13

I am currently using Ubuntu Desktop 11.04 and enabled the firewall using GUFW. I have also disabled all the unnecessary services. I am connected to the internet and would like to know details of any other systems trying to scan my system for any open ports or for any vulnerabilities. Is there any software which will log this into a file, which I can check?

Note: I am looking for an approach which can be followed by novice users of Ubuntu and not only by experts. GUI is preferred.

5
  • 1
    Do not forget about your router being able to log incomming requests!
    – Rinzwind
    Sep 17, 2011 at 13:45
  • If there is no router and directly connected to the internet? Sep 18, 2011 at 15:58
  • 1
    I think that is not the wisest decission if you are afraid of ppl scanning your system but now I understand the question ;) I believe you should never ever go onto the web with a system without a router. Even out of the box give better security than a system directly connected. No idea if they are pricey where you live but 20 euro/25 dollars gets me a decent one overhere ;)
    – Rinzwind
    Sep 18, 2011 at 16:33
  • 2
    @Rinzwind: The router is likely running linux with more services enabled than an Ubuntu default install and, likely, poorer update policies. Not really much more secure, IMHO. Sep 20, 2011 at 17:46
  • This is bad advise. Routers commonly contain vulnerabilities - while a properly patched Ubuntu box probably does not! Furthermore, NAT is not security, and with IPv6 you don't even have NAT!
    – vidarlo
    Oct 28, 2017 at 18:43

4 Answers 4

8

Try this

sudo ufw logging on

You should see access in /var/log/syslog. But this are raw logs, which only show you individual access. UFW itself hasn't any tool to summarize these access to an useable report. Also I don't know about a tool which can do this.

2
  • /var/log/syslog contains a lot of other logs also. I am looking for an easier approach which would be helpful for those who are new to using Linux/Ubuntu. Sep 18, 2011 at 4:50
  • Let me understand this. You're asking for a GUI tool (which will only let one do what the tool designer thought of) that will enable untrained Linux novices to connect directly to the Internet safely, and show them what's going on (in plain language) as the system (with "all the unnecessary services" disabled) defends itself against all attacks? Without learning how to read logs? I think you seek the impossible.
    – waltinator
    Nov 8, 2011 at 9:02
0

You may try this http://www.howtoforge.com/intrusion-detection-with-snort-mysql-apache2-on-ubuntu-7.10

Note: It is an old post written for ubuntu 7.10. But will hep you to get an idea about how it works.

1
  • Note: I am looking for an approach which can be followed by novice users of Ubuntu and not only by experts. GUI is preferred. Sep 22, 2011 at 7:57
0

Snort is the backend, and different other programs provide a GUI (usually through a web interface) to that. Here is a list of programs that would work: GUI for Snort Unfortunately there are no official ubuntu packages for them, (take care with ossim, that is a completely different package). If I had to build an application now I would first look at http://snorby.org/ because the development of many of the other projects seems to be stalling.

0

I'd probably use PSAD (port scan attack detector).

I found a fairly easy to follow writeup here:

http://www.cyberciti.biz/faq/linux-detect-port-scan-attacks/

However, it probably isn't for rank novices.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .