2

I have installed some servers on LUbuntu 18.04, such as postgresql server, mysql server, vino server, and I may have installed and run some servers without knowing it. I rarely intend them to be accessible from another computer, and haven't taken any measure to configure the servers to make them secure until I can find some time to become familiar with them, so I am worried about the security issue.

How can I monitor, record and check about the ports on my LUbuntu having been scanned or connected to by other computers, either within my local wifi or from the Internet (in case that the machines in my local wifi inside or outside my control are accessible from the Internet)?

For example, a while ago, my vino server wrote messages on stdout that some strange IPs from the Internet managed to break in my local wifi and connected to it. I have stopped running it since then, and still haven't got time and idea to solve that issue. https://askubuntu.com/questions/1067305/is-my-vino-server-being-attacked I have the same concerns about the other servers running on my Lubuntu. So I would like to check and monitor the connections to them, just for finding any problem at the time being (not attempting to solve them until I acquire some knowledge and skills).

1

The question you are asking is usually a much broader thematic from an network/sysadmin admin point-of-view, and depends on your needs, size and security policies.

Log generator solutions on your network for detecting intruders can range from:

  • application specific logs;
  • device specific logs (e.g. firewalls, routers, ...)
  • authentication logs
  • DHCP/DNS logs
  • iptables logs
  • Intrusion detection solutions (IDS)
  • honey pots
  • netflow solutions

As for collecting those logs, you usually can have:

  • a central syslog server;
  • a netflow collector
  • solutions correlating your logs with external events (for instance IP security blacklists).

However, from your question description, I would be more concerned on firewalling/separating effectively the internal network from the Internet.

As for giving hints about specific and interesting tools in the area of security/intrusion systems, have a look at:

How PSAD detects attacks?

Detecting port scans can accomplished by sniffing packets off the wire. This is the method used for many Intrusion Detection Systems. In this case PSAD simply reads syslog. The syslog messages are generated by IPTables firewall logging. The PSAD scripts parse the logs to find relevant information and creates simple reports.

In the world of information security, the most common intrusion detection system (IDS) you will ever encounter is Snort. As you probably already know, an IDS works similarly to antivirus (AV) software on your desktop; It attempts to identify malicious software on your network and warns you of its presence.

How to Install and Configure OSSEC on Ubuntu Linux

OSSEC is an open source host-based intrusion detection system that can be used to keep track of servers activity. It supports most operating systems such as Linux, FreeBSD, OpenBSD, Windows, Solaris and much more. It is used to monitor one server or multiple servers in server/agent mode and give you a real-time view into what’s happening on your server. OSSEC has a cross-platform architecture that enables you to monitor multiple systems from centralized location.

Suricata

Suricata is a free and open source, mature, fast and robust network threat detection engine.

The Suricata engine is capable of real time intrusion detection (IDS), inline intrusion prevention (IPS), network security monitoring (NSM) and offline pcap processing.

Suricata inspects the network traffic using a powerful and extensive rules and signature language, and has powerful Lua scripting support for detection of complex threats.

With standard input and output formats like YAML and JSON integrations with tools like existing SIEMs, Splunk, Logstash/Elasticsearch, Kibana, and other database become effortless

see also The honeynet project

PS My internal network at home is completely firewalled from the outside, and the only way of getting in/using internal services (SSH/Web site/voIP/VMs/temperature sensors) is via an IPsec VPN.

If I can avoid it, I never expose web servers or SSH services to the Internet-at-large.

VNC-based solutions are also inherently insecure and not meant to be exposed in the Internet.

psad should be interesting for a small network, maybe suricata, try running your own DNS service and watch the logs

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.