0
votes
1answer
48 views

Faillog - unsuccessful login count in Motd

I wish to include a count of failed login attempts whenever a user logs in. I've created: /usr/local/bin/dynmotd which contains #!/bin/bash FAILLOG=`faillog -u` echo -e " $FAILLOG " and ...
3
votes
3answers
59 views

Monitor all login attempts

Few weeks ago I thought it would be a good idea to write a script to send me an email whenever some user logs in into my server. So I came with a perfectly working script notifyLogin.sh, then I ...
2
votes
1answer
565 views

What audit log files are created in linux to track a users activities?

One of the machines on our networks was consuming a large amount of Internet bandwidth. However no user was using the system. When I connected to the server using SSH and ran who it showed that a ...
4
votes
3answers
272 views

Hidden Files&Directories in user's home directory [closed]

I am in my user's home directory, I do: ls -a Then it shows me large number of hidden files and directories in my user's directory. Which of them I am allowed to remove? Which ones are necessary ...
2
votes
1answer
160 views

Was my Unix server compromised?

Someone asked if this constituted a break-in and wondered if their server had been compromised. Jan 12 04:16:51 foo sshd[26725]: Failed password for root from 61.174.51.207 port 1076 ssh2 Jan 12 ...
4
votes
2answers
152 views

Finding the logs in a hacked server. [closed]

My server has been hacked and the hacker managed to ssh as root (I know, horrible mistake on my part). What files should I be looking for to discover the origin of the attack? (At least their IP). ...
2
votes
1answer
437 views

AIX 6.1 — Without root can I get the last failed login for a user i have access to?

I know the information is in the security files but I don't have access and it's more work then I want to do to go to our Unix admins to get the information (everytime the account gets locked which is ...
4
votes
3answers
432 views

Logging when limit Exceeds

Is there a log file that logs information when the values set in /etc/security/limits.conf are exceeded? If not is there a way to make it log when the values are exceeded?
7
votes
3answers
537 views

Uncover sudoer user with root privileges which ran command X?

I'm the main sysadmin of a system. In the system there are 3 sudoers users with root's privileges. The system runs a script in background which check the hash of system's utilities to detect possible ...
1
vote
1answer
88 views

Monitoring an under attack Server thorugh a remote endpoint

I have this Debian server that is constantly under attack as shown in its /var/log/auth.log file. I was wondering if there is a best practices of monitoring it through sending all important log ...
7
votes
4answers
295 views

Which data should be excluded from log files , error messages etc. if posted online?

What data should one erase from log files, error messages etc., if posting them as a screenshot so as not to expose sensitive information? As I have little knowledge about this topic, I can vividly ...
4
votes
3answers
336 views

Is a command's stdout to the terminal being logged?

I am interested in learning whether a command's output to the terminal is logged somewhere. Since that can be a bit too generic, what about cat (and ccat) in specific? If I use cat on a file, will ...
0
votes
1answer
196 views

Intruder nature detection by opensource tools like tripwire

I want to use different kind of intrusion detection tools like OpenSource Tripwire. Please suggest me some tools which can provide me some additional information to that provided by tripwire? ...
2
votes
2answers
76 views

Checking integrity of my server data

I want to make a log to detect the nature of intrusions into my Unix/Linux based server. For that I want to learn some tools like Open Source Tripwire and OSSEC. Please suggest to me similar tools. ...
1
vote
1answer
749 views

Is there a way to report incorrect login attempts in Ubuntu 12.10?

I am concerned with some people trying to access my laptop while I am away in my work place. Therefore I was wondering if is there a way to set up kind of automatically monitor and report wrong ...
0
votes
1answer
71 views

What to make of system scans reported by psad

My system logs show that psad detects scans like this every minute. psad: scan detected: 192.168.1.10 -> 192.168.1.1 udp: [53] udp pkts: 2 DL: 2 If the first address is mine, and the second ...
3
votes
1answer
193 views

In my secure log there is a new group added that Im unsure about after adding semanage

I installed semanage onto my CentOS 6.2 box and I was going through my secure log after the install and noticed this entry: Aug 31 22:12:17 xxxx groupadd[12929]: group added to /etc/group: ...
2
votes
3answers
2k views

Making sense of auth log

I am seeing some log enties that look like hacking attempts Type 1 Dec 26 03:09:01 ... CRON[9271]: pam_unix(cron:session): session closed for user root Dec 26 03:17:01 ... CRON[9308]: ...
8
votes
3answers
5k views

How can I track who SSH'es into my linux machine?

I'm running Ubuntu 10.04. Is there a way I can get a daily report of who has logged onto the box, what time, and even - this may be asking too much - a report of the commands they used? This is a ...
0
votes
1answer
2k views

How to really security a linux-mint-desktop?

I'm installing some security software in my mint9Gnome. I first went to Firestarter and looks like a pretty start. Now I'm going to OSSEC and want some good tools to search my logs too. Thinking ...
9
votes
1answer
649 views

Log every invocation of every SUID program?

I would like to have a log file that contains an entry for every time a user runs any suid program, containing the user name, the program and any command line arguments passed to it. Is there a ...
9
votes
5answers
842 views

Monitoring activity on my computer.

So recently I found that someone has been using my computer without consent, browsing folders, etc.... I could change all my passwords straight away, but I'm curious as the what the intruding party ...