Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I am currently using Ubuntu Desktop 11.04 and enabled the firewall using GUFW. I have also disabled all the unnecessary services. I am connected to the internet and would like to know details of any other systems trying to scan my system for any open ports or for any vulnerabilities. Is there any software which will log this into a file, which I can check?

Note: I am looking for an approach which can be followed by novice users of Ubuntu and not only by experts. GUI is preferred.

share|improve this question
1  
Do not forget about your router being able to log incomming requests! –  Rinzwind Sep 17 '11 at 13:45
    
If there is no router and directly connected to the internet? –  Praveen Sripati Sep 18 '11 at 15:58
1  
I think that is not the wisest decission if you are afraid of ppl scanning your system but now I understand the question ;) I believe you should never ever go onto the web with a system without a router. Even out of the box give better security than a system directly connected. No idea if they are pricey where you live but 20 euro/25 dollars gets me a decent one overhere ;) –  Rinzwind Sep 18 '11 at 16:33
2  
@Rinzwind: The router is likely running linux with more services enabled than an Ubuntu default install and, likely, poorer update policies. Not really much more secure, IMHO. –  Javier Rivera Sep 20 '11 at 17:46
add comment

4 Answers

Try this

sudo ufw logging on

You should see access in /var/log/syslog. But this are raw logs, which only show you individual access. UFW itself hasn't any tool to summarize these access to an useable report. Also I don't know about a tool which can do this.

share|improve this answer
    
/var/log/syslog contains a lot of other logs also. I am looking for an easier approach which would be helpful for those who are new to using Linux/Ubuntu. –  Praveen Sripati Sep 18 '11 at 4:50
    
Let me understand this. You're asking for a GUI tool (which will only let one do what the tool designer thought of) that will enable untrained Linux novices to connect directly to the Internet safely, and show them what's going on (in plain language) as the system (with "all the unnecessary services" disabled) defends itself against all attacks? Without learning how to read logs? I think you seek the impossible. –  waltinator Nov 8 '11 at 9:02
add comment

You may try this http://www.howtoforge.com/intrusion-detection-with-snort-mysql-apache2-on-ubuntu-7.10

Note: It is an old post written for ubuntu 7.10. But will hep you to get an idea about how it works.

share|improve this answer
    
Note: I am looking for an approach which can be followed by novice users of Ubuntu and not only by experts. GUI is preferred. –  Praveen Sripati Sep 22 '11 at 7:57
add comment

Snort is the backend, and different other programs provide a GUI (usually through a web interface) to that. Here is a list of programs that would work: GUI for Snort Unfortunately there are no official ubuntu packages for them, (take care with ossim, that is a completely different package). If I had to build an application now I would first look at http://snorby.org/ because the development of many of the other projects seems to be stalling.

share|improve this answer
add comment

I'd probably use PSAD (port scan attack detector).

I found a fairly easy to follow writeup here:

http://www.cyberciti.biz/faq/linux-detect-port-scan-attacks/

However, it probably isn't for rank novices.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.