1

I have looked at many logs and it seems that some of them are more relevant for monitoring purposes against hackers. The ones I found are:

-auth.log
-mail.log: if i'm running a mail server, will this be important?
-btmp
-secure
-faillog
-apache2/access.log
-mysql.log & mysql.err

Note: I'm running LAMP and using phpMyAdmin to access DB.

Is there anything that is useless in that list? Anything that I should include?

Also, I fail to open up these log files that don't have ".log" extensions. I guess I'm supposed to execute them, but even User doesn't have execute permissions on them and when I chmod 700, nothing happens when I execute them. How am I supposed to do it?

Thanks in advance

2 Answers 2

3
  • error.log of your httpd-Server
  • Your php-error-log (wherever you configured it to be)

Apart from that this is not enough to protect your system. Using IPS (like SELinux) and a HIDS (like aide, samhain or tripwire) will help more than that.

If your PHP-Application has SQL-injection problems you need to review your code - as these measures will not help either.

2
  • Thank you for your help. I will look up your suggestions. As for the SQL injections, I am using PDO in my PHP app. This is probably secure enough isn't it? Thanks again
    – ericd
    Sep 27, 2012 at 1:06
  • @ericd PDO is just an abstraction layer for sql-type databases (so you do not need to change the code much if you switch from mySQL to MSSQL, Oracle or Postgres or ...). It does imho not prevent sql-injections.
    – Nils
    Sep 27, 2012 at 20:40
1

What is put in each log is determined by /etc/rsyslog.conf (for debian squeeze -- different if you are using a different syslog daemon).

auth.log usually will show password hack attempts, I monitor for ssh attempts. apache2/error.log will give you http errors.

mail.log is important -- we use sendmail / dovecot and sasl, sasl and dovecot show up here.

I would recommend looking at the package fail2ban. If you install it for your distribution, it should have some of the settings already tuned to what you've got. It looks for login failures and errors, can be configured to email you hack attempts as well as automatically block offending IP addresses and ports.

1
  • Thanks for your suggestion. I will read fail2ban documentation
    – ericd
    Sep 27, 2012 at 1:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .