0

I am administrating a server and obviously i am slightly paranoid if its security is compromised. Hence i regularly try to check if the security is still intact. Here are the things that i do roughly twice a week, maybe you could comment on it and/or give some additions.

I do:

  1. Run chkrootkit and rkhunter
  2. check cat /var/log/auth.log | grep opened | grep sshd:session For user logins (i know who is on vacation, hence these people should not login)
  3. Check cat /var/log/auth.log | grep opened | grep root to see if somebody gained root access (despite me)
  4. Loosely check the running tasks if something suspicious pops up

I do not really want to discuss safety measures, but rather how you check the security-integrity on a regular basis in few time (the stuff i do takes roughly 10 minutes).

Thanks for your help.

closed as primarily opinion-based by user364819, user117103, David Foerster, Eric Carvalho, Kevin Bowen May 10 '16 at 4:32

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I am aware that there are many answered questions about how to secure a server, i rather want to know how you check on a day to day basis. – jh600 Apr 20 '16 at 21:05
0

This answer is more for if you just want to simplify / automate different tasks you do using scripts and crontab.

You can set up a script that you can run whenever you wish.

#!/bin/bash

chkrootkit
rkhunter

cat /var/log/auth.log | grep opened | grep sshd:session | more
#the ' | more' splits output into multiple screens, you can cut it off if you want

read
#delays the next command, waits until you press enter to move on, again, uncomment if you are doing this automatically

cat /var/log/auth.log | grep opened | grep root | more
read
#same as previous command

ps aux          
#change this to whatever command you use to check processes...

read

Just modify the script however you see fit. Make sure it is executable with chmod +x myNewScript.sh. Run this (bash /path/to/script/myNewScript.sh) whenever you want.

You can also alias this command by putting alias secCheck='bash /path/to/script/myNewScript.sh in your .bashrc file (home dir). Then just run secCheck at any time whenever you want to check security.

If you want to make the script automated, as in no user interaction needed, remove all read's and output the cat's somewhere to maybe check later, etc. You can then set up crontab to run the script as frequently as you like.

1

I would personally suggest a piece of software called OSSEC HIDS (Host Intrusion Detection System) which if configured properly (which is reasonably easy to do so, just follow the installer) will regularly send you system and security related information such as what is listening on which port, if the hashsums of any important files have been changed, when software is installed, removed, purged, or upgraded, if any adapters enter promiscuous mode, etc. It is also highly customizable so you can change what it alerts you about and increase certain alerts such as the files it monitors.

I would also suggest that you regularly scan your server with an AV such as clamav which can be installed with.

And that you setup fail2ban to block any hackers trying to login into your server many times trying to brute force their way in.

  • I have fail2ban up, there are really a lot of people from China trying to brute force the server :-) OSSEC sounds interesting, thanks for the suggestion. – jh600 Apr 20 '16 at 21:16

Not the answer you're looking for? Browse other questions tagged or ask your own question.