0

I'm looking for some kind of monitor or intrusion detection to monitor my NAS.

The following things I would like to monitor:

  1. Incoming network traffic (source -> Router -> NAS) from another
  2. country -> E-Mail Alert New users have been created on the system ->
  3. E-Mail Alert Unexpectedly high I / O load -> E-Mail Alert monitoring
  4. service (Apache, MySQL, etc.) -> E-Mail Alert / Service restart

The service monitoring, point 4, I could solve with Monit. But what about the other points?

Is there something ready or does anyone have ideas how something could work together, for example, with Monit?

For example, to point 2, I would like to observe changes to a file which all users may update, e.g., passwd.

I am grateful for suggestions or solutions.

Improve this question

2 Answers 2

Reset to default
2

basically all of this could be done by some scripting and handy linux/unix off-the-shelf tools.

  1. For this point I'm not sure what do you actually mean. Is your server actually router/gateway towards NAS? If it is than you can implement variety of solutions. You can log rule hitting with IPTables for example and use geoip-lookup bash tool to find out from which country certain IP address is. If you encounter occurance of unusual country trigger mail sending with mailx or sendmail... If you would like to do more serious accounting you could use ip-conntrack instead of IPTables for logging purpose.

  2. Script invoked every x min, hours or days which will monitor passwd file. You could monitor syslog or rsyslog as well.

  3. Again script which will monitor output of certain command. But for you it seems that "uptime" would be good enough. And again mailx or sendmail for mail sending invoked from script

  4. 3rd party solution like nagios or monit. Or again writing of your own script which would parse syslog or check status of services.

There are really variety of possible solutions, but again... all depends on your real requirements and skills...

BR, Neven

Improve this answer
1
  • At Point 1: Yes its my own router but it is a closed (black) box (a router from my provider) named Speedport with a http management interface for simple configurations but with out a terminal or shell
    – Floyd
    Commented Aug 7, 2015 at 6:25
1

You can install Zabbix and track the same performance data with it's agent. You can configure Zabbix trigger to track disk I/O load as well. You can also check '/etc/passwd' file for changes with Zabbix as well to check if new users added to the system, or you can do it with the custom script.

Tracking network traffic from another country is the most difficult task here. You can configure your 'iptables' config to block all connections different from your country IP list but it will be messy.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .