust that that keeps the baddies away? I think one thing that would be interesting would be a utility that checks the checksums of files and contents of directories of various installed components…
There isn't one single solution to cover all angles. So yes, logs are useful but won't protect you either. And yes, they could help you to discover intrusion. Regarding authentication, you could use public/private key auth for ssh. This is stronger than passwords. You could also use two factors authentication (look for yubikey for an example) And yes, such a tool exist: for instance tripwire.
Custom logs generated by your own app for things like login attempts, etc, are definitely useful for detecting issues. I was referring more to things like apache connection logs, and other logs generated by other programs - I would imagine that there's a huge range of things to look for.
Earlier quoted context omitted.
Logs are great for forensic investigation after one has been alerted to an exception, my question is more about expanding alert coverage to various other suspicious activity. Do most people just make a strong password and trust that that keeps the baddies away? I think one thing that would be interesting would be a utility that checks the checksums of files and contents of directories of various installed components…
Check out http://OSSEC.net , its a host based intrusion detection system. It does everything you described and more. I am slowly working on a better Web UI with real time alerts.
Sad, really. It's mostly due to apathy and no mandate from higher-ups to pursue stronger security, but in general our farm is only strong enough to keep generic attacks at bay. 0-days, man-in-the-middle, hell even some SSL vulnerabilities are possible for us. We have a "security team" so we defer most of the security precautions to them and just keep our base software configured not to let anyone unauthorized in.
However, utilizing host-based as well as network-level intrusion detection tools, combined with kernel-level and userland-level security patches and mandatory security access control policies is the best all-around solution. Grsecurity for kernel patches, an OS base with strong security in mind (many new distros use things like stack-smashing-protecting patches to glibc), snort for network IDS, tripwire/portsentry/others for host-based IDS, SELinux configured for all your hosts to further enforce your access requirements.
And of course, diligence: monitor security lists (particularly the one for your distro/kernel) and update immediately when a patch comes out.