As a side note: this is just a thread part of my
main thread which is destinated at securing debian!
Well I assume you have adjusted your syslog configuration. Now you will install and configure logcheck. Logcheck works on the principle of notifying you with EVERYTHING that you told it not to ignore. I like that idea:
Code:
----------------------------------------------------------------------
installed logcheck
----------------------------------------------------------------------
security level: paranoid
email address: linux-admins@example.com
Do NOT create logcheck.logfiles from /etc/syslog.conf
rm /etc/logcheck/ignore.d
rm /etc/logcheck/logcheck.ignore
mkdir /etc/logcheck/ignore.d
touch /etc/logcheck/logcheck.ignore
mkdir /var/lib/logcheck
----------------------------------------------------------------------
----------------------------------------------------------------------
configured logcheck
----------------------------------------------------------------------
adjusted /etc/cron.d/logcheck to do a check every 15 mins
rather than every hour so that it's possible to quickly act
on security and other happenings
created /etc/logcheck/ignore.d/cron:
CRON.*CMD
cron.*CMD
cron.*RELOAD
cron.*STARTUP
created /etc/logcheck/ignore.d/ntpdate:
ntpdate\[.*\]: step time server .* offset .* sec
created /etc/logcheck/ignore.d/postfix:
postfix/pickup\[.*\]: .*: uid=.* from=
postfix/cleanup\[.*\]: .*: .*message-id=
postfix/qmgr\[.*\]: .*: from=
postfix/smtp\[.*\]: .*: to=.*, relay=
postfix/smtpd\[.*\]: connect from
postfix/smtpd\[.*\]: .*: client=
postfix/smtpd\[.*\]: disconnect from
postfix/local\[.*\]: .*: to=.*, relay=
postfix.*User Unknown
postfix.*alias database.*rebuilt
postfix.*aliases.*longest
postfix.*from=
postfix.*lost input channel
postfix.*message-id=
postfix.*putoutmsg
postfix.*return to sender
postfix.*status=
postfix.*timeout waiting
created /etc/logcheck/ignore.d/ssh:
sshd.*: (log: )?.* from localhost
sshd.*: (fatal: )?Connection closed by remote host\.
sshd.*(log: )?Closing connecting to
sshd.*: Accepted publickey for .* from .* port .*
sshd.*: Did not receive identification string from \
192.168.0.82
sshd.*: PAM pam_putenv: delete non-existent entry;
created /etc/logcheck/ignore.d/sysklogd:
syslogd.*: restart\.
created /etc/logcheck/ignore.d/uptimed:
uptimed: moving up to position
uptimed: milestone:
inserted into /etc/logcheck/logcheck.ignore:
authsrv.*AUTHENTICATE
login.*: ROOT LOGIN .*
mail.local
PAM-.*: Access granted to .* for .*
PAM_.*: .* session opened for user .*
PAM_.*: .* session closed for user .*
pam.*: default limits skipped for 'root'
su.*: \+ .*-root
-- MARK --
last message repeated .* times
replaced /etc/logcheck/logcheck.logfiles with:
# these files will be checked by logcheck
/var/log/news/news.crit
/var/log/news/news.err
/var/log/news/news.notice
/var/log/auth.log
/var/log/critical.log
/var/log/cron.log
/var/log/daemon.log
/var/log/emergency.log
/var/log/error.log
/var/log/info.log
/var/log/kern.log
/var/log/lpr.log
/var/log/mail.log
/var/log/user.log
/var/log/uucp.log
----------------------------------------------------------------------
