0

I see online recommendations that I look through logs in /var/log for attacks on my webserver, or security issues with the (Ubuntu Linux) system at large, but it would be helpful if I had something that could look for me and email me about anything suspicious.

I have seen some pages about log management software, but I'm not sure what would be effective, especially for someone who is not doing this as a business. What are some good packages to look at? Or does what I'm looking for exist?

Improve this question
2
  • Are you looking for a plain monitoring tool (like Monitorix) – or rather something that takes action itself on defined patterns (like Fail2ban)? Both can configured to send mails on defined events (in fact, I'm using both but not their mail feature ;)
    – Izzy ♦
    Jul 20, 2016 at 21:09
  • Fail2ban looks like the thing. Thanks! Post it as an answer and I'll accept it.
    – Topological Sort
    Jul 22, 2016 at 19:16

1 Answer 1

Reset to default
0

I'm using a combination of Monitorix (for long-term evaluation) and Fail2ban on my machines. Both can send out email alerts, though I'm not using that feature.

For your case, I'd especially recommend Fail2Ban:

  • look through logs in /var/log: Exactly what it does. Already ships with a set of rules which you can extend by your own (using regular expressions).
  • email me about anything suspicious: not only that, it can take immediate precautions – e.g. banning a given "attacker IP" for a specified amount of time (that's behind the name: "X failed logins → Ban!").

It's quite effective, and for me runs as kind of "automatic IDS": bans hackers (web, mail, ssh and more) as well as "leechers", and a lot more. It knows about a bunch of often-used software and its log formats (e.g. Apache, OpenSSH, ProFTP, misc. mail servers), so even out-of-the-box you get something useful. Though most stuff (except for SSH) is "disabled" by default, it takes a few minutes to pick the ones you use and activate them.

Once you've got a bit familiar with it, you even start writing your own rules – and have it interact with other services (e.g. Apache's mod_security: let that throw some "EMERGENCY" type of events, and have Fail2Ban act on them). I can only warmly recommend it.

Improve this answer
2
  • mod_security has a lot of false positives, and I had to comment out or modify many of the rules.
    – cybernard
    Jul 23, 2016 at 4:48
  • @cybernard So did I – but having adjusted it accordingly, it does a great job. mod_security was just mentioned as example here – the recommended software is Fail2Ban :)
    – Izzy ♦
    Jul 23, 2016 at 11:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.