Topic: Access log - how to interpret it?

[Mahmood Al-Yousif]

I'm wondering if there is a utility that shows who access my e-smith server from the outsite, ie, attempting to probe or hack or attempted unauthorized access into the server. I searched through this board and couldn't find a reference.

Any help would be appreciated...

regards
Mahmood

[Allen Rapini]

Hi Mahmood

while logged in as root, "tail -f /var/log/messages" will probably show you a never ending stream of denied packets, as well as lot's of additional info. These are informational only, and if you never see them, you might have a false sense of security. If you accept the default security settings of the installation, you should be happy with feature/security balance

Allen

[Filippo Carletti]

You could be looking for an IDS. Snort comes to mind. But beware, more false positives than real warnings.

[Mahmood Al-Yousif]

Thanx for the reply. The tail command certainly does the trick, however I think the tail command would keep the log open and append whatever happens to the server.  What I had in mind is something to filter the log for me and show me what was denied, maybe on a web page where I can make a decision if there was an unauthorized incursion...

[Mahmood Al-Yousif]

Thanx for the suggestion Filippo, I'll look into that and see what happens.

I am new to security, and what started me thinking about this whole thing is a report on GRC.COM which scared the bejesus out of me! So I thought I'd better look into a reporting application to find out if something unauthorized was happening.

So I thought a good place to start is to look for a "filter" or such utility that would read the /var/log/messages and show me any denied requests and more importantly what they mean...

As I am looking at "tail -f /var/log/messages" as I am typing this, I see "server identd[4222]: Successful lookup: 1392 , 143: www" and I have no idea what that means other than someone is possibly looking at my website...

Okay... can anyone guide me where to start the self-education on security? I know I can search for "security" on the net, but I'm lazy!! So point me to a site where you think has "non-technical" information on what to look for, what to do, etc.

I am assured by the several messages I read here that e-Smith does take security very seriously and thus it is more secure than trying to build my own RedHat server... but I would like to know more...

Thanx
Mahmood

[allen rapini]

"swatch" comes to mind, altho I haven't used it. You can find what I think is the right version for you at:
ftp://ftp.rpmfind.net/linux/powertools/6.2/i386/SRPMS/swatch-3.0b4-1.src.rpm

but read the info at this address first:
http://rpmfind.net/linux/RPM/ASP//blackcat-linux/6.2/tools/noarch//swatch-3.0b4-1.noarch.html

Hope that helps, I might even take a look at it myself...

Allen

[robert]

Hi
i would reccomend you install webstats from the contributed modules.
it gives you lots of info about web server.

if you want to know just about breakin attempts issue these commands from a ssh terminal.

cd /var/log
cat messages |grep BREAKIN

Hopefully you will see nothing and return to the prompt.
robert
www.syanpticserver.com