Latest LQ Deal: Latest LQ Deals
Go Back > Forums > Linux Forums > Linux - Security
User Name
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.


  Search this Thread
Old 05-19-2010, 04:55 AM   #1
LQ Newbie
Registered: May 2010
Posts: 1

Rep: Reputation: Disabled
How to detect webserver hacks etc. / Usefulness of Antivir

Hi all,

Can somebody give me jsut a quick hint (for google search), how to check my webserver if there are dangerous scripts (e.g. via upload) on my webserver.

I wonder if the ususal AV software (translated for Linux) can detect such exploit software? Our company has some licences for Antivir Linux...
Does it make sense to install Antivir for Linux and create a daily cronjob that scans my webfiles/ upload dirs?

Thanks in advance,
Old 05-20-2010, 06:48 AM   #2
LQ Veteran
Registered: Feb 2003
Location: Maryland
Distribution: Slackware
Posts: 7,803
Blog Entries: 1

Rep: Reputation: 422Reputation: 422Reputation: 422Reputation: 422Reputation: 422
Unfortunately, I don't think there is an easy answer to what you're asking. There are programs like chkrootkit or rkhunter that will check to see if the machine has been infected with some known rootkits. There are also programs like Aide or Samhain that will check the files to see if anything has changed, but to be useful those have to be installed an initialized BEFORE you put the server on the web. These are probably closest to what you want to do, but they only detect changes, they don't tell if the changes are hazardous or not. You could also check the checksums of the installed packages for your distro against the published versions to see if they match, but that won't detect any malware that is outside of the distro. As for antivirus, there aren't a lot of viruses for Linux out in the wild. Linux tends to have more issue with trojans and rootkits.

Maybe if you gave us some more details about your existing situation and what you're concerned about we can give some better advice.
Old 05-20-2010, 04:49 PM   #3
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3599Reputation: 3599Reputation: 3599Reputation: 3599Reputation: 3599Reputation: 3599Reputation: 3599Reputation: 3599Reputation: 3599Reputation: 3599Reputation: 3599
I agree. Instead you should harden the host, particularly the web stack components, before exposing the machine to the Wickedly Wild intarWeb: only use off-the-shelf and updated software versions (esp. if based on PHP and other popular interpreted languages) and avoid home-brewn applications unless you know what you're doing, configure all components as tightly as possible (don't enable features you don't really need), use SSL (or stunnel?) if you can, use an application firewall like mod_security, maybe use a reverse proxy and an IDS to watch over traffic. Ensure logging is combined with alerting (Logwatch, SEC, et cetera?) because without logging and alerting you'll be blind until way after the fact. And finally do test your setup (regularly) before exposing services.


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Xscreensaver hacks (looking for old hacks) xr82 Linux - Software 2 01-07-2009 01:32 PM
LXer: The Usefulness Of Linux-Next LXer Syndicated Linux News 0 04-24-2008 04:50 PM
purpose/usefulness of the nobody user? slzckboy Linux - General 6 01-28-2007 10:40 PM
Usefulness of isos? dr_zayus69 General 6 03-13-2006 01:04 PM
Firewall usefulness oneandoneis2 Linux - Security 8 03-03-2005 12:37 PM > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 04:12 AM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration