13

I am currently using Ubuntu Desktop 11.04 and enabled the firewall using GUFW. I have also disabled all the unnecessary services. I am connected to the internet and would like to know details of any other systems trying to scan my system for any open ports or for any vulnerabilities. Is there any software which will log this into a file, which I can check?

Note: I am looking for an approach which can be followed by novice users of Ubuntu and not only by experts. GUI is preferred.

  • 1
    Do not forget about your router being able to log incomming requests! – Rinzwind Sep 17 '11 at 13:45
  • If there is no router and directly connected to the internet? – Praveen Sripati Sep 18 '11 at 15:58
  • 1
    I think that is not the wisest decission if you are afraid of ppl scanning your system but now I understand the question ;) I believe you should never ever go onto the web with a system without a router. Even out of the box give better security than a system directly connected. No idea if they are pricey where you live but 20 euro/25 dollars gets me a decent one overhere ;) – Rinzwind Sep 18 '11 at 16:33
  • 2
    @Rinzwind: The router is likely running linux with more services enabled than an Ubuntu default install and, likely, poorer update policies. Not really much more secure, IMHO. – Javier Rivera Sep 20 '11 at 17:46
  • This is bad advise. Routers commonly contain vulnerabilities - while a properly patched Ubuntu box probably does not! Furthermore, NAT is not security, and with IPv6 you don't even have NAT! – vidarlo Oct 28 '17 at 18:43
8

Try this

sudo ufw logging on

You should see access in /var/log/syslog. But this are raw logs, which only show you individual access. UFW itself hasn't any tool to summarize these access to an useable report. Also I don't know about a tool which can do this.

| improve this answer | |
  • /var/log/syslog contains a lot of other logs also. I am looking for an easier approach which would be helpful for those who are new to using Linux/Ubuntu. – Praveen Sripati Sep 18 '11 at 4:50
  • Let me understand this. You're asking for a GUI tool (which will only let one do what the tool designer thought of) that will enable untrained Linux novices to connect directly to the Internet safely, and show them what's going on (in plain language) as the system (with "all the unnecessary services" disabled) defends itself against all attacks? Without learning how to read logs? I think you seek the impossible. – waltinator Nov 8 '11 at 9:02
0

You may try this http://www.howtoforge.com/intrusion-detection-with-snort-mysql-apache2-on-ubuntu-7.10

Note: It is an old post written for ubuntu 7.10. But will hep you to get an idea about how it works.

| improve this answer | |
  • Note: I am looking for an approach which can be followed by novice users of Ubuntu and not only by experts. GUI is preferred. – Praveen Sripati Sep 22 '11 at 7:57
0

Snort is the backend, and different other programs provide a GUI (usually through a web interface) to that. Here is a list of programs that would work: GUI for Snort Unfortunately there are no official ubuntu packages for them, (take care with ossim, that is a completely different package). If I had to build an application now I would first look at http://snorby.org/ because the development of many of the other projects seems to be stalling.

| improve this answer | |
0

I'd probably use PSAD (port scan attack detector).

I found a fairly easy to follow writeup here:

http://www.cyberciti.biz/faq/linux-detect-port-scan-attacks/

However, it probably isn't for rank novices.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.