Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I am using ubuntu 10.04.I want to get an alert when someone tries to access my sytem.For example if someone access my system as an ssh user i want to get an alert in my system.How to get this type of alerts?

share|improve this question
1  
What kind of alert do you want? –  Chris Woollard Nov 7 '10 at 8:43

2 Answers 2

up vote 2 down vote accepted

fail2ban is probably the one tool you'll want for this. It works by parsing the logs of popular services (ssh, apache, etc) and looking for login failures.

When it finds a certain number of failures (ie if it sees somebody trying to brute-force their way in over SSH) it can update iptables to block the attacking IP. It can also send out emails to notify you (as you ask).

You can read more about setting it up from here: https://help.ubuntu.com/community/Fail2ban but there are lots of pages on the internet telling you how to do more with it. It's not a simple tool.

Other than that, for any service, if you move it off to an unpredictable port, people will be much less likely to just stumble upon it and be able to start brute forcing it. I run my all my SSH servers in the 40000-50000 port range. I have fail2ban installed too but I've never had anybody find the SSH server yet.

Of course this isn't useful for any service (http will always be expected on p80 for example) so if you're maintaining other users, you have to consider how much extra effort changing the port will cause them.

share|improve this answer

I answered a similar question about running a script on ssh login/logout. Of course that only works for SSH logins.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.