How to detect webserver hacks etc. / Usefulness of Antivir
 

Hi all,

Can somebody give me jsut a quick hint (for google search), how to check my webserver if there are dangerous scripts (e.g. via upload) on my webserver.

I wonder if the ususal AV software (translated for Linux) can detect such exploit software? Our company has some licences for Antivir Linux...
Does it make sense to install Antivir for Linux and create a daily cronjob that scans my webfiles/ upload dirs?

Thanks in advance,
Caroline

Unfortunately, I don't think there is an easy answer to what you're asking. There are programs like chkrootkit or rkhunter that will check to see if the machine has been infected with some known rootkits. There are also programs like Aide or Samhain that will check the files to see if anything has changed, but to be useful those have to be installed an initialized BEFORE you put the server on the web. These are probably closest to what you want to do, but they only detect changes, they don't tell if the changes are hazardous or not. You could also check the checksums of the installed packages for your distro against the published versions to see if they match, but that won't detect any malware that is outside of the distro. As for antivirus, there aren't a lot of viruses for Linux out in the wild. Linux tends to have more issue with trojans and rootkits.

Maybe if you gave us some more details about your existing situation and what you're concerned about we can give some better advice.

I agree. Instead you should harden the host, particularly the web stack components, before exposing the machine to the Wickedly Wild intarWeb: only use off-the-shelf and updated software versions (esp. if based on PHP and other popular interpreted languages) and avoid home-brewn applications unless you know what you're doing, configure all components as tightly as possible (don't enable features you don't really need), use SSL (or stunnel?) if you can, use an application firewall like mod_security, maybe use a reverse proxy and an IDS to watch over traffic. Ensure logging is combined with alerting (Logwatch, SEC, et cetera?) because without logging and alerting you'll be blind until way after the fact. And finally do test your setup (regularly) before exposing services.