Monitoring a file server for intruders

bellsal · 02-19-2010, 10:54 AM

Hello Everyone,

I have built a file server at home and my users data is secured on an encrypted partition. This, of course, only protects the users data if the server is stolen, but doesn't protect the users from network intruders. So, if I want to monitor for such intruders, what logs besides /var/log/syslog/ should I monitor?

Also, is there some free monitoring software (linux) that I can download? For example, nagios?

Thanks in advance,

bellsal

rweaver · 02-19-2010, 11:42 AM

Nagios, Zenoss, Cacti, etc... will monitor the actual server's drive space, cpu, etc... less so security issues.

You probably want to install rkhunter and chkrootkit on the machine and set them up for a nightly run and mail the reports to you. It's also not a bad idea to install an application like tripwire, bsign, or systraq to monitor the system files for changes.

You might want to look at a more robust IDS like snort.

stickman · 02-28-2010, 11:19 AM

You might also look at something like OSSEC, which is a handy tool for collecting and reporting various anomalies.