1

Ubuntu Server with Apache, hosting multiple websites and mail-servers.

Besides /var/log/auth.log, are there other places where break-in attempts are logged?

Context: I used to have a lot of break-in attempts. Then I disabled password login for root. Now, I only log into root via SSH keys. Plus there are no non-root user accounts.

I don't see break-in attempts in /var/log/auth.log any more. This is odd to me because I'm aware of people still trying to break into my server.

So my question is, under my new authentication mechanism:

  1. is it that "would-be-breakers" are unable to get to the point in my server where their attempts would be logged?

  2. or is it that I'm looking in the wrong log file (/var/log/auth.log)?

If (2), then where should I be checking for break-in attempts?

  • What server ? SSH ? FTP ? – Panther Aug 18 '15 at 22:19
  • Since one of the first things a "breaker" will do is disable logging, this doesn't help. You could use a tool to monitor system changes, but there is no log file for "I have been broken into". – waltinator Aug 18 '15 at 22:27
  • @bodhi.zazen Not sure how to answer your question. It's a DigitalOcean droplet that I use to host websites via Apache. No FTP server on it. I use a private SSH key to log into it, and it also has a bunch of other SSH keys used by mail servers. – thanks_in_advance Aug 18 '15 at 23:04
  • @waltinator Interesting point. Once they've gotten in they can erase their footprints. Nevertheless, I'd like to learn to identify break-in attempts on my server. A goal (not the only goal though) is to learn to identify patterns such as certain times of the week, or IP address clusters from where attempts are being made. – thanks_in_advance Aug 18 '15 at 23:06
  • I would modify the question - how to monitor for failed ssh login attempts as you are monitoring your ssh server. You have the correct log file, although you can add custom rules to iptables to log new ssh conections and modify the verbosity of ssh (see man ssh). you might aslo consider HIDS. – Panther Aug 18 '15 at 23:25
2

SSH authentication failures are logged by default to /var/log/auth.log.

You should still see auth failures being logged there after the changes you describe -- something else must have changed. I have root login disabled entirely, and key-based auth only with passwords disabled for user accounts. I still see a few failures per hour in auth.log before they get blocked with fail2ban.

Well-designed services will log authentication failures with the syslog auth facility and would be logged here as well. It's good practice to export your logs to a remote syslog server to make it difficult for an attacker to hide their intrusion if they get root.

In a more general sense, "break-in attempts" is too vague a term for this question. It could mean anything from SQL injection to buffer overflows. Intrusion attempts can be subtle and difficult or impossible to distinguish from legitimate traffic. You can't detect every attack.

  • 1
    Not all services can be relied on to be well designed, and may not detect a break-in attempt like trying to get a web server to invoke some leftover PHP debug script. It might be logged in the webserver's log, but won't make it to auth.log – waltinator Aug 19 '15 at 3:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.