0

My Web Server is running Ubuntu 12.04.2 LTS with all security updates installed. It is used as a Web Proxy server that handles incoming requests on HTTP/80 HTTPS/443 but also retrieves web content from other servers using HTTP/HTTPS connections. The server also uses HTML5 WebSocket connection to send real-time updates to client users.

I have received a notification by three separate home users that my server allegedly performed a port scan on their ip-addresses. Unfortunately, I only know the date and time of the alleged portscan, but no destination IP or port. Also, I am unsure whether these are false alarms or my server has actually been compromised.

So far I have conducted a preliminary analysis using "netstat -anltp" to check if there is any suspicious traffic. When checking everything seems fine as there are only HTTP connections. In addition, I have executed "ps aux" to list all running processes, but I have to admit, I'm a bit lost at this point.

What are further steps that can be performed to detect suspicious traffic? What log files should be checked? What logs should be enabled to detect future suspicious outgoing traffic? What third-party tools can detect further outgoing portscans?

Improve this question
2
  • You have to do the detection on a separate computer. If your server has been pwned. your logs on that server are not reliable.
    – Deer Hunter
    Jun 25, 2013 at 11:00
  • You write them back and ask for log entries, IP addresses, and any other actual useful information they can provide.
    – Michael Hampton
    Jun 25, 2013 at 15:36

1 Answer 1

Reset to default
0

The tool that can detect outgoing portscans is tcpdump. Run tcpdump -i eth0 -w dump and then, with a lot of calm, read the dump details matching the packets sent in those dates.

Ask your users for their IPs also, if static.

Look to /var/log/auth.log and last -100 to see if someone abused your system, check for suspicious cron jobs, look into the /root directory if something strange appeared. In these cases a tool that hashize the system files (like tripwire) would be important.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .