LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 08-04-2015, 03:14 PM   #1
Ulysses_
Senior Member
 
Registered: Jul 2009
Posts: 1,303

Rep: Reputation: 57
How to log as much as possible about connections to your computer


How can one log as much as possible about people looking at one's computer? Eg people doing port scans, or people looking at a web site set up on a home computer?
 
Old 08-04-2015, 03:38 PM   #2
MensaWater
LQ Guru
 
Registered: May 2005
Location: Atlanta Georgia USA
Distribution: Redhat (RHEL), CentOS, Fedora, CoreOS, Debian, FreeBSD, HP-UX, Solaris, SCO
Posts: 7,831
Blog Entries: 15

Rep: Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669
To do "as much as possible" you could run tcpdump / wireshark to capture all packets on all interfaces.

You can of course do less than that (e.g. specify which interface and/or which port and/or which protocol and/or whether it is inbound or outbound packets).

Type "man tcpdump" to get a good idea of what this does.

As you might imagine tracking ALL packets all the time is going to generate a lot of data. Usually you only want to do this for debugging purposes (e.g. you suspect something bad is happening now and want to find out who is hitting you).
 
Old 08-04-2015, 04:02 PM   #3
Ulysses_
Senior Member
 
Registered: Jul 2009
Posts: 1,303

Original Poster
Rep: Reputation: 57
Is there any script that uses tcpdump output to initiate whois lookups and traceroute's to everyone trying to connect?

Even better, what if the uninvited visitor goes to the web site in the home computer, how can some identification info be discovered about them so even if they change IP you can still tell it's them?

Last edited by Ulysses_; 08-04-2015 at 04:04 PM.
 
Old 08-04-2015, 06:36 PM   #4
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 10,659
Blog Entries: 4

Rep: Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941
(Much ...) Better Idea: "Keep them from connecting!"

If a particular service is "open to the public," then obviously you cannot discriminate with regard to exactly who "the public" is. But if you find that the intended limit is less than "the public," you should be cutting them off at the pass.

Likewise, if you find that (unintended members of ...) "the Public" have latched-on to (say...) your ssh port and are hammering user-id's and passwords against it ... as "the Public" is certainly free to do ... then you should close that service such that "user-id's and passwords" are never permitted. Your sshd daemon should require (only) digital certificates, and refuse "user-id/password" as an option altogether.
 
Old 08-05-2015, 02:33 AM   #5
Ulysses_
Senior Member
 
Registered: Jul 2009
Posts: 1,303

Original Poster
Rep: Reputation: 57
Alright, could find the way to stop all services with open ports. But might a web server be an exception that is useful for getting info about intruders if the site is NOT being advertised anywhere and exists for the sole purpose of getting info about intruders?

Last edited by Ulysses_; 08-05-2015 at 02:39 AM.
 
Old 08-05-2015, 02:45 AM   #6
astrogeek
Moderator
 
Registered: Oct 2008
Distribution: Slackware [64]-X.{0|1|2|37|-current} ::12<=X<=15, FreeBSD_12{.0|.1}
Posts: 6,263
Blog Entries: 24

Rep: Reputation: 4194Reputation: 4194Reputation: 4194Reputation: 4194Reputation: 4194Reputation: 4194Reputation: 4194Reputation: 4194Reputation: 4194Reputation: 4194Reputation: 4194
Quote:
Originally Posted by Ulysses_ View Post
Alright, could find the way to stop all services with open ports. But might a web server be an exception that is useful for getting info about intruders if the site is NOT being advertised anywhere and exists for the sole purpose of getting info about intruders?
See "honeypot" as near match.

But if you are making it publicly available as said above, advertised or not, they are NOT "intruders", they are visitors...
 
Old 08-05-2015, 02:48 AM   #7
Ulysses_
Senior Member
 
Registered: Jul 2009
Posts: 1,303

Original Poster
Rep: Reputation: 57
Call them intruder wanna-be's, how do you get as much information as possible about them?

Last edited by Ulysses_; 08-05-2015 at 12:50 PM.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
2 internet connections on 1 computer Roy Purba Linux - Newbie 11 04-20-2012 02:11 PM
Can Apache log simultaneous connections? mickyjune26 Linux - Newbie 4 01-11-2011 10:05 PM
Log ssh connections zanzaricchio Linux - Networking 3 08-16-2010 12:44 PM
How to log network connections with timestamp batbayar Linux - Networking 1 03-17-2010 02:21 AM
iptables log new connections to ports t163r Linux - Security 1 03-25-2007 06:48 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 06:40 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration