Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am a novice in Linux who just switched from Windows. Today while I was surfing internet I got a message on screen

"XXX.XXX.XXX.XXX" IP is trying to view your screen. Click yes to continue?

I immediately disconnected and also closed that window. Now I want to know how to retrieve my internet logs to see the incoming IP.

What are the logs I should look at to analyze this? How can I secure the Linux box from further attacks?

share|improve this question
1  
Are you certain it wasn't just a random web popup scam/spam thing? –  Mat Feb 28 '12 at 19:21

1 Answer 1

The normal culprits for looking at the logs are:

/var/log/messages
/var/log/daemon.log
/var/log/syslog
dmesg
/var/log/dmesg
/var/log/Xorg.0.log

Beyond that you will need application specific logs which might be stored in:

/var/log/<app>/

The issue you are facing is that you have enabled remote connectivity to your desktop like Vino which should not be touched unless you really really want it. Against simple attacks Linux is pretty secure but you should not rest on your laurels because software is written by humans and we all make mistakes so:

  1. Don't run more then you need to.
  2. Have a firewall in place.
  3. If something is not used like: Vino remove it completely if possible.
  4. If your machine is facing Internet directly have secure passwords.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.